News for hackers. Stuff that matters.

A comment on Making Open Source software safer and more secure. Parent comment

Re:Making Open Source software safer and more secure by shadowgovt on Thursday January 13, 2022 @05:04PM (#29927550)
Google doesn't use Log4j; they built an in-house logger.

Meanwhile, they fund OpenSSL (https://arstechnica.com/information-technology/2014/04/tech-...) but are also funding alternatives (https://www.neowin.net/news/google-provides-funding-for-deve...).

[ Parent | on HN ]
Re:Making Open Source software safer and more secure by pvorb on Thursday January 13, 2022 @05:19PM (#29927746)
Google does certainly use log4j. They didn't write every single line of code themselves that they're using.
[ Parent | on HN ]
Re:Making Open Source software safer and more secure by shadowgovt on Thursday January 13, 2022 @05:36PM (#29927935)
It's possible it's being used somewhere in an open-source external project that Google produces. I can't name anything off the top of my head.

... but in-house, in their running-on-Borg services written in Java, they have their own API for log capturing. Log4j doesn't offer nearly the level of integration to their logging and tracing fabric they need. And the Cloud Logging API has adapters for Log4j, but none maintained first-party, IIUC.

[ Parent | on HN ]
Re:Making Open Source software safer and more secure by UncleMeat on Friday January 14, 2022 @05:03AM (#29932594)
Google's codebase is huge and has many weird corners, but the monolith structure meant that virtually everybody switched over to a different logging framework a while ago.
[ Parent | on HN ]