Re: log4j vulnerability, do you all really let your production services and hosts talk to any old IP address on the Internet that they want to?
49
58
412
Conversation
Replying to
github.com/GrapheneOS/Att
Not that it matters in this case since we use OpenJDK 17 and wouldn't dare to use a horrifying Apache logging library instead of java.util.logging.
We're so adverse to complexity we use the barebones OpenJDK HTTP server and SQLite as the database though.
3
15
This Tweet is from a suspended account. Learn more
Something existing and being widely used doesn't imply there's an actual need or reasoning behind it. Complexity of log4j is largely because they're poorly reinventing the wheel and aren't familiar with approaches elsewhere... there are advantages to having a broader perspective.
1
1
This Tweet is from a suspended account. Learn more
They should be using a proper logging service covering more than simply their one process with a far more robust and properly engineered approach. I see it as a symptom of developers creating something in their language ecosystem bubble without system administration experience.
logging.apache.org/log4j/log4j-2.
I can't understand why a logging library would actually have all of these things instead of being glue to a service.
It might make sense to a Java programmer but it doesn't make sense to me where Java is simply one of a dozen languages I regularly use.
2
Service being something like rsyslog or systemd-journald?