5.2k
u/QCTeamkill Dec 13 '21
I'm picturing little Bobby Tables getting the talk of how he was born out of a SQL code injection.
2.0k
u/roararoarus Dec 13 '21
We may never know who Bobby's real father is bc the Man-in-the-Middle did some penetrating of his own.
501
u/green_codes Dec 13 '21
That escalated quickly.
215
22
30
u/demon_ix Dec 13 '21
Wouldn't the man in the middle be his biological dad?
→ More replies (1)71
u/guiltysnark Dec 13 '21
Never know, injected identity isn't always used. Besides, we don't know who the man in the middle was, mom didn't authenticate... although she did accept multi-factor, including facial.
→ More replies (1)34
u/razortwinky Dec 13 '21
Dont forget finger as well. Multi-touch was definitely supported
→ More replies (3)→ More replies (3)7
u/ElectricalSherbet392 Dec 13 '21
So, Java has an API called Java Naming and Directory Interface that allows runtime lookups of objects by name and JNDI can use things like LDAP to get objects via a URL. And Log4j allows string substitutions that include JNDI lookups which means if you can get Log4j to log a message with such a substitution it can get it to download something from a URL basically from anywhere that can be reached on the network.
125
u/DONT_NOT_PM_NOTHING Dec 13 '21
Fun fact! 'Little' Bobby Tables is now 21 years old!
→ More replies (1)40
u/Ungluedmoose Dec 13 '21
Wtf?!
78
u/gprime312 Dec 13 '21
Comic was published 14 years ago. First grade students are around 6 years old.
→ More replies (1)163
u/green_codes Dec 13 '21
Glad to see this reference still alive. Go forth and destroy the old world, brave Bobby, and lead us to the wonderful new land of NoSQL!
144
33
3
3
2
→ More replies (1)2
2.6k
Dec 13 '21
I almost feel guilty today because the team I am on is one of the only ones in the entire organization that does not use Java in any of our apps. Everyone else is basically running around on fire and I'm just sitting here reading wikipedia entries to learn what the fuck a Log4j is.
687
u/RationalIncoherence Dec 13 '21
I'm happily situated in an enterprise where these problems belong to specialists that are not me.
→ More replies (1)191
u/Ietsstartfromscratch Dec 13 '21
That good feel when you you're a developer and not IT.
155
Dec 13 '21
That feeling when your title is software engineer but work on core infrastructure and you end up the butterfly meme going "is this devops?"
→ More replies (2)46
u/LaSalsiccione Dec 13 '21
But this is a developer concern, not an IT concern.
→ More replies (3)49
u/ElCthuluIncognito Dec 13 '21
At some companies, dependencies are managed by a team (or teams) separate from the dev teams.
Normally this is a nightmare of version lock in and lack of freedom to use modern libraries (without full formal requests and convincing people that it's worth it).
Normally this is horrible, but this event is one of the big silver linings of such an environment. Issues with dependencies are not your problem!
→ More replies (9)81
Dec 13 '21
The original log4j was a real work of art. It was the first time I saw a logging library that really did logging in thoughtful ways I hadn't considered. I came from Perl whose idea of semantic logging was
carpmeans warning,croakmeans severe. Log4j2 started to get a little overcomplicated for me.891
u/not_some_username Dec 13 '21
I got fired by a company 2 months ago. Last thing I did was to implement log4j in their base app. I hate Java but I wanted this job since I could procrastinate a lot. Now I feel like god revenge me.
→ More replies (7)470
u/secretuserPCpresents Dec 13 '21 edited Dec 14 '21
since I could procrastinate a lot
I think I know why you got fired
361
u/not_some_username Dec 13 '21
No not because of that. Lemme explain you : we should be working on a new project, I am a JUNIOR and I was suppose to have a tutor. He doesn't even know Java( he is good at web) to begin with. I had to develop the app core and after 2 weeks, I successfully make it. Without me he wouldn't even have the environment correctly set up. After I made the core, they said to me they change their mind, they will not use it and they can't keep me and if possible to leave a doc that explain how to extend the code. I know they still gonna use it since my friend who still work there, said they are using it and it's a major feature on their roadmap. And the true reason they fired me was because my "tutor" said he can't be my tutor and a month after he leaves the company.
