How do I fund ripping out bad ideas from existing open source software?
Log4j2 partially exists because of pushback on adding features to v1
Log4j2 partially exists because of pushback on adding features to v1
Honestly the biggest problem of package managers is finding a reputable package that one can trust.
The best one can do to aid this situation is reviewing, vetting and warning of which packages that can be trusted and not. Automatic scanners to find code smells and vulnerabilities.
“Security rating: 2/10, This package seems to use JNDI loading, are you sure you want to continue (y/n).”
Logging as it's understood today should ship with most STD libraries. Things like logback an log4j really should just eventually be rolled into the std.