6 ms·

This attitude should stop. They're volunteers. It's open source. Users are required to use such piece of software at their own will and risk. Log4j didn't ever

This attitude should stop. They're volunteers. It's open source. Users are required to use such piece of software at their own will and risk. Log4j didn't ever get a single penny from most (all?) of their users, and now they should take all the blame. Why? The disclosure process was terrible, they clearly had no time to perform a thorough validation of the hotfixes, and this is the result. Why didn't anybody else step up to help them? Did any of the large companies using log4j pour some thousand dollars into the Apache foundation to let a couple of security-oriented engineers take a complete review of the patches? But then, it's log4j developers and Apache that should be blamed. Bah. That's SO pretentious.

dylan604 5y ago
>But then, it's log4j developers and Apache that should be blamed. Bah. That's SO pretentious. Um, yeah. They wrote the idiotic code that allowed this to happen. Who should get the blame then, the users? Duh, no. Should the hackers taking advantage of the exploit? Maybe, some, but they wouldn't be able to do it if the code wasn't so badly wrritten. >Why didn't anybody else step up to help them? To me, this is the pretentious part. I didn't write the code, I don't use the code, so why in the world should I be expected to fix the code? Do you use the code? Why didn't YOU fix it?
- alanfranz 5y ago
  If you don’t use the code, you’re not vulnerable > who should get the blame? The users? If you leverage a ton of open source deps, shit is going to happen. You should not blame anyone. But if you must, yes: blame the users that choose such piss-poor software.
  - dylan604 5y ago
    Just because someone releases code with AS IS/NO WARRANTY/BLAH BLAH BLAH doesn't mean they should not get called out for introducing such a vuln. Yes, you chose the code, failed to evaluate it's security, etc, but at the end of they day, the Log4* devs made a very very bad decision. Sadly, because of it's deep use in so many projects, it has kind of become too big to fail. I doubt %1 of users will swap out the logging package for something else. They will all wait for the Log4 devs to keep releasing updates. People keep singing the praises of FOSS, but yet whenever this kind of shit happens, it's always the user's fault for choosing poorly which packages are being used. I'm saying that the original devs are criminals, but they did the original sin here. The fault ultimately lies at their feet. Why is this such a unrespected point of view?
    - 5e92cb50239222b 5y ago
      Would it be any better if this library was a proprietary product, the vulnerability would have been discovered by NSA and exploited until the end of time? Come to think of it, they wouldn't even have to search for any exploits. Just ask devs nicely to put the backdoor in and be done with it.
      - kafkaIncarnate 5y ago
        Who said anything about 'nicely'? Or 'ask'?
    - alanfranz 5y ago
      Discussion is ok. Disrespect is not. What original sin? What fault? You’re basically saying that log4j developers lured you into temptation, otherwise you would have coded your own logging library, which, for sure, would have been better. I haven’t seen 1/100 of this hatred for Apple iMessage vuln that led to NSO zero-click exploits, and I don’t get why.
      - filmgirlcw 5y ago
        > I haven’t seen 1/100 of this hatred for Apple iMessage vuln that led to NSO zero-click exploits, and I don’t get why. I think there are a few reasons for this, and most of them aren’t based on logic, but emotion. First, as bad as the NSO zero-click exploits are, they aren’t things that developers were potentially injecting into their own projects. So there is an easier force to “blame” — Apple (for making the mistakes in the first place — and to be clear, all software can have bugs) and NSO Group (for being pieces of shit) — whereas if you either chose Log4j for your own project, or more likely, chose a project/product that chose to use Log4j, the “who to blame” question becomes a lot less comfortable to answer. At least with the NSO thing, there is a face of who the bad guy is. So it’s easy to sort of not hate Apple, provided Apple patched exploits as soon as they found them. That doesn’t mean that Apple, a company that has used its “better” security relative to its competitors one of its marketing messages, gets off easy. It’s a black mark for them for sure and will make it harder for the company to argue that it is so much more secure than x, y, z service or platform. With Log4j, similar to OpenSSL, people have to grapple with the reality that they don’t really know a lot about a lot