4 ms·
Money spent on dedicated testing might have discovered it earlier perhaps?
by taberiand 5y ago
Money spent on dedicated testing might have discovered it earlier perhaps?
- jsiepkes 5y agoI don't really see how the Log4J2 issue would have been uncovered by testing. It's not really a bug but more of a design flaw. The reason is that the whole JNDI string interpolation feature by itself opens a door to a whole world of layered complexity which you can't comprehend. And even if you could comprehend it all Java could add some feature to JNDI which introduces an issue which wasn't there when it was all tested.
- brabel 5y agoExactly, the JNDI feature has been on the docs for everyone to see for several years: https://logging.apache.org/log4j/2.x/manual/lookups.html https://logging.apache.org/log4j/2.x/manual/lookups.html Anyone who knows anything about JNDI would've immediately recognized that this was an incredibly bad idea, as JNDI attacks are well known around black-hat circles (LDAP is just one of the things you can do once you have JNDI available). Yet, here we are, several years later, acting surprised this thing existed and thinking that tests would've helped!? What kind of tests, exactly?!!? I think I am to blame myself, as many other Java developers who actually use log4j, has a good understanding of how it works, knows JNDI and LDAP, yet never connected the dots and noticed what this incredibly stupid feature was making possible.
- mro_name 5y agoI don't think testing is the silver bullet here – it's about system boundary awareness.