> And whether Heartbleed was worse than log4shell is mostly philosophical. Most definitely not. Heartbleed means that as long as your are on the internet they

> And whether Heartbleed was worse than log4shell is mostly philosophical. Most definitely not. Heartbleed means that as long as your are on the internet they have your certs, full stop. Log4shell required access in both directions (to inject the vulnerable string, then for target machine to load the payload off internet) to do anything. The sheer fact that you think it is 'philosophical' difference points to you not understanding anything about the topic. log4shell could be trivally prevented by common security practices like "not allowing your apps to freely access anything on internet", heartbleed could not.