Re:Making Open Source software safer and more secure
by melissalobos on Thursday January 13, 2022 @04:44PM
(#29927302)
This seems like it is the second time we have had to learn about the importance of maintain large open source infrastructure projects like this. log4j and openSSL before it, show that these projects aren't just the responsibility of the maintainers, but all of their users as well. We really need more money being paid by larger users like Google directly to the maintainers.
[ Parent
| on HN ]
Re:Making Open Source software safer and more secure
by shadowgovt on Thursday January 13, 2022 @05:04PM
(#29927550)
Google doesn't use Log4j; they built an in-house logger.
Meanwhile, they fund OpenSSL (https://arstechnica.com/information-technology/2014/04/tech-...) but are also funding alternatives (https://www.neowin.net/news/google-provides-funding-for-deve...).
Re:Making Open Source software safer and more secure
by pvorb on Thursday January 13, 2022 @05:19PM
(#29927746)
Google does certainly use log4j. They didn't write every single line of code themselves that they're using.
Re:Making Open Source software safer and more secure
by shadowgovt on Thursday January 13, 2022 @05:36PM
(#29927935)
It's possible it's being used somewhere in an open-source external project that Google produces. I can't name anything off the top of my head.
... but in-house, in their running-on-Borg services written in Java, they have their own API for log capturing. Log4j doesn't offer nearly the level of integration to their logging and tracing fabric they need. And the Cloud Logging API has adapters for Log4j, but none maintained first-party, IIUC.