4 ms·
This seems like it is the second time we have had to learn about the importance of maintain large open source infrastructure projects like this. log4j and open
by melissalobos 5y ago
This seems like it is the second time we have had to learn about the importance of maintain large open source infrastructure projects like this. log4j and openSSL before it, show that these projects aren't just the responsibility of the maintainers, but all of their users as well. We really need more money being paid by larger users like Google directly to the maintainers.
- shadowgovt 5y agoGoogle doesn't use Log4j; they built an in-house logger. Meanwhile, they fund OpenSSL (https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/ https://arstechnica.com/information-technology/2014/04/tech-...) but are also funding alternatives (https://www.neowin.net/news/google-provides-funding-for-development-of-openssl-alternative/ https://www.neowin.net/news/google-provides-funding-for-deve...).
- pvorb 5y agoGoogle does certainly use log4j. They didn't write every single line of code themselves that they're using.
- shadowgovt 5y agoIt's possible it's being used somewhere in an open-source external project that Google produces. I can't name anything off the top of my head. ... but in-house, in their running-on-Borg services written in Java, they have their own API for log capturing. Log4j doesn't offer nearly the level of integration to their logging and tracing fabric they need. And the Cloud Logging API has adapters for Log4j, but none maintained first-party, IIUC.
- UncleMeat 5y agoGoogle's codebase is huge and has many weird corners, but the monolith structure meant that virtually everybody switched over to a different logging framework a while ago.