I am currently trying to go through a Code Review at a large bank to get our code approved for release on the internet. One thing that came up was in some situations, we are displaying the raw exception message which was listed as a no-no, which I disagree with. While it's not particularly informative to the user which is potentially an issue, I can't see where “Invalid use of null” is going to be particularly useful to a hacker, but to a developer, that tidbit may help identify the problem when the user calls for help (good application logging aside in this example). Ironically, when errors weren't handled because the developer forgot, this passed code review.

So my intent was to enumerate all the default error messages to determine if there are any which would be particularly helpful to a hacker. While I am still looking to find or create an application which will enumerate all the default messages that .New throws out, I did come across a great article which lists the various error handling philosophies, and tries to weigh out the pros and cons of each. Here's where to get this pearl of wisdom:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/exceptdotnet.asp