{"action":"created","issue":{"url":"https://api.github.com/repos/OWASP/ASVS/issues/57","labels_url":"https://api.github.com/repos/OWASP/ASVS/issues/57/labels{/name}","comments_url":"https://api.github.com/repos/OWASP/ASVS/issues/57/comments","events_url":"https://api.github.com/repos/OWASP/ASVS/issues/57/events","html_url":"https://github.com/OWASP/ASVS/issues/57","id":92835595,"number":57,"title":"remove excessive logging requirements","user":{"login":"countermode","id":13163914,"avatar_url":"https://avatars.githubusercontent.com/u/13163914?v=3","gravatar_id":"","url":"https://api.github.com/users/countermode","html_url":"https://github.com/countermode","followers_url":"https://api.github.com/users/countermode/followers","following_url":"https://api.github.com/users/countermode/following{/other_user}","gists_url":"https://api.github.com/users/countermode/gists{/gist_id}","starred_url":"https://api.github.com/users/countermode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/countermode/subscriptions","organizations_url":"https://api.github.com/users/countermode/orgs","repos_url":"https://api.github.com/users/countermode/repos","events_url":"https://api.github.com/users/countermode/events{/privacy}","received_events_url":"https://api.github.com/users/countermode/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/OWASP/ASVS/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"vanderaj","id":5029993,"avatar_url":"https://avatars.githubusercontent.com/u/5029993?v=3","gravatar_id":"","url":"https://api.github.com/users/vanderaj","html_url":"https://github.com/vanderaj","followers_url":"https://api.github.com/users/vanderaj/followers","following_url":"https://api.github.com/users/vanderaj/following{/other_user}","gists_url":"https://api.github.com/users/vanderaj/gists{/gist_id}","starred_url":"https://api.github.com/users/vanderaj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vanderaj/subscriptions","organizations_url":"https://api.github.com/users/vanderaj/orgs","repos_url":"https://api.github.com/users/vanderaj/repos","events_url":"https://api.github.com/users/vanderaj/events{/privacy}","received_events_url":"https://api.github.com/users/vanderaj/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/OWASP/ASVS/milestones/3","html_url":"https://github.com/OWASP/ASVS/milestones/3.0","labels_url":"https://api.github.com/repos/OWASP/ASVS/milestones/3/labels","id":1201855,"number":3,"title":"3.0","description":"","creator":{"login":"vanderaj","id":5029993,"avatar_url":"https://avatars.githubusercontent.com/u/5029993?v=3","gravatar_id":"","url":"https://api.github.com/users/vanderaj","html_url":"https://github.com/vanderaj","followers_url":"https://api.github.com/users/vanderaj/followers","following_url":"https://api.github.com/users/vanderaj/following{/other_user}","gists_url":"https://api.github.com/users/vanderaj/gists{/gist_id}","starred_url":"https://api.github.com/users/vanderaj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vanderaj/subscriptions","organizations_url":"https://api.github.com/users/vanderaj/orgs","repos_url":"https://api.github.com/users/vanderaj/repos","events_url":"https://api.github.com/users/vanderaj/events{/privacy}","received_events_url":"https://api.github.com/users/vanderaj/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":68,"state":"open","created_at":"2015-07-10T04:07:21Z","updated_at":"2015-08-11T04:24:28Z","due_on":"2015-09-20T14:00:00Z","closed_at":null},"comments":6,"created_at":"2015-07-03T09:35:51Z","updated_at":"2015-08-11T07:52:22Z","closed_at":"2015-08-11T04:24:28Z","body":"Various items require logging to which I strongly disagree. To begin with, in countries with stricter privacy protection laws this kind of logging requires the consent of the users and/or employees. Even if this consent is given, this data is personally identifiable (and this includes even MAC- and IP-addresses as by the European Court of Justice) and must be controlled very strictly. Many enterprises and organizations opt for not logging for this reason. Secondly, what is the benefit of logging without reaction? Most of my customers hoard mounds of data without being able to get any benefit from that.\r\nI propose to replace requirements of the kind \"verify that events XYZ are logged\" are converted to \"verify that events XYZ are properly reacted on\"."},"comment":{"url":"https://api.github.com/repos/OWASP/ASVS/issues/comments/129746541","html_url":"https://github.com/OWASP/ASVS/issues/57#issuecomment-129746541","issue_url":"https://api.github.com/repos/OWASP/ASVS/issues/57","id":129746541,"user":{"login":"countermode","id":13163914,"avatar_url":"https://avatars.githubusercontent.com/u/13163914?v=3","gravatar_id":"","url":"https://api.github.com/users/countermode","html_url":"https://github.com/countermode","followers_url":"https://api.github.com/users/countermode/followers","following_url":"https://api.github.com/users/countermode/following{/other_user}","gists_url":"https://api.github.com/users/countermode/gists{/gist_id}","starred_url":"https://api.github.com/users/countermode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/countermode/subscriptions","organizations_url":"https://api.github.com/users/countermode/orgs","repos_url":"https://api.github.com/users/countermode/repos","events_url":"https://api.github.com/users/countermode/events{/privacy}","received_events_url":"https://api.github.com/users/countermode/received_events","type":"User","site_admin":false},"created_at":"2015-08-11T07:52:22Z","updated_at":"2015-08-11T07:52:22Z","body":"Hello Andrew,\n\nI think that will do.\n\n\nBest\n\nAm 11.08.2015 um 06:24 schrieb Andrew van der Stock:\n> V8.10 has been adjusted:\n>\n> Verify that the application does not log sensitive data as defined\n> under local privacy laws or regulations, organizational sensitive\n> data as defined by a risk assessment, or sensitive authentication\n> data that could assist an attacker, including user’s session\n> identifiers, passwords, hashes, or API tokens.\n>\n> This covers off the text at the beginning and is quite specific.\n> Please let me know if this is sufficient, or if we need to have\n> another go.\n\n-- \n--------------------------------------------------------\nSecorvo ist TOP CONSULTANT 2015, Kategorie \"IT-Berater\"\nhttp://www.secorvo.de/auszeichnungen\n--------------------------------------------------------\n\nDr. Safuat Hamdy\nSecurity Consulting\n\nSecorvo Security Consulting GmbH\nEttlinger Strasse 12-14, D-76137 Karlsruhe\nTel. +49 721 255171-304, Fax +49 721 255171-100\nsafuat.hamdy@secorvo.de, http://www.secorvo.de\nPGP: 6A83 EC49 8474 D77C 1258  AE91 4BB4 8DEE 952A 2506\n\nMannheim HRB 108319, Geschaeftsfuehrer: Dirk Fox\n"}}