> Loading and running a java class is only the most absurd exploitation possibility with log4j. Uh, yeah, the RCE was very bad. And not a thing with Rust due t

> Loading and running a java class is only the most absurd exploitation possibility with log4j. Uh, yeah, the RCE was very bad. And not a thing with Rust due to not having object serialization. > you can still slurp any environment variables (or other process information) and send it to any host Yeah, you can write a logger in rust that does really crazy things like adding environment variables through some sort of parsing of a language construct. That would still be a problem, but a lot less serious. It would probably also be really unidiomatic, but that's a separate story.