of the code they run — and even worse, acknowledge that they aren’t capable of understanding or auditing that code themselves. I certainly don’t understand a lot of the code and libraries I rely on for things I build. And if I really stop to think about that, that’s scary. Fortunately, my own projects are personal and aren’t taking data from others. But facing that reality can be a difficult pill to swallow. And Log4j is even worse than OpenSSL in a way, because one could be forgiven for having trust in a well-respected cryptographic library, and for not having a deep understanding of how that library works. But having an insecure logging library? That almost feels avoidable — even if it isn’t. So people want to blame someone. And when it looks like the code — made by volunteers or not — wasn’t the best written, that’s an easy thing to go to. Rather than self-reflecting about all the libraries we use every day that we don’t think about the security or code quality of. It doesn’t help that the disclosure, for a host of reasons, wasn’t good. That isn’t me blaming the Log4j team, it just is what it is. Disclosure wasn’t great and the fury to patch made some mistakes and now that there is outsized attention on the library, even more vulnerabilities have been found. Which is all understandable and indicative of what often happens in high stress situations. Ultimately, we should all accept that mistakes happen and that this wasn’t done out of malice. We all have some level of culpability for what we choose to use in our projects. But mistakes happen. And as you say, discussion is OK but disrespect isn’t. But I think we see lashing out because people want to find someone to blame.
- grafs50 5y ago
  I don't understand what the problem is if you don't use the code. Why does it matter to you if it gets fixed?
  - thowaway202107 5y ago
    Not approving of what OP said, I’d point out that everyone has an interest in it being fixed, because it’s a wide spread and severe CVE that impacts lots of software that we all probably use daily without knowing it.
  - dylan604 5y ago
    I use services that do use that code though, so I am affected when it goes down
    - yawaramin 5y ago
      Then you should blame the people who provide those services for going down. Not the open source libraries that they chose to use.
- thowaway202107 5y ago
  > Um, yeah. They wrote the idiotic code that allowed this to happen. And released it with NO WARRANTY. And no mega corp thought it’d be a good idea to try and buy one. > To me, this is the pretentious part. I didn't write the code, I don't use the code, so why in the world should I be expected to fix the code? Do you use the code? Why didn't YOU fix it? If you don’t use it, then noone’s expecting you to fix anything. But those out there using it for free, complaining that it’s broken, and not doing anything to help? They should hush their hush holes. Or open pull requests. But mostly hush their hush holes.
- samhw 5y ago
  This comment isn't even consistent with itself. First you say: > Who should get the blame then, the users? Duh, no. And then you say: > I don't use the code, so why in the world should I be expected to fix the code? Do you use the code? Why didn't YOU fix it? Just take a step back, stop trying to throw shade at anyone and everyone, and look at the situation analytically. I don't really see the point of these comments. The people who make a contribution to the world are the people who see a problem and take practical steps to fix it and improve the situation, rather than the people who see a problem and immediately descend into finger-pointing and shouting.
wbl 5y ago
Log4J is bigger than all of V7 Unix. What do you need all that for?
- kabdib 5y ago
  Because the only unsolved problem in logging libraries is: "When do I stop adding features?" Decent logging is surprisingly complicated, but it's not "We need an arrrchitecturreee! for infinitely configurable logging or we are utterly doomed" complicated.
laumars 5y ago
> The disclosure process was terrible, they clearly had no time to perform a thorough validation of the hotfixes, and this is the result. Even with proper disclosure, patching can be harder than it seems at face value. Take shellshock (the bash RCE from 2014) for example, the first patch was released a week after discovery and publication happened after the patch was released. Yet there were still a flurry of further CVEs found and further emergency patches required as a result. The problem is once a major vulnerability is discovered, you then have a the worldwide attention focused on that specific vulnerability looking for other ways to break it. So it’s not really a surprise that you find multiple CVEs for most major vulnerabilities.

