3 ms·
Exactly. If we paid people to maintain log4j, they'd try to justify their existence by writing more code and shipping it in log4j. But log4j doesn't need more c
by csande17 5y ago
Exactly. If we paid people to maintain log4j, they'd try to justify their existence by writing more code and shipping it in log4j. But log4j doesn't need more code to be secure, it needs dramatically LESS code!
The correct answer here isn't "pay people to make log4j even worse", it's "don't use log4j".
- seoaeu 5y agoIdentifying and removing superfluous code seems like exactly the kind of unexciting work that a developer might only consider if they are compensated.
- throwaway47292 5y agoHow many developers have you seen to do that? Removing code is twice harder than writing it. Sometimes even more than twice, not only technically, but politically.