Hacker News Reader

Comment by jsiaajdsdaa | Hacker News Reader

Better idea: stop logging.

Ironically, logging is one of the ways to help mitigate/detect security vulnerabilities.

It's not just logging. L4J is so extensible that people have used it for all kinds of things, way waaaaaayyyyy away from just logs. So disabling logs won't necessarily cut it.

I am no expert. I ended up indexing all the open source kruft I use to hold this ship of fools together, then verified that the Log4J pieces were definitely disabled with a bunch of monitoring while I tossed stuff at it. I did mention I am not an expert, right? I am sure there is a more Pro way to do this.

F around and find out basically. If you choose to build on the house of cards, thou repeath whaet thou soweth or something.

problem: food contaminated

solution: stop eating

solution: find uncontaminated food, or make it yourself

option 1 - we and farmers, as professionals are responsible for supplying stuff that is not dangerous and works as it should

Option 2 - which you are advocating - it's every man for himself and we decent into socity of warring tribes of hunter hatherer or subsitence farming at best

option 2 is the only possible state of reality, because it is never possible to guarantee that everything work in every instance

let the buyer be aware

I mean, how do you know your webserver doesn't have a bug? How do you know your OS doesn't? Just write those yourself? How do you know yours doesn't? One must still verify the key functionality regardless.

But, you're not wrong, some people reach for every library and framework they can, and others focus on building the most minimal and understandable thing that will work. I'm not saying writing your own server in assembly, but, avoid unnecessary junk and magic and libraries.

It's the classic dilemma: in this world of ours, one can either return to monke or progress to crab.

the issue is that this can pop up in any library, not just logging. It's about keeping your deps up to date (or not) by a "3d party" (assuming he mean 3rd party)

Yes, this can pop up in any library. But only because developers aren't taught "don't put remote code execution into your code". You'd think that would be something that someone would teach, but it doesn't really come up. Remember that log4j was vulnerable because of a feature - it all worked as designed.

Reply on news.ycombinator.com