dylan604 5y ago

>But then, it's log4j developers and Apache that should be blamed. Bah. That's SO pretentious. Um, yeah. They wrote the idiotic code that allowed this to happen. Who should get the blame then, the users? Duh, no. Should the hackers taking advantage of the exploit? Maybe, some, but they wouldn't be able to do it if the code wasn't so badly wrritten. >Why didn't anybody else step up to help them? To me, this is the pretentious part. I didn't write the code, I don't use the code, so why in the world should I be expected to fix the code? Do you use the code? Why didn't YOU fix it?

alanfranz 5y ago
If you don’t use the code, you’re not vulnerable > who should get the blame? The users? If you leverage a ton of open source deps, shit is going to happen. You should not blame anyone. But if you must, yes: blame the users that choose such piss-poor software.
- dylan604 5y ago
  Just because someone releases code with AS IS/NO WARRANTY/BLAH BLAH BLAH doesn't mean they should not get called out for introducing such a vuln. Yes, you chose the code, failed to evaluate it's security, etc, but at the end of they day, the Log4* devs made a very very bad decision. Sadly, because of it's deep use in so many projects, it has kind of become too big to fail. I doubt %1 of users will swap out the logging package for something else. They will all wait for the Log4 devs to keep releasing updates. People keep singing the praises of FOSS, but yet whenever this kind of shit happens, it's always the user's fault for choosing poorly which packages are being used. I'm saying that the original devs are criminals, but they did the original sin here. The fault ultimately lies at their feet. Why is this such a unrespected point of view?
  - 5e92cb50239222b 5y ago
    Would it be any better if this library was a proprietary product, the vulnerability would have been discovered by NSA and exploited until the end of time? Come to think of it, they wouldn't even have to search for any exploits. Just ask devs nicely to put the backdoor in and be done with it.
    - kafkaIncarnate 5y ago
      Who said anything about 'nicely'? Or 'ask'?
  - alanfranz 5y ago
    Discussion is ok. Disrespect is not. What original sin? What fault? You’re basically saying that log4j developers lured you into temptation, otherwise you would have coded your own logging library, which, for sure, would have been better. I haven’t seen 1/100 of this hatred for Apple iMessage vuln that led to NSO zero-click exploits, and I don’t get why.
    - filmgirlcw 5y ago
      > I haven’t seen 1/100 of this hatred for Apple iMessage vuln that led to NSO zero-click exploits, and I don’t get why. I think there are a few reasons for this, and most of them aren’t based on logic, but emotion. First, as bad as the NSO zero-click exploits are, they aren’t things that developers were potentially injecting into their own projects. So there is an easier force to “blame” — Apple (for making the mistakes in the first place — and to be clear, all software can have bugs) and NSO Group (for being pieces of shit) — whereas if you either chose Log4j for your own project, or more likely, chose a project/product that chose to use Log4j, the “who to blame” question becomes a lot less comfortable to answer. At least with the NSO thing, there is a face of who the bad guy is. So it’s easy to sort of not hate Apple, provided Apple patched exploits as soon as they found them. That doesn’t mean that Apple, a company that has used its “better” security relative to its competitors one of its marketing messages, gets off easy. It’s a black mark for them for sure and will make it harder for the company to argue that it is so much more secure than x, y, z service or platform. With Log4j, similar to OpenSSL, people have to grapple with the reality that they don’t really know a lot about a lot of the code they run — and even worse, acknowledge that they aren’t capable of understanding or auditing that code themselves. I certainly don’t understand a lot of the code and libraries I rely on for things I build. And if I really stop to think about that, that’s scary. Fortunately, my own projects are personal and aren’t taking data from others. But facing that reality can be a difficult pill to swallow. And Log4j is even worse than OpenSSL in a way, because one could be forgiven for having trust in a well-respected cryptographic library, and for not having a deep understanding of how that library works. But having an insecure logging library? That almost feels avoidable — even if it isn’t. So people want to blame someone. And when it looks like the code — made by volunteers or not — wasn’t the best written, that’s an easy thing to go to. Rather than self-reflecting about all the libraries we use every day that we don’t think about the security or code quality of. It doesn’t help that the disclosure, for a host of reasons, wasn’t good. That isn’t me blaming the Log4j team, it just is what it is. Disclosure wasn’t great and the fury to patch made some mistakes and now that there is outsized attention on the library, even more vulnerabilities have been found. Which is all understandable and indicative of what often happens in high stress situations. Ultimately, we should all accept that mistakes happen and that this wasn’t done out of malice. We all have some level of culpability for what we choose to use in our projects. But mistakes happen. And as you say, discussion is OK but disrespect isn’t. But I think we see lashing out because people want to find someone to blame.
grafs50 5y ago
I don't understand what the problem is if you don't use the code. Why does it matter to you if it gets fixed?
- thowaway202107 5y ago
  Not approving of what OP said, I’d point out that everyone has an interest in it being fixed, because it’s a wide spread and severe CVE that impacts lots of software that we all probably use daily without knowing it.
- dylan604 5y ago
  I use services that do use that code though, so I am affected when it goes down
  - yawaramin 5y ago
    Then you should blame the people who provide those services for going down. Not the open source libraries that they chose to use.
thowaway202107 5y ago
> Um, yeah. They wrote the idiotic code that allowed this to happen. And released it with NO WARRANTY. And no mega corp thought it’d be a good idea to try and buy one. > To me, this is the pretentious part. I didn't write the code, I don't use the code, so why in the world should I be expected to fix the code? Do you use the code? Why didn't YOU fix it? If you don’t use it, then noone’s expecting you to fix anything. But those out there using it for free, complaining that it’s broken, and not doing anything to help? They should hush their hush holes. Or open pull requests. But mostly hush their hush holes.
samhw 5y ago
This comment isn't even consistent with itself. First you say: > Who should get the blame then, the users? Duh, no. And then you say: > I don't use the code, so why in the world should I be expected to fix the code? Do you use the code? Why didn't YOU fix it? Just take a step back, stop trying to throw shade at anyone and everyone, and look at the situation analytically. I don't really see the point of these comments. The people who make a contribution to the world are the people who see a problem and take practical steps to fix it and improve the situation, rather than the people who see a problem and immediately descend into finger-pointing and shouting.

wbl 5y ago

Log4J is bigger than all of V7 Unix. What do you need all that for?

kabdib 5y ago
Because the only unsolved problem in logging libraries is: "When do I stop adding features?" Decent logging is surprisingly complicated, but it's not "We need an arrrchitecturreee! for infinitely configurable logging or we are utterly doomed" complicated.

laumars 5y ago

> The disclosure process was terrible, they clearly had no time to perform a thorough validation of the hotfixes, and this is the result. Even with proper disclosure, patching can be harder than it seems at face value. Take shellshock (the bash RCE from 2014) for example, the first patch was released a week after discovery and publication happened after the patch was released. Yet there were still a flurry of further CVEs found and further emergency patches required as a result. The problem is once a major vulnerability is discovered, you then have a the worldwide attention focused on that specific vulnerability looking for other ways to break it. So it’s not really a surprise that you find multiple CVEs for most major vulnerabilities.