4 ms·
> wide range of output formats Not to mention a wide range of destinations, too. Want to log to a database table? You’re covered. What about log messages to a
by TedDoesntTalk 5y ago
> wide range of output formats
Not to mention a wide range of destinations, too. Want to log to a database table? You’re covered. What about log messages to a chat server (xmpp, slack) or email but only fatal errors? You’re covered.
Now roll your own logging system that supports those destinations safely and get back to me to do pen testing. I bet we’ll find some vulns in your code.
- tekknik 5y agoThis is the job of a log collector, not a log producer/library. The logging library itself should have no mechanism for shipping files anywhere except a file / stdout / stderr.
- ashtonkem 5y agoHindsight bias. Keep in mind that Log4j is older than most log aggregators by a solid decade. This is a solid reason to not use log4j going forward, but an ahistoric charge against it in the era when it was first written and adopted. Most of us have log4j in our system because it's used by some various dependency of one type or another, and up until now it has generally just worked.