4 ms·

Fund a new fork

• bobbyi 5y ago
  Why not logback instead? It's existed for more than 10 years and its stated goal is "picking up where log4j 1.x leaves off" http://logback.qos.ch/ http://logback.qos.ch/
• Too 5y ago
  Just leads to the xkcd “there are now 14 competing standards.” Honestly the biggest problem of package managers is finding a reputable package that one can trust. The best one can do to aid this situation is reviewing, vetting and warning of which packages that can be trusted and not. Automatic scanners to find code smells and vulnerabilities. “Security rating: 2/10, This package seems to use JNDI loading, are you sure you want to continue (y/n).”
  • yjftsjthsd-h 5y ago
    Humor me: if log4j had 13 (independently developed) competitors, wouldn't the impact of this be much lower, because many consumers would use different libraries? Like genetic diversity as a hedge against disease.
    • rini17 5y ago
      Joke's on you: Then any nontrivial project would end up depending on half of them, actually increasing attack surface.
    • gonzo41 5y ago
      I bet they'd all compete on features and probably implement the same exploit trying to maintain market share. Logging as it's understood today should ship with most STD libraries. Things like logback an log4j really should just eventually be rolled into the std.