3 ms·

> I don't think this argument makes much sense, beyond completely legalistic. The downstream users chose to use Log4j, chose to upgrade to the version where t

> I don't think this argument makes much sense, beyond completely legalistic. The downstream users chose to use Log4j, chose to upgrade to the version where the exploit was introduced, chose not to audit the code. It's their responsibility and theirs alone. A maintainer can release a new version of their software. No-one is under any obligation to use it. They certainly don't reach down into your repos and push their changes. So I agree that the maintainers shipped a release. I certainly don't agree that the shipped it into anyone else's codebase.

watwut 5y ago
> The downstream users chose to use Log4j, chose to upgrade to the version where the exploit was introduced, chose not to audit the code. It's their responsibility and theirs alone. No. It is manipulative framing where responsibility for backdoor is pushed onto users. It is especially ridiculous in the context of industry where not upgrading is seen as irresponsible. And especially ridiculous when the same industry pushes for open source and when companies eventually start to listen and use open source, acts like there was something wrong with using open source.
- jeltz 5y ago
  Totally agreed. If software is ever to become a serious and respected industry we can't just deny responsibility and blame the users as soon as something goes wrong.
  - ta988 5y ago
    You can already do like in real industries, pay someone to write you a logging framework and they will be responsible for it. Guess what, you can even pay someone to just be responsible and audit FOSS code for you. Looks like we are already a serious and respected industry that just contains a few complaining entitled users benefiting from the free work of others...
  - PedroBatista 5y ago
    Why don’t all those people affected by this ask for their money back?
- closewith 5y ago
  > No. It is manipulative framing where responsibility for backdoor is pushed onto users. I fundamentally disagree that anything was pushed onto downstream users. They explicitly pulled Log4j. Framing it as the maintainers pushing the update onto downstream users is itself so manipulative that I wonder if you are conversing in good faith. Framing the bug as a backdoor is absurdly manipulative. The Apache License even warns the users explicitly: > Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
  - watt 5y ago
    You are the part of the problem then.
    - pjmlp 5y ago
      Lack of legal liability for any kind of security exploit, and auditing processes for companies that allow wild west integration of libraries are the problem.
    - blindmute 5y ago
      Dude, take a step back here. You're using someone else's free code. Someone wrote some code for free, put it online, and said "yeah anyone can use this for free go ahead". They don't owe anyone anything.
- salawat 5y ago
  >It is especially ridiculous in the context of industry where not upgrading is seen as irresponsible. Upgrading without due diligence, and without reason is as irresponsible an not upgrading when the need to becomes manifest. Running "unsafe" versions of software in conditions where their unsafe nature is not open to exploitation is a completely legitmate action. If you upgrade just because there's a later version available, you're rolling the dice as needlessly as the fellow that'll get around to it once he has time to read the code. Note: I'm aware of, and also cherish the no warranties explicit or implied clause. However, In real life, where social relationships do matter, I don't see this escape clause standing the test of time as society catches up the technology.

watwut 5y ago

> The downstream users chose to use Log4j, chose to upgrade to the version where the exploit was introduced, chose not to audit the code. It's their responsibility and theirs alone. No. It is manipulative framing where responsibility for backdoor is pushed onto users. It is especially ridiculous in the context of industry where not upgrading is seen as irresponsible. And especially ridiculous when the same industry pushes for open source and when companies eventually start to listen and use open source, acts like there was something wrong with using open source.

jeltz 5y ago
Totally agreed. If software is ever to become a serious and respected industry we can't just deny responsibility and blame the users as soon as something goes wrong.
- ta988 5y ago
  You can already do like in real industries, pay someone to write you a logging framework and they will be responsible for it. Guess what, you can even pay someone to just be responsible and audit FOSS code for you. Looks like we are already a serious and respected industry that just contains a few complaining entitled users benefiting from the free work of others...
- PedroBatista 5y ago
  Why don’t all those people affected by this ask for their money back?
closewith 5y ago
> No. It is manipulative framing where responsibility for backdoor is pushed onto users. I fundamentally disagree that anything was pushed onto downstream users. They explicitly pulled Log4j. Framing it as the maintainers pushing the update onto downstream users is itself so manipulative that I wonder if you are conversing in good faith. Framing the bug as a backdoor is absurdly manipulative. The Apache License even warns the users explicitly: > Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
- watt 5y ago
  You are the part of the problem then.
  - pjmlp 5y ago
    Lack of legal liability for any kind of security exploit, and auditing processes for companies that allow wild west integration of libraries are the problem.
  - blindmute 5y ago
    Dude, take a step back here. You're using someone else's free code. Someone wrote some code for free, put it online, and said "yeah anyone can use this for free go ahead". They don't owe anyone anything.
salawat 5y ago
>It is especially ridiculous in the context of industry where not upgrading is seen as irresponsible. Upgrading without due diligence, and without reason is as irresponsible an not upgrading when the need to becomes manifest. Running "unsafe" versions of software in conditions where their unsafe nature is not open to exploitation is a completely legitmate action. If you upgrade just because there's a later version available, you're rolling the dice as needlessly as the fellow that'll get around to it once he has time to read the code. Note: I'm aware of, and also cherish the no warranties explicit or implied clause. However, In real life, where social relationships do matter, I don't see this escape clause standing the test of time as society catches up the technology.