3 ms·

> My point is one shouldn't bring up Apache in the first place when talking about a project like Log4j. It's similarly irrelevant as "hosted on GitHub". That i

> My point is one shouldn't bring up Apache in the first place when talking about a project like Log4j. It's similarly irrelevant as "hosted on GitHub". That isn't comparable. - the name of the project is "Apache Log4J" - the tag-line is "*Apache Log4j* 2 is an upgrade to Log4j that provides significant improvements over its predecessor..." - it's hosted under the Apache organization - the documentation, release notes, and bug tracker is under the apache.org domain. - the artifacts are published under the org.apache namespace - etc. No competent person in the industry is going to think that GitHub is associated with the projects it hosts. There are also hundreds of projects stewarded by Eclipse, Red Hat, and other similar organizations that avoid this confusion by using sensible branding. What you're saying is more equivalent to "no reasonable person would think that Vitamin Water contains vitamins and is healthy". https://www.businessinsider.com/coca-cola-glacau-vitaminwater-misleading-advertising-lawsuit-2014-10 https://www.businessinsider.com/coca-cola-glacau-vitaminwate...

layer8 4y ago
The fact that Log4j is a project under the Apache foundation has practically zero bearing regarding Log4Shell. What relevance do you think Apache has here? Apache isn't a software development organization, it's a dev community umbrella organization. And therefore I think it's not useful to refer to the product as an Apache product.
- richbell 4y ago
  > The fact that Log4j is a project under the Apache foundation has practically zero bearing regarding Log4Shell. What relevance do you think Apache has here? Apache isn't a software development organization, it's a dev community umbrella organization. I am not sure how to make my point any clearer.
  - layer8 4y ago
    FWIW, I agree that the branding on the project pages can be misleading. My point is, we as developers who know what Apache is, shouldn't carry that misleading branding over when discussing such a project. In most contexts it doesn't make sense to talk about such a project as an Apache project, as if Apache was the entity managing the content of that project, very much like it doesn't make sense to talk about it as a GitHub project in that capacity.

layer8 4y ago

The fact that Log4j is a project under the Apache foundation has practically zero bearing regarding Log4Shell. What relevance do you think Apache has here? Apache isn't a software development organization, it's a dev community umbrella organization. And therefore I think it's not useful to refer to the product as an Apache product.

richbell 4y ago
> The fact that Log4j is a project under the Apache foundation has practically zero bearing regarding Log4Shell. What relevance do you think Apache has here? Apache isn't a software development organization, it's a dev community umbrella organization. I am not sure how to make my point any clearer.
- layer8 4y ago
  FWIW, I agree that the branding on the project pages can be misleading. My point is, we as developers who know what Apache is, shouldn't carry that misleading branding over when discussing such a project. In most contexts it doesn't make sense to talk about such a project as an Apache project, as if Apache was the entity managing the content of that project, very much like it doesn't make sense to talk about it as a GitHub project in that capacity.