5 ms·
Ask HN: How are you holding up with this Log4j madness?
Seems most of the industry has been rushing out deployments this weekend.
- beanjuiceII 5y agoI am relaxing at home, and if my employer wants they could pay me time and a half over the weekend, but I've received no call as of yet :) sounds like a monday thing?
- kadoban 5y agoAt most places it's very much an ass-o-clock on whatever day it happens to be kind of thing. Maybe your place is less affected, or maybe they're just most clueless. Hope your Monday goes well.
- beanjuiceII 5y agoso far all is quiet on the eastern front, but we are definitely effected... the entire org (a very large one) deploys mostly java. I've lit beacons of Gondor, but knowing this org that might take a week to get anyone to take it seriously..maybe another month to start patching who knows.
- kadoban 5y agoOof. Maybe whoever owns your systems via the exploit will patch it first. Seriously though, good luck, hopefully someone notices your beacons soon.
- beanjuiceII 5y agothere are "assessments" happening, but I'd expect months or a year before this is all patched, so hopefully the infiltrators will patch the systems for us like u mentioned :)
- ev1 5y agoour applications cannot make outbound connections from logging (they have to go through a specific class/function/service/factory that sets up all the metadata like mTLS, proxy, etc), and any non-mTLS attempts don't work, along with any to "not recognised" endpoints. I noticed on thursday thanks to HN and mitigated before 2.15.0 released, and have done nothing all weekend. i want to know who the fuck on earth actually has a use case of loading a class and running it inline from a logging call rather than calling getUserEmailFromLdap(ou, principal).toString() or something
- thrashh 5y agoIMO I don’t think the actual feature is bad. I think the real problem is that some people consider logging messages data that must be sanitized (like SQL) while others don’t. And when you mix these two groups of people, we have very major problems.
- ev1 5y agoif at least anything "downloading executable code from elsewhere and running it" needs to be severely, excessively opt in behaviour. the actual feature feels incredibly strange to me as someone that has written in a ton of languages and always explicitly treated it as a plain text string unless very explicitly intended to format it
- ironmagma 5y agoIt’s been nice knowing we are using a sane development stack that doesn’t include bloatware.
- emptybottle 5y agohttps://gist.github.com/seanmhanson/fe370c2d8bd2b3228680e38899baf5cc https://gist.github.com/seanmhanson/fe370c2d8bd2b3228680e388...
- justbaker 5y agoI’ve certainly been insane before and feel no offense by the parent comment. Simply linking this gist without an explanation of why you are or why you disagree seems like you cannot defend your opinion but with just a link to someone else’s opinion. Again I feel no offense. You aren’t helping mental health (or anything for that matter) trying to censor language that is in no way malevolent in its usage.
- ironmagma 5y agoAs a person with a mental disorder I find the word “insane” in the context of software development to be perfectly cromulent.
- jononomo 5y agoMy prediction is that by the time the anniversary of the January 6th insurrection rolls around people will have entirely forgotten about this issue.
- niij 5y agoPlease don't inject unrelated flamebait into this.
- btown 5y agoWe have avoided Java internally, but I am mainly worried that our ecosystem of SaaS tools, service providers, even payment processors might be bleeding data breaches and nobody knows yet. All it takes is one old ETL script on an unmaintained server that logs user-submitted records once a week, and their internal networks will be backdoored by script kiddies at some point soon, not to mention sophisticated actors. The companies that downsized technical teams during the pandemic simply don’t have the bandwidth to audit their entire security surface - #hugops to anyone being asked to do this. It’s a perfect storm. And we’re only seeing the beginning. But it’s not like I’m going to use our corporate credentials to probe our own service providers to see which APIs are vulnerable - I have no desire to be banned and sued. And we’re too small an account to be able to do anything but make ourselves sound paranoid to our account managers. So I’m just waiting for the other shoe to drop. I hope it’s not something that splashes onto our reputation.
- burntoutfire 5y agoIf I understood the vuln correctly, the injected malicious payload makes Log4J download and execute code from attacker's LDAP. I'm thinking that, in serious organizations, the call to the LDAP just won't make it through the firewall.
- btown 5y agoEven if we assume serious and dedicated security ops at these organizations, the attacker can specify the port to connect to. So any firewall would need to deeply inspect outbound traffic. And plenty of ETL jobs can mix in offsite data e.g. pulling from S3, or even from a hosted LDAP solution, so they wouldn’t prevent outbound traffic. The attacker could even use AWS IPs! As I said, a perfect storm.
- altdataseller 5y agoI haven't heard many companies actually reporting major exploits, or any major sites having outages.. So I'm questioning whether this flaw really does result in remote code execution, or whether the vast majority of companies are using a version of log4j that doesn't have this flaw.
- deleted 5y ago[deleted]
- darthrupert 5y agoI run nothing on Java so doing "Kermit drinks tea" while looking at news. With a slight dread that what I am using might have similar problems that we don't know yet.