4 ms·
People think they are safe because they don't allow for outgoing ldap, but combined with a way to do dns lookups, these kind of things can get really scary. Th
by xorcist 5y ago
People think they are safe because they don't allow for outgoing ldap, but combined with a way to do dns lookups, these kind of things can get really scary.
The java ecosystem is full of these abstractions, that are not outright security problems in themselves, but give rise to complex interactions that makes it hard to judge what the implications are.
This particular logging system has been used by millions of developers for the better part of a decade before any one single person realized the actual implications.
- ethanbond 5y agoJust a minor clarification that’s worth being explicit about: It has been used by millions of developers for the better part of a decade before anyone disclosed the implications.
- tfigment 5y agoWhat i discovered was all of my applications that use log4j do not use version 2. They have out of date dependencies or use slf4j. I'm not sure how i feel but mostly happy im not scrambling. I wonder what adoption rate v2 actually has.
- yawaramin 5y agoI think adoption has mostly gone towards slf4j+logback now.
- mrclark411 5y agologback is *gpl, I think that scares folks away.
- gunnarmorling 5y agoLogback is dual-licensed under EPL v1.0 and the LGPL 2.1, as per the licensee's choosing [1]. In particular, it is not licensed under the GPL. [1] http://logback.qos.ch/license.html http://logback.qos.ch/license.html
- yawaramin 5y agoIt scares away people who see 'GPL' and refuse to read further, perhaps. Not only is it dual licensed, but both licenses (EPL and LGPL) freely allow linking with proprietary software.