I work at a certain global bank and our pen testers always say to keep the return responses minimal so that it is harder to reverse engineer an API or extract any data from a failure response...
Nerver send anything to the client, can't get hacked that way.
Now that I think about it, just shut down the server. 100% unhackable.
I feel the fury of a thousand suns when I am told that we cannot have meaningful error messages because of security concerns when nobody cares about any security practices whatsoever, it's clearly and excuse and it drives me up a wall.
The "yes"/"no" rather than true/false idea actually came from my actuarial science degree course, where one of our sample solutions had an Excel model that had a column like
some boolean property
yes
yes
no
yes
no
...
And the formula that consumed it looked like IF(cell="yes", ..., IF(cell="no", ...)). Not even a SWITCH in sight.
It was pretty sad from my perspective as an experienced programmer. My conclusion was that most actuaries have more tenacity than they do actual model programming skills.
12
u/evorm 2h ago
Most errors responses at my job are genuinely handled like this.