> No. It is manipulative framing where responsibility for backdoor is pushed onto users. I fundamentally disagree that anything was pushed onto downstream user

> No. It is manipulative framing where responsibility for backdoor is pushed onto users. I fundamentally disagree that anything was pushed onto downstream users. They explicitly pulled Log4j. Framing it as the maintainers pushing the update onto downstream users is itself so manipulative that I wonder if you are conversing in good faith. Framing the bug as a backdoor is absurdly manipulative. The Apache License even warns the users explicitly: > Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.