News for hackers. Stuff that matters.
Re:Third High Severity CVE in Log4j Is Published by jiggawatts on Sunday December 19, 2021 @03:01AM (#29612256)
> generally not something companies take responsibility for

I have some bad news for you: viruses and hackers don't care about your support contracts and the delays they cause.

Actually, I tell a lie: the hackers love them.

Re:Third High Severity CVE in Log4j Is Published by staticassertion on Sunday December 19, 2021 @04:48AM (#29612648)
That's not relevant? The original premise here is "compiled languages will make things worse because they're harder to patch" except:

a) It's very rare to patch things manually

b) It's very rare to develop patches yourself (for 3rd party software)

I'm sure some companies out there with many decades old deployments have to do stupid shit like that, but it's hardly the standard.

Re:Third High Severity CVE in Log4j Is Published by lazide on Sunday December 19, 2021 @03:56PM (#29618312)
Having been on the receiving end of waiting a long time to get a patch for a actively being exploited zero day - the point is, even if you want to fix it yourself (which I desperately did), you can’t.

If it’s some important piece of software you also can’t stop or the business stops - well, you and everyone else is just going to take it in the pants.

Many enterprises are in exactly this bind. And support contracts only get you so far.

Re:Third High Severity CVE in Log4j Is Published by staticassertion on Sunday December 19, 2021 @06:00PM (#29619448)
I'm losing your point. So, you wanted to patch it, and you couldn't, so how is it bad then that a compiled binary would make patching more difficult?
Re:Third High Severity CVE in Log4j Is Published by lazide on Tuesday December 21, 2021 @12:36AM (#29634303)
It was impossible to fix because it was a compiled binary with no available source. That’s the point.