News for hackers. Stuff that matters.

A comment on Third High Severity CVE in Log4j Is Published. Parent comment

Re:Third High Severity CVE in Log4j Is Published by yjftsjthsd-h on Sunday December 19, 2021 @02:48AM (#29612200)
Humor me: if log4j had 13 (independently developed) competitors, wouldn't the impact of this be much lower, because many consumers would use different libraries? Like genetic diversity as a hedge against disease.
[ Parent | on HN ]
Re:Third High Severity CVE in Log4j Is Published by rini17 on Sunday December 19, 2021 @06:16AM (#29613064)
Joke's on you: Then any nontrivial project would end up depending on half of them, actually increasing attack surface.
[ Parent | on HN ]
Re:Third High Severity CVE in Log4j Is Published by gonzo41 on Sunday December 19, 2021 @07:00AM (#29613266)
I bet they'd all compete on features and probably implement the same exploit trying to maintain market share.

Logging as it's understood today should ship with most STD libraries. Things like logback an log4j really should just eventually be rolled into the std.

[ Parent | on HN ]