Hacker News Reader

Comment by lesuorac | Hacker News Reader

I’d be happy to bet with you if I rolled my own log4j I would have never implemented jndi as a formatting argument.

Sure I shouldn’t roll my own crypto but I can write a logger…

Logging is a very complicated security area. You often get sensitive data in the logs and it gets sent across the network to monitoring servers.

Also any part of the program can send data to the logger. This means the logger can receive malicious payloads from anywhere. Maybe your logger handles ascii control characters badly?

I dunno I pretty much always wrote my own logger. Not even a shared library or anything just copypaste into next project or often don't even bother with that, just knock something out on the spot. Even before AI.

The only even slightly tricky part is like "don't mess unicode up", rest is straightforward. Sure it can be complicated with logging sinks, configurability, when to flush, monitoring and so on but in many cases you just don't need all that. You just build it whenever you do need it.

Logging is complicated for the general purpose point of view. Most people never need all of those features - which is kind of the point here. Log4j had so many features that 90% of projects didn’t need. Sure, large projects with multiple servers pointing at log receivers is complicated. But how many people were affected by the needs of probably 2 companies?

Capture log messages and write them directly to stderr? That’s easy.

This is where the LLM coded library replacements make sense. When you have non-critical code that can be easily swapped, I’m happy to let an LLM generate a logging package. If I have a need to send log messages out to a separate server for archival? I’d be a little more critical.

Imagine that you don't need monitoring servers, like possibly the majority of actual log4j deployments?

For example Minecraft uses log4j to write messages to the console and a rotating file.

Technically you can configure it to send to other places - presumably. In practice you'd be better just redirecting stdout, tailing the file, or installing a mod?

Honestly unless you insist on allowing running your software on Windows you're much better off delegating the logging to syslog over a thin wrapper. It can handle about anything except most exotic cases. This however goes against Java land portability promises and its NIH attitude so we have what we have.

Java is really really good at handling plugins. You can load additional JAR files alongside the app's own JAR file (indeed many apps are shipped as multiple JAR files) and classes from different files are integrated just as well as classes from the same file, and you can load them by name. It's pretty easy to have a command-line option that says "use this logger class instead" and make it the user's problem to supply a suitable class at startup time, and I think this is the way that makes the most sense in Java. It works on any OS and allows more detailed data exchange than just a log string; the logging plugin could even choose to take a stack trace whenever it's called, or read global data like the player's account name.

And probably more importantly, AI can write a very simple logger with no extra features than you absolutely need in 5 minutes, if that.

Can, or should?

I can’t be bothered to check the exact assembly to see if timing attacks are possible.

But crypto really is just a small thing. I’m not going to design a nuclear reactor but I’ll definitely do stuff that depends on the electricity from one. Similarly one can still do their own authentication; its not like even Apple forgot to rate limit…

Reply on news.ycombinator.com