Like if I’m using print statements to test my code. Is it okay to leave stuff like that in there when “publishing” the app/program?

Edit: So I meant logging. Not “tests”. Using console.log to see if the code is flowing properly. I’ll study up on debugging. Also, based on what I managed to grasp from your very helpful comments, it is not okay to do, but the severity of how much of an issue it is depends on the context? Either that or it’s completely avoidable in the first place if I just use “automated testing” or “loggers”.

  • Septimaeus@infosec.pub
    3·
    6 days ago

    Great question.

    There’s no universal rule against it and descriptive logs and errors are considered good practice, but one-off test statements in output are a common code smell, which isn’t a proper bug but suggests there might be one elsewhere.

    Why?

    The reasoning for this varies but for example:

    • in most settings, output is expected to be meaningful; for example a print statement in a C program is included in its result and expected to be parsable, even if it’s just a number like 0 (success)
    • logging specific values can expose runtime data that sometimes shouldn’t be exposed, or can otherwise offer an attacker intel about the application structure
    • debug statements in logging can indicate the dev has not yet learned to use a debugger, the preferred tool for that job
    • logging non-descriptive or otherwise unhelpful messages can indicate the developer is aware of a bug they’re attempting to catch on prod, or maybe just has a habit of not cleaning up after themselves
    • otherwise, obvious output-based testing might suggest the developer is not writing unit tests or maybe has no test harness at all, which for any larger application is a big red flag to most experienced developers

    Again there’s no hard and fast rule against it, and whether it’s frowned upon depends on the context. For example, I actually expect slapdash logging in stuff like one-off scripts, app mockups, recently scaffolded projects, and so forth.

    Also, not every codebase merits a full testing solution. I would consider it a form of premature optimization, which is more of a process inefficiency than a mistake but should still be avoided.

    Most importantly, it’s OK to be a beginner. I wouldn’t think poorly of a developer due to a code smell like this. It’s more like an opportunity to learn, and IMO you’re ahead of the game for even thinking to ask.

    Edit: use spoiler for info dump