As a non-java company developer at the time, I think our biggest challenge was explaining to everyone that Log4j didn’t affect us. It took a non-zero amount of effort because a lot of customers panicked. To be fair, it was also an industry where confidentiality is important.
Oh man. I missed it by like a month. I graduated with my bachelors in December, and started in January. I was hearing horror stories from my new coworkers about how people had to cancel vacations to get stuff patched asap
Lol, yeah for us we didn’t own any of the code that used it but depended on server software made internally that did. At the time we managed our own hosts, so it was a long week of deployments.
That one was so annoying because you had to be using the log server to have any issues. If your network was locked down, the log server was disabled, or if you happened to be using a version that was from before the log server was added, then there were no issues. But clients just heard “log4j” and thought it was unsafe.
Log4j was a fun one to watch unfold everywhere when things went haywire
That was not a fun week to be a developer.
As a non-java company developer at the time, I think our biggest challenge was explaining to everyone that Log4j didn’t affect us. It took a non-zero amount of effort because a lot of customers panicked. To be fair, it was also an industry where confidentiality is important.
Also a lot of people were pulling it transitively.
If you’re pulling log4j transitively, someone somewhere has made a serious mistake. Libraries should only depend on façades like SLF4J.
Oh man. I missed it by like a month. I graduated with my bachelors in December, and started in January. I was hearing horror stories from my new coworkers about how people had to cancel vacations to get stuff patched asap
It was if none of your code used log4j. I remember being very grateful that I had chosen
java.util.loggingand Logback for my Java logging needs.Lol, yeah for us we didn’t own any of the code that used it but depended on server software made internally that did. At the time we managed our own hosts, so it was a long week of deployments.
That one was so annoying because you had to be using the log server to have any issues. If your network was locked down, the log server was disabled, or if you happened to be using a version that was from before the log server was added, then there were no issues. But clients just heard “log4j” and thought it was unsafe.
‘clients’ are really dumb sometimes…
Couldn’t remember which logging library it was, thanks for mentioning it, it would have low-key bugged me all day.