News for hackers. Stuff that matters.

A comment on New Log4j2 vulnerability. Parent comment

Re:New Log4j2 vulnerability by alfiedotwtf on Tuesday December 28, 2021 @06:05PM (#29719402)
Holy moly, how was that ever a good idea. Just like routers being able to be configured via the manufacturer's website, config by someone other than you seems like a big red flag
[ Parent | on HN ]
Re:New Log4j2 vulnerability by jfoutz on Tuesday December 28, 2021 @06:14PM (#29719503)
well log4j will be old enough to drink in a few weeks (January 8, 2001). It's way older than bcfg2 or ansible, chef, puppet, etc. I'm not sure when the functionality was added. I'd bet it was the bees knees at the time.
[ Parent | on HN ]
Re:New Log4j2 vulnerability by mschuster91 on Tuesday December 28, 2021 @06:40PM (#29719710)
Log4j v2 (which was the first version to support plugins and lookups) was released in 2014.
[ Parent | on HN ]
Re:New Log4j2 vulnerability by jfoutz on Tuesday December 28, 2021 @06:53PM (#29719810)
Wild. I guess the NSA black bag job at Google was 2013, which led to SSL everywhere. I guess most folks still had the hard and crunchy on the outside, soft and chewy model on the inside mindset. Time flies.
[ Parent | on HN ]
Re:New Log4j2 vulnerability by mongol on Tuesday December 28, 2021 @06:19PM (#29719551)
Sad that it should be retired now when it is coming of age.
[ Parent | on HN ]