3 ms·

You do realize that this issue wasn't discovered this morning, and indeed part of the point is that if it wasn't people in their spare time it could've been pat

by detaro 5y ago

You do realize that this issue wasn't discovered this morning, and indeed part of the point is that if it wasn't people in their spare time it could've been patched days ago, and you could've fixed all your services during the week? So you prefer working weekends to fix a delayed bug instead of devs being paid to help fix it for everybody during the working week?

raggi 5y ago
> Usually (as per ASF rules) the team should wait 72 hours after creating a release candidate before publishing the release to give the community enough time to review and cast their votes. We are building consensus to shorten that window for this particular release, given its urgency. from: https://github.com/apache/logging-log4j2/pull/608#issuecomment-990264908 https://github.com/apache/logging-log4j2/pull/608#issuecomme... If you read more of the history of the release you'll find that additional vectors were found in the RC process that were also fixed.