2 ms·

Minecraft servers were one part of it... Minecraft clients where another. If you sent a message to everyone with a client (that logged that message), everyone

by shagie 5y ago

Minecraft servers were one part of it... Minecraft clients where another. If you sent a message to everyone with a client (that logged that message), everyone with a client would at least ping back to the ldap server. The issue where this was introduced was: https://issues.apache.org/jira/browse/LOG4J2-313 https://issues.apache.org/jira/browse/LOG4J2-313 That's from 2013 (Minecraft was 2 years old then) On the other hand, nothing with it really happened until someone asked if it was a security vulnerability - https://github.com/apache/logging-log4j2/pull/608#issuecomment-989762094 https://github.com/apache/logging-log4j2/pull/608#issuecomme... And then all hell broke loose. Simply said, this was a feature that was intended to make it easier for one company to use their structure with ldap lookups for where/how to log. The author of the change did what many people encourage others to do when working with open source "here's some code that I wrote, I'm contributing it back upstream." If this was part of something "bigger", it sat quiet for the better part of a decade.

cannabis_sam 5y ago
Wow, that’s a scary read… No consideration, no discussion, no security analysis, just “JDNI is cool, can I hav plz? Ofc!” Did none of these people consider what JDNI is designed to do? Did none of these people consider what side-effects are appropriate within a logging library?
- shagie 5y ago
  Yes... but... realize that log4j2 was in beta releases at the time, being maintained by one developer as part of a "I want to redesign how it works". As an open source developer working on a project that hadn't even been formally released, I'd be quite pleased to have someone else contributing the features that they found useful back upstream in an effort to make it a better project. Yes, this is what jndi is supposed to do. Was it done as best as it could be? Probably not. But it isn't something that's only in log4j2 http://logback.qos.ch/manual/loggingSeparation.html#ContextJNDISelector http://logback.qos.ch/manual/loggingSeparation.html#ContextJ... https://dennis-xlc.gitbooks.io/the-logback-manual/content/en/chapter-3-configuration/configuration-file-syntax/variable-substitution.html#obtaining-variables-from-jndi https://dennis-xlc.gitbooks.io/the-logback-manual/content/en... But I'm not going to fault a solo developer of some beta software in the world of 2013 for not rejecting a patch because every angle wasn't thought out.
deleted 5y ago
[deleted]

by shagie 5y ago

cannabis_sam 5y ago

Wow, that’s a scary read… No consideration, no discussion, no security analysis, just “JDNI is cool, can I hav plz? Ofc!” Did none of these people consider what JDNI is designed to do? Did none of these people consider what side-effects are appropriate within a logging library?

shagie 5y ago
Yes... but... realize that log4j2 was in beta releases at the time, being maintained by one developer as part of a "I want to redesign how it works". As an open source developer working on a project that hadn't even been formally released, I'd be quite pleased to have someone else contributing the features that they found useful back upstream in an effort to make it a better project. Yes, this is what jndi is supposed to do. Was it done as best as it could be? Probably not. But it isn't something that's only in log4j2 http://logback.qos.ch/manual/loggingSeparation.html#ContextJNDISelector http://logback.qos.ch/manual/loggingSeparation.html#ContextJ... https://dennis-xlc.gitbooks.io/the-logback-manual/content/en/chapter-3-configuration/configuration-file-syntax/variable-substitution.html#obtaining-variables-from-jndi https://dennis-xlc.gitbooks.io/the-logback-manual/content/en... But I'm not going to fault a solo developer of some beta software in the world of 2013 for not rejecting a patch because every angle wasn't thought out.

deleted 5y ago

[deleted]