6 ms·

Saying that "Apache mismanaged" it when talking about addressing a vuln is quite awkward. Probably fueled by lack of understanding of what the foundation does.

by sdf4j 4y ago

Saying that "Apache mismanaged" it when talking about addressing a vuln is quite awkward. Probably fueled by lack of understanding of what the foundation does. The fact that every project have to have apache stamped in their name doesn't help either.

richbell 4y ago
So is saying "The Apache Software Foundation... quickly released a patch", but the average person doesn't care about the inner workings of the foundation because, as you mentioned, everything is stamped with "Apache". It may be technically incorrect, but most people wouldn't understand if you got into the minutiae.
- wongarsu 4y ago
  They might be able to understand, but they wouldn't care. If there's a bug in Microsoft Office there's no discussion which engineer was responsible. Microsoft put their name on it and are thus first recipient of praise and blame alike. Apache Log4J2 is no different.
- layer8 4y ago
  Apache provides infrastructure and some general organizational rules for projects, but the people who actually maintain any given Apache project are largly independent and autonomous, they are not "Apache".
  - richbell 4y ago
    You're right, but this misses the point of my comment. It's a distinction without a difference for most people, and trying to clarify the structure of the foundation to executives and senior leaders (technical and non-technical) only makes their perception of any Apache-branded or open source projects worse.
    - layer8 4y ago
      My point is one shouldn't bring up Apache in the first place when talking about a project like Log4j. It's similarly irrelevant as "hosted on GitHub".
      - richbell 4y ago
        > My point is one shouldn't bring up Apache in the first place when talking about a project like Log4j. It's similarly irrelevant as "hosted on GitHub". That isn't comparable. - the name of the project is "Apache Log4J" - the tag-line is "*Apache Log4j* 2 is an upgrade to Log4j that provides significant improvements over its predecessor..." - it's hosted under the Apache organization - the documentation, release notes, and bug tracker is under the apache.org domain. - the artifacts are published under the org.apache namespace - etc. No competent person in the industry is going to think that GitHub is associated with the projects it hosts. There are also hundreds of projects stewarded by Eclipse, Red Hat, and other similar organizations that avoid this confusion by using sensible branding. What you're saying is more equivalent to "no reasonable person would think that Vitamin Water contains vitamins and is healthy". https://www.businessinsider.com/coca-cola-glacau-vitaminwater-misleading-advertising-lawsuit-2014-10 https://www.businessinsider.com/coca-cola-glacau-vitaminwate...
        layer8 4y ago
        The fact that Log4j is a project under the Apache foundation has practically zero bearing regarding Log4Shell. What relevance do you think Apache has here? Apache isn't a software development organization, it's a dev community umbrella organization. And therefore I think it's not useful to refer to the product as an Apache product.
        richbell 4y ago
        > The fact that Log4j is a project under the Apache foundation has practically zero bearing regarding Log4Shell. What relevance do you think Apache has here? Apache isn't a software development organization, it's a dev community umbrella organization. I am not sure how to make my point any clearer.

by sdf4j 4y ago

richbell 4y ago

So is saying "The Apache Software Foundation... quickly released a patch", but the average person doesn't care about the inner workings of the foundation because, as you mentioned, everything is stamped with "Apache". It may be technically incorrect, but most people wouldn't understand if you got into the minutiae.

wongarsu 4y ago
They might be able to understand, but they wouldn't care. If there's a bug in Microsoft Office there's no discussion which engineer was responsible. Microsoft put their name on it and are thus first recipient of praise and blame alike. Apache Log4J2 is no different.
layer8 4y ago
Apache provides infrastructure and some general organizational rules for projects, but the people who actually maintain any given Apache project are largly independent and autonomous, they are not "Apache".
- richbell 4y ago
  You're right, but this misses the point of my comment. It's a distinction without a difference for most people, and trying to clarify the structure of the foundation to executives and senior leaders (technical and non-technical) only makes their perception of any Apache-branded or open source projects worse.
  - layer8 4y ago
    My point is one shouldn't bring up Apache in the first place when talking about a project like Log4j. It's similarly irrelevant as "hosted on GitHub".
    - richbell 4y ago
      > My point is one shouldn't bring up Apache in the first place when talking about a project like Log4j. It's similarly irrelevant as "hosted on GitHub". That isn't comparable. - the name of the project is "Apache Log4J" - the tag-line is "*Apache Log4j* 2 is an upgrade to Log4j that provides significant improvements over its predecessor..." - it's hosted under the Apache organization - the documentation, release notes, and bug tracker is under the apache.org domain. - the artifacts are published under the org.apache namespace - etc. No competent person in the industry is going to think that GitHub is associated with the projects it hosts. There are also hundreds of projects stewarded by Eclipse, Red Hat, and other similar organizations that avoid this confusion by using sensible branding. What you're saying is more equivalent to "no reasonable person would think that Vitamin Water contains vitamins and is healthy". https://www.businessinsider.com/coca-cola-glacau-vitaminwater-misleading-advertising-lawsuit-2014-10 https://www.businessinsider.com/coca-cola-glacau-vitaminwate...
      - layer8 4y ago
        The fact that Log4j is a project under the Apache foundation has practically zero bearing regarding Log4Shell. What relevance do you think Apache has here? Apache isn't a software development organization, it's a dev community umbrella organization. And therefore I think it's not useful to refer to the product as an Apache product.
        richbell 4y ago
        > The fact that Log4j is a project under the Apache foundation has practically zero bearing regarding Log4Shell. What relevance do you think Apache has here? Apache isn't a software development organization, it's a dev community umbrella organization. I am not sure how to make my point any clearer.