Finding Logs Where I Didn't Expect Them
When I first logged into the server, I expected to confirm what I already believed.
After all, I had designed the application.
I knew how the mediator worked.
I knew that messages weren't being stored.
I knew that files weren't being archived.
What I didn't know was what the underlying operating system was doing.
That distinction turned out to be far more important than I'd expected.
The first thing I discovered was that the server wasn't completely silent.
There were logs.
Not because the application was deliberately recording conversations, but because modern operating systems record all sorts of information.
- Services write to system journals.
- Background processes generate events.
- Web servers maintain their own records.
Applications can inherit logging behaviour without the developer ever realising it.
That was an uncomfortable discovery.
Not because I'd found anything catastrophic, but because it challenged one of my assumptions.
I had been thinking like an application developer.
The operating system was thinking like a system administrator.
Those are not always the same thing.
The next surprise was that fixing the problem wasn't simply a case of deleting a file.
First, I had to identify where information was being recorded.
Then I had to determine which logs were relevant.
Some were associated with the application.
Some belonged to the operating system.
Others were generated by the web server.
Each one had to be examined individually.
At one point, I found myself looking at multiple logging mechanisms, each with a different purpose and a different configuration.
The lesson was obvious.
Privacy doesn't begin and end with your own source code:
- The infrastructure matters.
- The operating system matters.
- The supporting services matter.
And assumptions can be very misleading.
By that stage, I had stopped trying to prove that SecurityNet was right.
Instead, I was trying to prove myself wrong.
I think that's a much healthier approach.
Because if you can't challenge your own assumptions, somebody else eventually will.
The difficult part was deciding what the evidence really meant.
