Re:Jndi: An irresponsibly bad logging library
by Ygg2 on Saturday December 11, 2021 @04:52PM
(#29524604)
Log4j maintainers didn't like the feature, they added it for backwards compatibility.
> Log4j maintainers have been working sleeplessly on mitigation measures; fixes, docs, CVE, replies to inquiries, etc. Yet nothing is stopping people to bash us, for work we aren't paid for, for a feature we all dislike yet needed to keep due to backward compatibility concerns.
Re:Jndi: An irresponsibly bad logging library
by NovaX on Saturday December 11, 2021 @05:03PM
(#29524681)
It was added by these maintainers in 2.x and did not exist in 1.x. The maintainers are also different from 1.x developers and took the brand. They may regret their past decisions, but it was is irresponsible to claim that it was not their fault and added for backward compatibility.
You added a feature that can load plugins and query any kind of data based on user provided strings, this is completely unexpected and never happened before. What to call it? How about SQL injection attack, sounds about fancy enough.
If you implement feature requests without thinking about the design and security implications it has you are doomed to repeat history.