What percentage of Java software can’t be patched because the companies that developed it have lost the source code?
93
166
1,570
Conversation
Replying to
Assuming the company is even still around. Lotta embedded java out there.
2
40
Replying to
Good news is the JNDI lookup stuff didn’t arrive til 2013, so anything from before then is totally safe.
3
1
56
It's also not provided by the original log4j which is even now is still far more widely used by log4j2 despite being completely dead for a long time. The original developer of the original log4j wasn't involved in log4j2 but rather built other successor projects outside Apache.
1
2
Apache wrongly announced that the original library was vulnerable to it and there appears to be some substantial bad blood between them and the author of the original library. Projects should definitely replace the abandoned original log4j but probably not with log4j2...
1
1
slf4j.org and logback.qos.ch are from the person who wrote the original log4j and those implement exactly the same API as the original log4j. A lot of people moved to those. I'm a bit turned off by the HTTPS to HTTP redirect and ancient Apache though...
1
3
The standard java.util.logging is perfectly good as long as you're fine with delegating all the complex processing features and triggers to a system service like rsyslog. It seems these libraries exist primarily to hard-wire that functionality into the application instead.