5 ms·
Feels like a bad comedy movie.
by nafey 5y ago
Feels like a bad comedy movie.
- input_sh 5y agoAt this point I feel like just shutting down anything Java-based until Log4j reaches version 2.20 or something.
- lstodd 5y ago2.20 would stand for 2^20 vulnerabilities. I decided to just ditch it and write from scratch something api-compatible, but extremely cut-down on "features". Maybe someone would release something along this line. I can't.
- solarengineer 5y agoYou could consider alternatives such as logback instead of writing your own.
- lstodd 5y agoA case of scare of old codebases. Decision was made to have at least some control.
- kazen44 5y agothis is basically what the openbsd community as done with several protocols/systems. LibreSSL is a complete rewrite of the openssl functionality with drastically fewer features. Same goes for CARP. Maybe running software with minimal defaults is a good thing, as it forces the users of the system/library/whatever to think about its behaviour and usecase.
- foxfluff 5y agoLibreSSL is a fork, not a complete rewrite.
- albertopv 5y agoUse logback, spring boot default.
- aluket 5y agoLogback isn’t entirely immune: https://cve.report/CVE-2021-42550 https://cve.report/CVE-2021-42550, although access to the configuration file is required.
- nafey 5y agoI wonder how difficult will it be to increment the major version and turn off all features that can lead to these vulnerabilities.
- silon42 5y agoTime to fork and start removing features.
- gjvc 5y agohttps://tinylog.org/v2/ https://tinylog.org/v2/