2 ms·
Here’s the alternate history where “Network” is passed as an argument to the constructor. The year 2006 rolls around and centralized logging is becoming pretty
by kortilla 5y ago
Here’s the alternate history where “Network” is passed as an argument to the constructor.
The year 2006 rolls around and centralized logging is becoming pretty cool. Someone requests that log4j add support to logging to a UDP syslog server. The constructor now requires “Network” and now everyone still thinks it’s reasonable.
IMO the elephant in the room is code execution of remotely loaded code. I want to be able to give something access to the network but not be able to execute stuff from network provided sources.
- bo0tzz 5y agoIt's a similar story though, that could be covered by another capability - one to access the Java classloader, or run executables on the filesystem, for example.
- tomjakubowski 5y agoThe last few paragraphs of the post address your post's alternate history.
- gnufx 5y agoThe way I put it was how come a remote process has authority to load arbitrary code into the local process?