My gut reaction was "what a waste of money, just move on to literally any other logging framework". Then I remembered that reality is still a thing, and that th

My gut reaction was "what a waste of money, just move on to literally any other logging framework". Then I remembered that reality is still a thing, and that there are thousands of companies running oodles of unmaintained applications. Applications to which they probably don't have the source code, and if they do, are unable to build new versions because of bit rot. And that, maybe, these people can get away with replacing the Log4J JAR file in their installation. Maybe. The state of software security seems truly abysmal. Which is no surprise, given that many companies outsource development, receive a working product, and then the development team moves on and no one ever seems to bother with security maintenance.