News for hackers. Stuff that matters.

A comment on Why Is C Faster Than Java (2009). Parent comment

Re:Why Is C Faster Than Java (2009) by reyqn on Monday December 27, 2021 @06:16AM (#29701490)
Was there not a flaw in the jndi api for ldap? log4j was just the entry point from what I understood.
[ Parent | on HN ]
Re:Why Is C Faster Than Java (2009) by drdec on Monday December 27, 2021 @07:32AM (#29701968)
No, JNDI is an API for accessing remote code. It stands for Java Naming and Directory Interface. Not supporting LDAP, the most common remote directory, would have been a flaw.

The flaw was in log4j's use of the library which allowed remotely connecting and executing code by default based on connection strings which were possibly user-entered.

[ Parent | on HN ]
Re:Why Is C Faster Than Java (2009) by reyqn on Monday December 27, 2021 @06:49PM (#29708399)
Ok so JNDI's purpose is actually accessing remote code. You just have to not give it any untrusted data. It seems like a dangerous tool to use.
[ Parent | on HN ]