Slashdot Mirror
Free Web-Based Exception Reporting
Tsar writes "Promethean Personal Software (makers of Sherpa, a code generating tool for db apps) have quietly released ExceptionCollection, a free (as in beer) online service for developers using any SOAP-enabled environment. You sign up on the site, download their component, add three or four lines of code to your app, and any exceptions thrown by your users get logged at ExceptionCollection.com for your later perusal (the last 100 anyway). There are several options, like whether reporting requires user approval. Is this as cool as it looks, or a solution in search of a problem?"
Why don't you just add one more function to your SOAP server and have your exception handler connect to that?
I can't think of any reason NOT to send detailed information about where my application is broken and possibly exploitable to one centralized location that I maintain no control over.
I wonder what they do with their exceptions.
It only allows the developer to see the last 100 exceptions? That might be fine and dandy for a site that only receives 100 hits per day. But when you're running an enterprise-grade site that gets 5 or 6 million hits on a slow day, 100 exceptions will basically be nothing. You could probably sit there and refresh the list of exceptions, getting a completely new list each time.
Cyric Zndovzny at your service.
"but I don't know anyone who actually sends in bug reports when an application crashes in XP"
There are several reasons for this... you almost never get any sort of reply, most users are practically incapable of writing a useful bug report (what were you doing, what did you click, etc.) and from what I see the majority of the information in an XP error report such as this is just some processor states and a few technical details.
I fail to see how anyone but a machine code professional would decode the XP reports, or how they would know what state the machine was in or why it crashed. The open-source project, OpenTTD, had this same feature for a while until it was scrapped when they realised that no-one could interpret the results or, if they could, it was far too complex, far too time-consuming and far too vague to the programmers.
I'm not saying you COULDN'T make the debug reports much better but then you're basically building every executable in a debug state, i.e. massively bloated and not as good performing, even if you go the highly-manual route and go through the code putting in printf's for each procedure entrance.
Bug reports are invaluable to a programmer but they need to be the right type. Spending 7 hours to trace the machine code route through a hex dump to find that someone was running it on a machine with a corrupt DLL is a massive waste of resources.
Getting experienced beta- and alpha- testers to submit a detailed, reproducible, bug where you can actually ask them to try patches out for you is amillion times more useful
I think I'll stick with recording my exception logs in my own database where I have some measure of security around it, and can look at all of them, not the last 100.
I used to do something like this using my personal web site. I didn't use it for exception reporting -- just for publishing generic statistics about our production stream. I could then monitor them remotely from my cell phone's web browser.
The key thing to be concerned about (as others have observed) is that any messages sent must be sufficiently generic so as not to give away vital information to the outside world.
When I published my stats, I used abbreviations that only I understood followed by percentages. That's it. If someone else saw it, they wouldn't understand it, and, even if they did, it was just non-vital aggregate information that wouldn't do them any good anyway.
This is the maximum level that such exception reporting could (wisely) rise to, and, as such, would be of limited value. I know from my own experience at large companies that log/exception output tends to contain things like userIDs, passwords, and server names, which could easily find itself passed along through these folks' API.
For this reason, it seems like a good service if installed internally, but a bad idea beyond proof of concept for anything larger than a mom-and-pop, where a single programmer knows and understands the whole system and can send sufficiently vague exceptions.
What if your code throws some exception you weren't expecting, even though you use return codes?
Examples:
1. Your code invokes a method on an object you didn't code, and it throws an exception. Wouldn't it be nice to know where the exception happened?
2. You made an unanticipated mistake! Your code throws a null pointer exception. Of course, if you are perfect, this never happens.
Remember to strip out an connection strings/password etc from you exception info if you're think of using this...
Why you would, I don't know. But still.
Pete
Wouldn't you be able to catch either of those in debug?
A more logical response to an exception than graceful handling is actual handling. If you run out of memory, what will you do? If you are receiving null pointers, how can you stop the sender from doing that? If your program is calling an unimplemented function, why isn't your linker catching it?
Exceptions are a way of making easily found bugs difficult to find. They move the instruction pointer far away from the actual error, and unroll the stackframe needlessly.
Just keeping the exceptions in the logfiles so you can literary put anything in the exception what you want, not having to wonder if some debug information which happens to be equal to a clients transaction wanders around on the network or even the internet. Plus logfiles can be analyzed too, enough handy tools around for that too (I use vi).
My wife's sketchblog Blob[p]: Gastrono-me