3 ms·
Apathy is definitely the issue. Sometimes you tell a vendor about an issue and they say their app doesn't use Log4J even though it's gobbling up the Log4J test
by I_Am_Nous 3y ago
Apathy is definitely the issue. Sometimes you tell a vendor about an issue and they say their app doesn't use Log4J even though it's gobbling up the Log4J test script in the username field...they don't want to care, so you can't make them.
- ddol 3y agoKnowing that a vendor you selected is mishandling your users data and doesn’t care to secure their systems is unacceptable. Time to find a new vendor, as your continued usage of their unsecured services is now a liability.
- bzzzt 3y agoMaybe they only use the log4j test script ;) Or maybe someone had to run some scanning tool which reported 'no vulnerabilities'. Exploiting log4j requires logging to be influenced by user input. Even if an application includes a vulnerable log4j but doesn't bother to log anything there's zero risk. In that case apathy saved you ;)