When shipping software to a client, should debug symbols (.PDBs) be bundled with it? If the client finds a bug or vulnerability in the software, a full stack trace (and a memory dump if possible) would be very helpful for the vendor in reproducing it.
What are the pros/cons of giving clients debug symbols?
Clients don’t need debug symbols to send crash dumps to vendors. Automated systems like Windows Error Reporting make it possible for clients to report crash dumps to vendors without even having to know what a crash dump is. And clients can always send you a kernel crash dump or a user mode minidump manually. You do need to keep the PDBs for your release builds around to do any post-mortem debugging.
Clients don’t need debug symbols to report stack traces. If you don’t enable frame pointer omission, a stack trace from a client’s machine should be intact enough that you can decode it using the debug symbols or map files.