Re:Log4j 2.15.0 – Previously suggested mitigations may not b...
by oblio on Thursday December 16, 2021 @04:48AM
(#29576635)
He he, an optimist.
log4j is in widespread use, directly or indirectly.
Most people don't give a crap about the exact Java logging library, the only places that actually care are those that bike shed, since functionally Java logging stuff is generally quite robust and full featured.
The worst part about my previous phrase is that the places that don't care about the Java logging library frequently don't do security audits, so prepare for a ton of exploits and data leaks in the following months and years.
log4j is in widespread use, directly or indirectly.
Most people don't give a crap about the exact Java logging library, the only places that actually care are those that bike shed, since functionally Java logging stuff is generally quite robust and full featured.
The worst part about my previous phrase is that the places that don't care about the Java logging library frequently don't do security audits, so prepare for a ton of exploits and data leaks in the following months and years.