How to get the convenience of #[instrument] while avoiding the accidental capture of sensitive data?

[lopter]

Hello,

#[instrument] is very useful, but since it records all arguments by default I was wondering how folks are avoiding the accidental capture of sensitive data such as private keys?

Was the reverse approach considered? (Meaning skip_all is the default, and then you would have to opt-in with e.g. record_all).

[mladedav]

There's an issue about that considering to reverse the default in the next breaking release. But that probably won't be anytime soon.

[lopter]

Fair, if there is an issue for this I could not find it.

I am getting a whisper in my ear that a non-default feature flag may also be another way to deal with this.

Default feature set would let #[instrument] work as it is, and a feature like safe-instrument-by-default would switch the semantic of #[instrument] to #[instrument(skip_all)]. A record_all argument would allow you to opt-in.

Wdyt?

[mladedav]

Features are a notoriously bad choice for changing behavior (as opposed to extending API) because of feature unification. If anything in your dependency tree decides to turn the feature on, there isn't a way for you to opt out of it.

You could just create a instrument-like macro that just changes the default but otherwise does the same thing. I think it could just generate the instrument attribute, adding skip_all if needed. It just wouldn't be part of tracing itself.