3 ms·

Three releases for essentially the same bug in a week is not okay. Just shut this project down. It’s seemingly a cesspit of bad code, bad testing and general i

• bpicolo 5y ago
  Every project has bugs. Log4j just also happens to have literally the most scrutiny on the planet right now. That's actually a great thing for the long term health of the project - it's getting a whole lot of free auditing right now. Many millions of dollars worth.
• soneil 5y ago
  We have systems still using 1.2.x. Do you think if they closed the doors today, the problem would magically disappear? We'd have it ripped out of circulation, replaced by christmas, and everything would be magically easy? There's an old joke, goes something like: “Recently, I was asked if I was going to fire an employee who made a mistake that cost the company $600,000. No, I replied, I just spent $600,000 training him. Why would I want somebody to hire his experience?”. That's what's happening for log4j right now. A lot of eyes, a lot of attention, stuff's going to come out - and long-term it'll be better off for it. Shutting it down and moving to something else that hasn't been tested in battle isn't the pay-off it sounds like.
• tetha 5y ago
  That's fairly normal. I'd rather patch everything 5 times in a row to get rid of one RCE at a time, rather than running with a 10/10 vulnerability for 5 days so the application can make sure to root out all possible problems.