> Reviewing all of the source code for log4j is not a walk in the park. Traditionally if something is too large to audit then you shouldn’t use it, which few e

> Reviewing all of the source code for log4j is not a walk in the park. Traditionally if something is too large to audit then you shouldn’t use it, which few exceptions (like Linux). Maybe this should be a red flag in the future, especially for a logging library that can almost be replaced with a call to stdout and a log collector.