Skip to main content
2 of 3
replaced http://serverfault.com/ with https://serverfault.com/

Should anonymizing IP addresses, hostnames, company names and other PII be encouraged?

Not to pick on any particular question, but I noticed this question doesn't appear to have anonymized:

  • an IP address from the server access log
  • the referer header
  • the domain name of the site being configured

Now, I should clarify that I don't think there's anything wrong with doing that, per se. The person who runs the site has the right to mention their site and post their logs. That's all fine. The OP should be allowed to do that if they want to for whatever reason.

However, I feel like there should be a community policy on this. Specifically, I feel like we should encourage anonymizing that kind of thing. Here are a few reasons:

  • If you're posting a question on here, you're often posting that question because something isn't working, or is behaving unexpectedly. So, by definition, whatever system you're talking about is misconfigured. That misconfiguration may be harmless, but it may well be exploitable. A default policy of asking people to obscure / change details which identify the machine(s) they're configuring (e.g. domain name, IP address) will keep them (and their users) protected without significantly affecting the quality of questions and answers.

  • Example addresses are available for most protocols (e.g. *.example.com for DNS, the 203.0.113.0/24 subnet for IP), and situations like this are perfect opportunities to use those addresses.

  • Whoever owns that client IP address probably wouldn't want it arbitrarily posted. We have no reason to believe that person was being abusive, and their specific information almost certainly isn't relevant to the question at hand. Is it unethical to post their information? No. But it is impolite.

I feel like there's already an informal culture of being careful not to share anything too sensitive (like authentication tokens or HIPAA data), but it would be nice to have an explicit, unambiguous policy on information which may not be legally restricted but which it could be irresponsible to disclose. Partly because I feel like this is something that most people don't even think about at all, and once you post that information and realize you probably shouldn't have it's already too late (because the information cannot be removed; it remains available in the revision history and in the caches of sites which crawl and archive SE-network sites).