3 ms·

> Speaking of disingenuous, since when is log4j “web 2.0”? Let's assume Web 2.0 is 2008 to the present day. Every single big corp I worked at during that time

by dvt 5y ago

> Speaking of disingenuous, since when is log4j “web 2.0”? Let's assume Web 2.0 is 2008 to the present day. Every single big corp I worked at during that time was a Java shop (serving via Tomcat/Jetty), and log4j is ubiquitous in every Java shop. Minecraft (a gaming epitome of Web 2.0), basically blew up because of Log4j.

ahtihn 5y ago
Sorry but log4j is not ubiquitous. Slf4j with logback has a significant presence. Spring boot doesn't come with log4j backend by default.
acdha 5y ago
So your definition of “web 2.0” includes every programming language and library used to build web 1 or 2 apps, along with all kinds of other things? That’s quite the stretch — and it’s telling that you’re only using that as a negative to attack things which you don’t have a personal financial stake in. I don’t imagine you’d like it if every vulnerability in some library used by a blockchain-related project was billed as a cryptocurrency problem.
- dvt 5y ago
  Sorry, but I think you're arguing from such bad faith, not sure if this conversation is redeemable. Imo, Log4j is as part of web2 as technologies like MongoDb or AJAX/XMLHttpRequest. Arguing the opposite is just completely nuts. I mean, Play Framework (a staple of Web 2.0 Java & Scala), uses Log4j implicitly[1]. Have you written any Web2 apps in Java? It doesn't seem like you have. > The Play logger is built on Log4j. Since most Java libraries use Log4j or a wrapper able to use Log4j as a backend, you can easily configure logging that is well-suited to your application. [1] https://www.playframework.com/documentation/1.2.x/logs https://www.playframework.com/documentation/1.2.x/logs
  - acdha 5y ago
    > I think you're arguing from such bad faith, not sure if this conversation is redeemable. Please tell me this is a joke. You compared two unlike things, and now it’s “bad faith” when you can’t support the claim? > Log4j is as part of web2 as technologies like MongoDb or AJAX/XMLHttpRequest This is half right. As with log4j you can tell what things are “web 2.0” by asking whether you had to use them or not. People built many, many Web 2.0 sites without Mongo or Java but they had to use XHR because that’s what web browsers supported — until Fetch arrived later, there wasn’t a good alternative. Someone using your site didn’t know what you used server side but they definitely could tell what your client-side code (which is what made it Web 2.0 instead of 1) was doing.

by dvt 5y ago

ahtihn 5y ago

Sorry but log4j is not ubiquitous. Slf4j with logback has a significant presence. Spring boot doesn't come with log4j backend by default.

acdha 5y ago

So your definition of “web 2.0” includes every programming language and library used to build web 1 or 2 apps, along with all kinds of other things? That’s quite the stretch — and it’s telling that you’re only using that as a negative to attack things which you don’t have a personal financial stake in. I don’t imagine you’d like it if every vulnerability in some library used by a blockchain-related project was billed as a cryptocurrency problem.

dvt 5y ago
Sorry, but I think you're arguing from such bad faith, not sure if this conversation is redeemable. Imo, Log4j is as part of web2 as technologies like MongoDb or AJAX/XMLHttpRequest. Arguing the opposite is just completely nuts. I mean, Play Framework (a staple of Web 2.0 Java & Scala), uses Log4j implicitly[1]. Have you written any Web2 apps in Java? It doesn't seem like you have. > The Play logger is built on Log4j. Since most Java libraries use Log4j or a wrapper able to use Log4j as a backend, you can easily configure logging that is well-suited to your application. [1] https://www.playframework.com/documentation/1.2.x/logs https://www.playframework.com/documentation/1.2.x/logs
- acdha 5y ago
  > I think you're arguing from such bad faith, not sure if this conversation is redeemable. Please tell me this is a joke. You compared two unlike things, and now it’s “bad faith” when you can’t support the claim? > Log4j is as part of web2 as technologies like MongoDb or AJAX/XMLHttpRequest This is half right. As with log4j you can tell what things are “web 2.0” by asking whether you had to use them or not. People built many, many Web 2.0 sites without Mongo or Java but they had to use XHR because that’s what web browsers supported — until Fetch arrived later, there wasn’t a good alternative. Someone using your site didn’t know what you used server side but they definitely could tell what your client-side code (which is what made it Web 2.0 instead of 1) was doing.