3 ms·
Of course! But it generally has fewer bugs than it did before, and you have greater confidence that it has fewer bugs. Perfect security is not achievable - you
by throw10920 5y ago
Of course! But it generally has fewer bugs than it did before, and you have greater confidence that it has fewer bugs. Perfect security is not achievable - you just make the best trade-offs that you can.
Log4j has, to my knowledge, never been audited.
- als0 5y agoI'm just pointing out that you assume Apple deployed unaudited code, just because the code had a bug. I would not make that assumption.
- throw10920 5y agoMy apologies, I wasn't clear. I agree, audited code can have bugs - but I'm not assuming that the presence of the bug was the indicator that it hadn't been audited. I'm taking the fact that I haven't heard of log4j being audited, the fact that I haven't heard of Apple auditing an external product before importing it into their environment, and the fact that auditing open-source software isn't standard practice among tech companies to make that assumption. ...although, the bug is sort of blatant. I would hope that an audit would catch this particular one, at least.