9 ms·
Jndi: An irresponsibly bad logging library
- i386 5y agoI’ll be gloating about the next golang security issue
- egeozcan 5y agoPeople have been joking about left-pad any time they hear about nodejs. This isn't unexpected. It could be because people want to rationalize their technology choices. Perhaps not all of them, some of us really like having a laugh for how broken the industry is :)
- i386 5y agoI agree. All software is utter garbage.
- lovelearning 5y agoWhat's the intention behind this repo? Seems to me the effort could have been better redirected towards fixing the insecure library instead. I'm not familiar with the Go ecosystem - is there some "Go more secure than Java" culture of mocking there?
- Ygg2 5y agoNo. This is just mocking. I'm sure no library in <Insert language here> had scope creep that led to vulnerability.
- bradfitz 5y agoI'm the author of the "mocking". I prefer to call it coping. :) I had a CVE against my own code just yesterday. It happens. I made fun of myself too: https://twitter.com/bradfitz/status/1469015417679081472 https://twitter.com/bradfitz/status/1469015417679081472
- eecc 5y agoHeh, go errori checking FTW! Well you did choose your poison… ;)
- CuriousCosmic 5y agoIt's just a joke and taking the piss out of the whole ordeal more than anything else.
- tehlike 5y agoBradfitz is a pretty solid eng, and clearly doing this for fun.
- cmeacham98 5y ago> Seems to me the effort could have been better redirected towards fixing the insecure library instead. It's already fixed and released with the fix. I also like to steer away from this type of reasoning, because it's applicable to almost anything: why are you here commenting on HN when you could be helping with the fix or doing charity work?
- pkulak 5y agoTrust me, what I'm doing right now isn't productive either.
- pm90 5y agoIt’s a demonstration in golang of what the vuln is. The assumption (not a bad one) is that golang devs may not be familiar with Java things and happenings. I can actually use it and simulate what an attacker could do. So it lets golang devs play with the problem. The problem with this vuln is that since this library is a Java library that’s used everywhere, remediation is going to have a really long tail. There are a fuckton of apps that use this logger and it’s owners are not aware of it. Or it’s used in a part of a stack that’s not tracked yet… nobody can really tell.
- bradfitz 5y agoI wrote the repo. I preemptively apologized for the bad joke: https://twitter.com/bradfitz/status/1469523009484431363 https://twitter.com/bradfitz/status/1469523009484431363 https://twitter.com/bradfitz/status/1469523985998118925 https://twitter.com/bradfitz/status/1469523985998118925 It started with me reading seeing this tweet: https://twitter.com/_StaticFlow_/status/1469358229767475205 https://twitter.com/_StaticFlow_/status/1469358229767475205 And I was just thinking it'd be fun to implement an expander for those. (https://twitter.com/bradfitz/status/1469526259335974912 https://twitter.com/bradfitz/status/1469526259335974912)
- deleted 5y ago[deleted]
- xvector 5y agoIt's a good joke
- geodel 5y agoSeems you are not familiar with Java either as the insecure log4j2 library is already fixed by volunteers.
- eyelidlessness 5y agoI can only speak for me, but isolated demonstrations of security vulnerabilities have definitely helped me learn both how to anticipate and identify issues in real work. Jokes still work well for that purpose. Sure, it wasn’t a direct contribution to log4j but maybe it provides some reference material to someone building another library which could benefit from knowing the possible exploit.
- kyruzic 5y agoIts a joke. Its 100 lines total. Probably took an hour. Why didn't you fix a bug with an open source library instead of writing this comment?
- Tepix 5y agoThe project comes across as arrogant. Perhaps it's just me.
- pas 5y agoCould you explain that please? Why does it seem arrogant?
- deleted 5y ago[deleted]
- bradfitz 5y agoI almost stopped myself from posting it over such concerns, but I wasn't about to let all those minutes go to waste without sharing a joke to some. It was really just meant for Twitter banter. I was just screwing around bored in transit while reading about all log4j substitution types.
- rodgerd 5y agoI'm glad you took the time to shit on the three unpaid volunteers who keep software used all over the world. I hope it makes you feel big and clever.
- csande17 5y agoYour attitude is how this log4j issue made it into production and stayed there for so long.
- zrail 5y agoThis attitude is so peculiar and pernicious. As far as I can tell it's basically: when someone does something we find bad or wrong the only appropriate reaction is gratitude for their hard work and effort. Any other reaction could lead to them feeling bad. That's bullshit. People make mistakes. People do malicious things under the guise of making a mistake and then hide behind this weirdly passive attitude.
- 5y ago
- madmod 5y agoGood satire. Code can be art too. Everyone here is taking this way too seriously.
- dimgl 5y agoYeah I thought this was pretty funny. I AM trying to understand why people are so mad though.
- csande17 5y agoEnterprise Java developers are scared to face the underlying human and cultural factors that led to such a massively boneheaded security vulnerability being possible.
- pas 5y agoAhaha. Unfortunately they are not. As in they don't care enough to fear or face it.
- pjmlp 5y agoEnterprise Java developers are ex-CORBA/DCOM/Smalltalk/Common Lisp developers actually, now busy building scalable Kubernetes clusters with Go to process CSV files with proper failover mechanisms.
