News for hackers. Stuff that matters.
Re:Third High Severity CVE in Log4j Is Published by Too on Sunday December 19, 2021 @01:38AM (#29611954)
Lesson learned. Never buy closed source.

Imagine the vulnerability would have been in the vendor code instead of in the log4j jar. You’d. still need a way to fix and rebuild it.

Note that this doesn’t have to mean a public MIT repo on GitHub. You can have more restrictive gray box licenses between your b2b partners only.

Re:Third High Severity CVE in Log4j Is Published by tormeh on Sunday December 19, 2021 @07:07AM (#29613294)
If it's a 20 year old closed source application, there probably aren't any exploits in the wild. You can bet there are exploits for log4j.