The whole thing stems from developers wanting "easy" to use logger and mixing "a formatting string" with "actual thing being formatted". The vulnerability is ba

The whole thing stems from developers wanting "easy" to use logger and mixing "a formatting string" with "actual thing being formatted". The vulnerability is bad enough on its own but having API of library allowing to pass one argument that is then treated as format string practically ensues someone will do on accident if library have interface being .log(format,value...) .log(format) It is kinda easy to assume second invocation would not apply formatting and just act as plain value, because it makes zero sense to have format string with no inputs, yet that's what Log4J does. Separating it for "log" and "log with formatting" calls helps a bunch, at the very least makes easier to search for potentially vulnerable code.