News for hackers. Stuff that matters.

A comment on Log4Shell Still Has Sting in the Tail. Parent comment

Re:Log4Shell Still Has Sting in the Tail by eli on Friday December 30, 2022 @11:18AM (#34186426)
Prove secure to a corporate procurement process. Not a formal logic proof.

Any use of Java will trigger additional diligence work to prove it does not use vulnerable log4j. So in this sense almost anything else is better.

[ Parent | on HN ]
Re:Log4Shell Still Has Sting in the Tail by ilyt on Friday December 30, 2022 @12:13PM (#34187096)
That's like 15 minutes of work tho
[ Parent | on HN ]
Re:Log4Shell Still Has Sting in the Tail by richbell on Friday December 30, 2022 @12:34PM (#34187360)
Perhaps — explaining that to people in procurement and convincing them is months of work. Corporate procurement doesn't actually care about the risk in many cases, they care about having someone to blame.
[ Parent | on HN ]