4 ms·

Logback has an interesting commit[1]: "disassociate logback from log4j 2.x as much as possible". They also updated their landing page [2]: "Logback is intended

Logback has an interesting commit[1]: "disassociate logback from log4j 2.x as much as possible". They also updated their landing page [2]: "Logback is intended as a successor to the popular log4j project, picking up where log4j 1.x leaves off. Fortunately, logback is unrelated to log4j 2.x and does not share its vulnerabilities." Can't say I blame them. [1] https://github.com/qos-ch/logback/commit/b810c115e363081afc70f8bf4ee535318c3a34e1 https://github.com/qos-ch/logback/commit/b810c115e363081afc7... [2] http://logback.qos.ch/ http://logback.qos.ch/ EDIT: Removed Apache from Apache Logback since, as correctly pointed out, it's not a Apache project.

Symbiote 5y ago
Logback, not Apache Logback. It is not an Apache project.
dikei 5y ago
This is such a cheap move by Logback, which comes from the former lead developer of Log4j 1. I used to like it for its technical merits: it's really much better than Log4j 1. But its development has stagnated, and it doesn't offer anything over Log4j2 nowadays. Furthermore, it's not an Apache project, it doesn't even use the Apache License, but LGPL.
- Aperocky 5y ago
  > it doesn't offer anything over Log4j2 nowadays. That's a major plus.
- jsiepkes 5y ago
  > But its development has stagnated, and it doesn't offer anything over Log4j2 nowadays. I would say that a logging framework also needs to be boring. I don't understand why string interpolation with access to the JNDI context needs to be in core Log4j2. Less is more so to say.
- d3nj4l 5y ago
  Logback is dual licensed as LGPL and EPL (Eclipse Public License).
- lolinder 5y ago
  I don't think it's them being cheap, I think they're reacting to a flood of questions. My very first question when I saw this was if logback was impacted. As soon as I found OP's comment, I could relax and eat breakfast.
d3nj4l 5y ago
I don't think that's them being cheeky or anything. The first thing I thought of when I saw this vuln was whether logback was also affected - a lot of the services at my workplace use logback, and I've used logback for a couple of personal projects. It makes sense for them to come out today and say "We are not associated with log4j2 and don't have this vulnerability", especially because logback was built to succeed log4j 1.

Symbiote 5y ago

Logback, not Apache Logback. It is not an Apache project.

dikei 5y ago

This is such a cheap move by Logback, which comes from the former lead developer of Log4j 1. I used to like it for its technical merits: it's really much better than Log4j 1. But its development has stagnated, and it doesn't offer anything over Log4j2 nowadays. Furthermore, it's not an Apache project, it doesn't even use the Apache License, but LGPL.

Aperocky 5y ago
> it doesn't offer anything over Log4j2 nowadays. That's a major plus.
jsiepkes 5y ago
> But its development has stagnated, and it doesn't offer anything over Log4j2 nowadays. I would say that a logging framework also needs to be boring. I don't understand why string interpolation with access to the JNDI context needs to be in core Log4j2. Less is more so to say.
d3nj4l 5y ago
Logback is dual licensed as LGPL and EPL (Eclipse Public License).
lolinder 5y ago
I don't think it's them being cheap, I think they're reacting to a flood of questions. My very first question when I saw this was if logback was impacted. As soon as I found OP's comment, I could relax and eat breakfast.

d3nj4l 5y ago

I don't think that's them being cheeky or anything. The first thing I thought of when I saw this vuln was whether logback was also affected - a lot of the services at my workplace use logback, and I've used logback for a couple of personal projects. It makes sense for them to come out today and say "We are not associated with log4j2 and don't have this vulnerability", especially because logback was built to succeed log4j 1.