Re:Third High Severity CVE in Log4j Is Published
by tekknik on Sunday December 19, 2021 @08:11AM
(#29613637)
> Reviewing all of the source code for log4j is not a walk in the park.
Traditionally if something is too large to audit then you shouldn’t use it, which few exceptions (like Linux). Maybe this should be a red flag in the future, especially for a logging library that can almost be replaced with a call to stdout and a log collector.
Traditionally if something is too large to audit then you shouldn’t use it, which few exceptions (like Linux). Maybe this should be a red flag in the future, especially for a logging library that can almost be replaced with a call to stdout and a log collector.