3 ms·

Better idea: stop logging.

throwaway23234 4y ago
the issue is that this can pop up in any library, not just logging. It's about keeping your deps up to date (or not) by a "3d party" (assuming he mean 3rd party)
- staticassertion 4y ago
  Yes, this can pop up in any library. But only because developers aren't taught "don't put remote code execution into your code". You'd think that would be something that someone would teach, but it doesn't really come up. Remember that log4j was vulnerable because of a feature - it all worked as designed.
MilStdJunkie 4y ago
It's not just logging. L4J is so extensible that people have used it for all kinds of things, way waaaaaayyyyy away from just logs. So disabling logs won't necessarily cut it. I am no expert. I ended up indexing all the open source kruft I use to hold this ship of fools together, then verified that the Log4J pieces were definitely disabled with a bunch of monitoring while I tossed stuff at it. I did mention I am not an expert, right? I am sure there is a more Pro way to do this.
- jsiaajdsdaa 4y ago
  F around and find out basically. If you choose to build on the house of cards, thou repeath whaet thou soweth or something.
craigching 4y ago
Ironically, logging is one of the ways to help mitigate/detect security vulnerabilities.
ClumsyPilot 4y ago
problem: food contaminated solution: stop eating
- jsiaajdsdaa 4y ago
  solution: find uncontaminated food, or make it yourself
  - ClumsyPilot 4y ago
    option 1 - we and farmers, as professionals are responsible for supplying stuff that is not dangerous and works as it should Option 2 - which you are advocating - it's every man for himself and we decent into socity of warring tribes of hunter hatherer or subsitence farming at best
    - jsiaajdsdaa 4y ago
      option 2 is the only possible state of reality, because it is never possible to guarantee that everything work in every instance let the buyer be aware
      - paulmd 4y ago
        I mean, how do you know your webserver doesn't have a bug? How do you know your OS doesn't? Just write those yourself? How do you know yours doesn't? One must still verify the key functionality regardless. But, you're not wrong, some people reach for every library and framework they can, and others focus on building the most minimal and understandable thing that will work. I'm not saying writing your own server in assembly, but, avoid unnecessary junk and magic and libraries. It's the classic dilemma: in this world of ours, one can either return to monke or progress to crab.

the issue is that this can pop up in any library, not just logging. It's about keeping your deps up to date (or not) by a "3d party" (assuming he mean 3rd party)

staticassertion 4y ago
Yes, this can pop up in any library. But only because developers aren't taught "don't put remote code execution into your code". You'd think that would be something that someone would teach, but it doesn't really come up. Remember that log4j was vulnerable because of a feature - it all worked as designed.

MilStdJunkie 4y ago

It's not just logging. L4J is so extensible that people have used it for all kinds of things, way waaaaaayyyyy away from just logs. So disabling logs won't necessarily cut it. I am no expert. I ended up indexing all the open source kruft I use to hold this ship of fools together, then verified that the Log4J pieces were definitely disabled with a bunch of monitoring while I tossed stuff at it. I did mention I am not an expert, right? I am sure there is a more Pro way to do this.

jsiaajdsdaa 4y ago
F around and find out basically. If you choose to build on the house of cards, thou repeath whaet thou soweth or something.

craigching 4y ago

Ironically, logging is one of the ways to help mitigate/detect security vulnerabilities.

ClumsyPilot 4y ago

problem: food contaminated solution: stop eating

jsiaajdsdaa 4y ago
solution: find uncontaminated food, or make it yourself
- ClumsyPilot 4y ago
  option 1 - we and farmers, as professionals are responsible for supplying stuff that is not dangerous and works as it should Option 2 - which you are advocating - it's every man for himself and we decent into socity of warring tribes of hunter hatherer or subsitence farming at best
  - jsiaajdsdaa 4y ago
    option 2 is the only possible state of reality, because it is never possible to guarantee that everything work in every instance let the buyer be aware
    - paulmd 4y ago
      I mean, how do you know your webserver doesn't have a bug? How do you know your OS doesn't? Just write those yourself? How do you know yours doesn't? One must still verify the key functionality regardless. But, you're not wrong, some people reach for every library and framework they can, and others focus on building the most minimal and understandable thing that will work. I'm not saying writing your own server in assembly, but, avoid unnecessary junk and magic and libraries. It's the classic dilemma: in this world of ours, one can either return to monke or progress to crab.