Re: log4j vulnerability, do you all really let your production services and hosts talk to any old IP address on the Internet that they want to?
49
58
412
Conversation
Replying to
github.com/GrapheneOS/Att
Not that it matters in this case since we use OpenJDK 17 and wouldn't dare to use a horrifying Apache logging library instead of java.util.logging.
We're so adverse to complexity we use the barebones OpenJDK HTTP server and SQLite as the database though.
Replying to
I think this instance shows the value of only adopting the complexity that you actually want/need.
1
1
9
I'm reminded of an excellent talk gave on reducing complexity and attack surface, and how much impact that can have on your overall security.
1
3
Show replies
This issue here is not whether I would myself use log4j instead of a built-in alternative (I would not). The issue is that it’s embedded in so many places. So we have a “bits on the box” problem…
2
This Tweet is from a suspended account. Learn more
Something existing and being widely used doesn't imply there's an actual need or reasoning behind it. Complexity of log4j is largely because they're poorly reinventing the wheel and aren't familiar with approaches elsewhere... there are advantages to having a broader perspective.
1
1