- dimgl 5y agoLOL this one got an audible chuckle out of me
- mrighele 5y agoReal Enterprise Java developer are probably still using log4j 1.x so are unaffected by the bug.
- lordfoom 5y agocan confirm :D
- tommiegannert 5y agoThis is actually a very friendly nudge... It only downloads and replaces the jndi escape sequence. No remote code execution. This could be extended using https://pkg.go.dev/plugin https://pkg.go.dev/plugin (Although, keeping it friendly is probably a good idea.)
- bradfitz 5y agoI considered it but stopped myself before actually running the response body from the HTTP GET. Too much :)
- Woodi 5y agoFirst - JNDI is not logging library. I get that module can be named anything author wishes but it is too much after yesterdays "but why LDAP even in picture" comments... :) JNDI is just: java Naming and Directory Interface: https://docs.oracle.com/javase/tutorial/figures/jndi/jndiarch.gif https://docs.oracle.com/javase/tutorial/figures/jndi/jndiarc... And all that log4fun is much more then one or two libraries bugs. Maybe even no or almoust no software bugs involwed ? List of "features" in play :> - log4j include realy rich log messages parser... - not proper usage of logs formats - log4j have ability to call to the network... - Internet calls are allowed from backend facing service like logger... - parsing "dot" have surprising effects - did't saw that in code, info after HN comments - log4j have ability to ask any database including LDAP for configuration - configuration have form of executable code :> .class WTF !!! - Java have ability to load .class files at runtime, analogous to linker .so/.dll files. Except Java can do this for files from network. Buitl-in feature, pretty automatic :> - security manager was off on JNDI, probably becouse naming services like directories for names and configurations are supoused to be internal and protected... - no one use Java sacurity manager, at least it's very serious and enterprise-only black magic (voices in the internet: no! it's not so hard to use ! just some certs!) - security manager is planned to be removed from Java anyway :) - security bugs from years ago didn't realy fixed... and last but no least: - Minecraft servers are being hacked all over the world ! Chaos and panic ! :) Something more ? :) Now, do loading executables from network is standard enterprisy practice ? Getting .dll's or COMs from db ? I hear once from Sun employee about SQL queries looked up from LDAP server. But it is Oracle now...
- bradfitz 5y agoOn the name: I knew jndi wasn't accurate (I read the 2016 blackhat slides) but the name I was going to use for the joke, log4g, was already in use and I didn't want to screw with their search results.
- rendall 5y agolog4gol is the project name no one needs, but that we deserve, or something
- 5y ago
- keyle 5y agoThis is great but I feel this needs a javascript interpreter. Like a VM, and every log entry could be stored on a blockchain with a stack machine.
- dorianmariefr 5y agodef log(input) puts eval(input) end Here you go, so powerful, so great
- kazinator 5y agoWhat I would be concerned with is this, before anything else: import "github.com/bradfitz/jndi" where is the version specified of what we are fetching? And at least a SHA256 to validate that it continues to be the same as what we fetched the first time, once upon a time? Without this, a good, secure logging library can suddenly turn bad in between your rebuilds, and you don't know. You probably want this piece to be cached locally, so your project builds even when the network or github is down. Do people really code like this?
- neild 5y agoThe version is specified in the go.mod file. The checksum of the module at that version is saved in the go.sum file. And on initial download the module checksum is validated against a auditable checksum database to verify that it matches the expected value for that module and version. See: https://go.dev/ref/mod#authenticating https://go.dev/ref/mod#authenticating
- alkonaut 5y agolog4j actually has something replacing an expression in curly brackets with something that can make a network call? And that just sat there? From the look of it, it’s not just an edge case of jndi either, it seems it’s the purpose of the whole prefix? When would a network request ever be a valid thing to do as a result of logging? Not to mention, when would it ever be acceptable to run remote code as a result? Or was the execution of a remote class using a vulnerability and not by protocol design?
- pja 5y agoThis was by design. Java has a history of these kinds of wild exploits ever since the XML days. The original use case was probably something like: we want to be able to customise the logging on a per user/customer basis, so if we can make a call to our LDAP server, we can return a Java class that will implement that customisation. This is enterprise level thinking. Some history from cloudflare here: https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/ https://blog.cloudflare.com/inside-the-log4j2-vulnerability-...
- ljm 5y agoThis is definitely the kind of thing you'd get from an enterprise IT consultancy when you ask for an ERP system and require services to authenticate via ActiveDirectory.
- xvector 5y agoNever go full enterprise level thinking.
- sildur 5y ago> This is enterprise level thinking. An enterprise-level app must be like a slum built on a minefield, then.
- dtgriscom 5y agoMore like a disco dance floor built on a minefield.
- fmajid 5y agoI’ve always loathed login and its Python offspring logging for over engineering and enterprisey code stench, and now I can gloat.
- fmajid 5y agos/login/log4j/g Pesky autocorrect...
- ir193 5y agoWe should not make fun of log4j2 developers for the work they're not paid for, they made it in their spare time. it's a shame so many companys are using log4j2 but few(if not none) sponsor them. https://github.com/sponsors/rgoers https://github.com/sponsors/rgoers