3 ms·

We dropped an entire feature from our product because of this crap. We had a sidecar java process that handled certain PDF conversion tasks, but the lack of in-

We dropped an entire feature from our product because of this crap. We had a sidecar java process that handled certain PDF conversion tasks, but the lack of in-house java wizardry meant that we couldn't trust that small binary with regard to a spiraling vulnerability situation. Our customers were very nervous at the time. Making something work in Java is easy. Proving it is secure is not. It is almost certain that we over-reacted and shot ourselves in the foot with this, but our customers were happy with the way in which we responded. Better safe than sorry was the theme throughout.

geodel 4y ago
> Making something work in Java is easy. Proving it is secure is not. Ok, so which language it is easy to prove secure?
- eli 4y ago
  Prove secure to a corporate procurement process. Not a formal logic proof. Any use of Java will trigger additional diligence work to prove it does not use vulnerable log4j. So in this sense almost anything else is better.
  - ilyt 4y ago
    That's like 15 minutes of work tho
    - richbell 4y ago
      Perhaps — explaining that to people in procurement and convincing them is months of work. Corporate procurement doesn't actually care about the risk in many cases, they care about having someone to blame.
- bob1029 4y ago
  None are. But, we do have sufficient resources to justify and defend decisions made with our primary development language. In this context, "prove" is more like "convince".
  - eby 4y ago
    Is there any interest in bringing back that feature? No wizard here, but I dealt with Log4shell for our product. Reach out if you'd like someone to take a look.
dj_mc_merlin 4y ago
> but the lack of in-house java wizardry meant that we couldn't trust that small binary with regard to a spiraling vulnerability situation. I've never experienced the problem of "nobody in my company knows Java well enough to trace the dependencies of a JAR". Do you all works in Rust and Javascript or something?
mtillman 4y ago
"This crap" being software that you exploited for financial gain without contributing to.
- DiggyJohnson 4y ago
  I think your use of the word “exploited” here is completely misused or naive, considering the open source license of the software.

geodel 4y ago

> Making something work in Java is easy. Proving it is secure is not. Ok, so which language it is easy to prove secure?

eli 4y ago
Prove secure to a corporate procurement process. Not a formal logic proof. Any use of Java will trigger additional diligence work to prove it does not use vulnerable log4j. So in this sense almost anything else is better.
- ilyt 4y ago
  That's like 15 minutes of work tho
  - richbell 4y ago
    Perhaps — explaining that to people in procurement and convincing them is months of work. Corporate procurement doesn't actually care about the risk in many cases, they care about having someone to blame.
bob1029 4y ago
None are. But, we do have sufficient resources to justify and defend decisions made with our primary development language. In this context, "prove" is more like "convince".
- eby 4y ago
  Is there any interest in bringing back that feature? No wizard here, but I dealt with Log4shell for our product. Reach out if you'd like someone to take a look.

dj_mc_merlin 4y ago

> but the lack of in-house java wizardry meant that we couldn't trust that small binary with regard to a spiraling vulnerability situation. I've never experienced the problem of "nobody in my company knows Java well enough to trace the dependencies of a JAR". Do you all works in Rust and Javascript or something?

mtillman 4y ago

"This crap" being software that you exploited for financial gain without contributing to.

DiggyJohnson 4y ago
I think your use of the word “exploited” here is completely misused or naive, considering the open source license of the software.