3 ms·
Yes, we all sat down and unanimously agreed that we should perform JNDI lookups to execute arbitrary code stored in an LDAP directory. No regrets.
by Smeevy 3y ago
Yes, we all sat down and unanimously agreed that we should perform JNDI lookups to execute arbitrary code stored in an LDAP directory.
No regrets.
- amoss 3y agoJava, Not Even Once.
- onionisafruit 3y agoI remember that meeting. It was the one where we all wore togas and drank the java kool aid from goblets before we voted on that. All 5,000,000 of us.
- ActorNightly 3y agoYou joke, but that code made it through rounds of reviews, and nobody saw anything wrong with having a logging library able to make network requests in the first place. I honestly don't even blame the developers of Log4J that much, because after all its open source, and nobody is paying them to use it despite the idiocy surrounding shit like that. I do however blame the developers that use Java, see things like this happen, and then continue to use it with Log4j after the patch like nothing ever happened.
- wil421 3y agoSince developers can just decide to rewrite a code base because Java is not a shiny new language.
- imtringued 3y agoJNDI is an obscure feature from the Java Enterprise Edition days that nobody really uses nowadays.