4 ms·
They wrote code essentially willing to run exec on any string passed to it, enabled this feature by default, and then didn't loudly warn people that any string
by x0x0 5y ago
They wrote code essentially willing to run exec on any string passed to it, enabled this feature by default, and then didn't loudly warn people that any string passed to log4j must be trusted. None of this is competent work.
- closewith 5y agoSurely then the responsibility lies with the people who decided to use this apparently incompetent work in their infrastructure? If I release terrible software with a license that expressly has no warranty and someone uses it, surely that's on them?
- x0x0 5y agoYou must audit every single line of code for every piece of software you use.