I remember that meeting. It was the one where we all wore togas and drank the java kool aid from goblets before we voted on that. All 5,000,000 of us.

You joke, but that code made it through rounds of reviews, and nobody saw anything wrong with having a logging library able to make network requests in the first place.

I honestly don't even blame the developers of Log4J that much, because after all its open source, and nobody is paying them to use it despite the idiocy surrounding shit like that.

I do however blame the developers that use Java, see things like this happen, and then continue to use it with Log4j after the patch like nothing ever happened.

JNDI is an obscure feature from the Java Enterprise Edition days that nobody really uses nowadays.

Java, Not Even Once.