3 ms·

>> I'm still flabbergasted that the original maintainers are rushing around trying to patch these problems. Agreed, while reading it I also disagreed at this p

>> I'm still flabbergasted that the original maintainers are rushing around trying to patch these problems. Agreed, while reading it I also disagreed at this point: >> the maintainers of log4j would have loved to remove this bad feature long ago, but could not because of the backwards compatibility promises they are held to. Nobody is holding them to anything. If they want to remove an old feature, go right ahead. If those using it think it's that important they can fork the project and maintain it themselves. Oh right, that would take effort or money.

duxup 5y ago
Did they want to remove it because of security concerns? If so, I really wouldn’t hold someone to any backwards compatibility promise if security is a concern.
- miohtama 5y ago
  My favorite way to dissect any open source issues: How much you paid for it? Money back guaranteed. If you paid $0 then it you are guaranteed to get $0 money back in the case of an issue.
omegalulw 5y ago
> Nobody is holding them to anything I don't get this argument. Part of sharing your work is making sure what you put out is actually helpful to people. If they remove features people really like, then the library won't be as helpful - so it's perfectly fine for the OG devs to maintain this feature. The same thing with "scrambling" to fix - that could be because a sword is hanging over your head, or because you care about the people who use your work. Thinking this way, I can perfectly see them working hard to fixing this bug.
- manquer 5y ago
  It is still a choice you make, do you want to be nice and do everything anyone asks of you ? Or stick to your principles and build only what you think is right? Developers are social creatures like anyone else and like validation and recognition from peers, that is understandable but not an excuse. It is no different from being able to say no when your boss ask you to build something you don't believe in or is against your morals, it is tough but our choice nonetheless. Their choice then to support this feature, and now to patch it. They could have no either time, no point in complaining about it after making the choice.
- phkahler 5y ago
  >> Part of sharing your work is making sure what you put out is actually helpful to people. No, people get to decide for themselves what is helpful to them. Assuming developers want to make the best tool they can, they still have to do so within the resource constraints they have. Dropping a feature or ignoring requests is part of that.
AmpsterMan 5y ago
I understand it perfectly. Log4j is used in many Enterprise systems. Java is a fairly conservative language. Combine both together and you get much hesitancy to break backwards compatibility ingrained in the Java world.
- cma 5y ago
  Why not turn it off by default and feature flag it with an env variable?

duxup 5y ago

Did they want to remove it because of security concerns? If so, I really wouldn’t hold someone to any backwards compatibility promise if security is a concern.

miohtama 5y ago
My favorite way to dissect any open source issues: How much you paid for it? Money back guaranteed. If you paid $0 then it you are guaranteed to get $0 money back in the case of an issue.

omegalulw 5y ago

> Nobody is holding them to anything I don't get this argument. Part of sharing your work is making sure what you put out is actually helpful to people. If they remove features people really like, then the library won't be as helpful - so it's perfectly fine for the OG devs to maintain this feature. The same thing with "scrambling" to fix - that could be because a sword is hanging over your head, or because you care about the people who use your work. Thinking this way, I can perfectly see them working hard to fixing this bug.

manquer 5y ago
It is still a choice you make, do you want to be nice and do everything anyone asks of you ? Or stick to your principles and build only what you think is right? Developers are social creatures like anyone else and like validation and recognition from peers, that is understandable but not an excuse. It is no different from being able to say no when your boss ask you to build something you don't believe in or is against your morals, it is tough but our choice nonetheless. Their choice then to support this feature, and now to patch it. They could have no either time, no point in complaining about it after making the choice.
phkahler 5y ago
>> Part of sharing your work is making sure what you put out is actually helpful to people. No, people get to decide for themselves what is helpful to them. Assuming developers want to make the best tool they can, they still have to do so within the resource constraints they have. Dropping a feature or ignoring requests is part of that.

AmpsterMan 5y ago

I understand it perfectly. Log4j is used in many Enterprise systems. Java is a fairly conservative language. Combine both together and you get much hesitancy to break backwards compatibility ingrained in the Java world.

cma 5y ago
Why not turn it off by default and feature flag it with an env variable?