4 ms·
> Personally I wonder whether anyone actually used log4j willingly Any project written in Java that has ANY dependencies will also use Log4j. Not even your cho
by lmilcin 5y ago
> Personally I wonder whether anyone actually used log4j willingly
Any project written in Java that has ANY dependencies will also use Log4j. Not even your choice anymore unless you are willing to write your entire stack from scratch.
The moment you start thinking about how to solve logging you will land at a log4j-like framework anyway.
> You should be checking all your 3rd party source code
How is that a usable advice? There are dozens of dependencies in a simplest application. A non-trivial may easily have above hundred dependencies.
- fiddlerwoaroof 5y agoI’ve always used the various log4j adapters and then excluded log4j from the transitive dependencies.
- carey 5y agoSame. Gradle even lets you configure replacement dependencies, so if anything depends on Log4J it automatically gets the adapter instead.
- DarkmSparks 5y ago> How is that a usable advice? Its not really advice, its an essential requirement if not getting pwnd is important to you. Expect to get pwnd eventually otherwise.