6 ms·
> I admit to a certain level of exaggeration but, at the same time, we are talking literal peanuts to a large company. I'm not sure you understand what you are
by throw_log4jfang 5y ago
> I admit to a certain level of exaggeration but, at the same time, we are talking literal peanuts to a large company.
I'm not sure you understand what you are asking, and I'm kind of dumbfounded by the sense of entitlement of your request. You are expecting others like me to be forced to work weekends on a problem that doesn't concern me (because my service is already patched) for absolutely nothing in return, and instead risking owning a problem and the blame of not coming up with a one-size-fits-all magic bullet.
All downsides and absolutely no upside at all, for my employer and let alone for myself.
Let me ask you this: how much of your personal time did you invested in coming up with a fix for this vulnerability? And yet you feel entitled to demanding this from others?
- detaro 5y agoYou do realize that this issue wasn't discovered this morning, and indeed part of the point is that if it wasn't people in their spare time it could've been patched days ago, and you could've fixed all your services during the week? So you prefer working weekends to fix a delayed bug instead of devs being paid to help fix it for everybody during the working week?
- raggi 5y ago> Usually (as per ASF rules) the team should wait 72 hours after creating a release candidate before publishing the release to give the community enough time to review and cast their votes. We are building consensus to shorten that window for this particular release, given its urgency. from: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990264908 https://github.com/apache/logging-log4j2/pull/608#issuecomme... If you read more of the history of the release you'll find that additional vectors were found in the RC process that were also fixed.
- deleted 5y ago[deleted]