3 ms·
Is there a more generous perspective than this? I've been reading but from what I can tell this was just a terrible idea. Hindsight is 20/20 and all - but reall
by oldcigarette 5y ago
Is there a more generous perspective than this? I've been reading but from what I can tell this was just a terrible idea. Hindsight is 20/20 and all - but really?
- IiydAbITMvJkqKf 5y agoI think the "generous" perspective is that there was a JRE update once which disabled the remote code execution feature by default. Note, this was a JRE update, not a log4j update.
- hn_throwaway_99 5y agoNote, as others have commented, the JRE change prevented the fully open-ended RCE where you could download classfiles from an external server and run them. However, the log4j bug does still allow posting of environment variables to external servers, even with the JRE changes, which could be just as catastrophic. That was my understanding anyway, someone correct me if I'm wrong.
- x0x0 5y agoNo, the log4j devs really seem to have thought it was a good idea to have this (1) built, and (2) enabled by default. One of them was on twitter whinging that they needed it for backcompat. I just can't.