> I liked the humble, “lessons learned” tone of the post. > > every feature you add is a feature you maintain forever. ... until it becomes a security flaw.

> I liked the humble, “lessons learned” tone of the post. > > every feature you add is a feature you maintain forever. ... until it becomes a security flaw. Log4shell (IIRC) goes back to a feature to do an indirect lookup of a string over jndi in a beta version of the library. https://issues.apache.org/jira/browse/LOG4J2-313 https://issues.apache.org/jira/browse/LOG4J2-313