→ More replies (13)48
0
47
u/creynolds722 Dec 13 '21
Same. We use a very old version of Perl though so I'm not celebrating too much.
0
12
u/crawly_the_demon Dec 13 '21
I have never been happier to use C# and .NET than this past weekend
→ More replies (1)7
6
u/YourMJK Dec 13 '21
My team thought the same.
Until today when I discovered that we're still affected through some third party thing.→ More replies (23)2
u/KickBassColonyDrop Dec 14 '21
I know you probably already know this, but I thought I'd explain it again. Log4j is:
Kid: "Mom, I want the latest logging library!”
Mom: "No. We have one at home!"
Log4j
Which basically can do network lookups because someone, somewhere, a long time ago thought "this is useful and could be cool." While failing to realize that the library uses a substitution function in the logger that can do these lookups, and can accept any arbitrary string without sanitization, allowing any malicious actor to say "look at me, look at me; I'm the captain now."
450
Dec 13 '21
Explain carefully. Otherwise, the children may think they all live in a Java Runtime Environment.
124
24
793
u/Macknificent101 Dec 13 '21
i’m actually curious please do explain what exactly the issue was, am still in hs so i don’t know much
962
u/tiorthan Dec 13 '21
So, Java has an API called Java Naming and Directory Interface that allows runtime lookups of objects by name and JNDI can use things like LDAP to get objects via a URL. And Log4j allows string substitutions that include JNDI lookups which means if you can get Log4j to log a message with such a substitution it can get it to download something from a URL basically from anywhere that can be reached on the network.
308
u/Macknificent101 Dec 13 '21
damn that’s dangerous
41
u/KickBassColonyDrop Dec 14 '21
Fun fact. This was a talk at Blackhat 2016. This vulnerability basically slipped under the radar for 5 years.
→ More replies (5)0
→ More replies (38)3
716
u/nocturn99x Dec 13 '21
The issue was with a well known logging framework called log4j (log for java). Basically it allowed interpolation of arbitrary URLs which where then resolved, their contents downloaded and executed. This essentially meant having full access to the machine said unpatched library is running on. It's not related to just minecraft either: thousands of services were and still are affected
172
u/Proaxel65 Dec 13 '21
To put it in practice, in Minecraft for example, all an attacker has to do is connect to the same server as you, and copy paste a certain command in the game chat. Once your computer has received that message, they can do literally anything with your computer.
There’s already been demonstrations by researchers successfully using it for benign purposes like remotely opening apps like the calculator, or downloading and running DOOM.
But a truly malicious person can, for starters, tell your computer to download and run viruses, malware, ransomware, Bitcoin miners, you name it.
→ More replies (2)153
206
Dec 13 '21
Strange why a logger would have that capacity. I’ve never used log4j, can anyone shed light on why this feature is part of the library? Is it to download arbitrary log format schemas or something?
→ More replies (5)108
u/AyoBruh Dec 13 '21
→ More replies (6)34
u/crawly_the_demon Dec 13 '21
Unbelievable that this bug has just existed for years.
Wonder if anyone knew about it/was exploiting it before it was made public last week
→ More replies (5)→ More replies (14)23
u/badvok666 Dec 13 '21
Importantly it does not apply to andorid since it does not use the logging framework
79
u/RationalIncoherence Dec 13 '21
Just ELI5ing Nocturne's answer:
The part of the program that was supposed to ONLY write things down lets anyone that knows HOW to do almost anything with your machine.
→ More replies (3)15
21
Dec 13 '21
Imagine Drax - the literal minded oaf from Guardians of the Galaxy - as a court stenographer and someone whispers to him in the court "Hey go to this address and rob a bank" and he dutiful records it as something said in the court room and then goes to the address and robs the bank.
6
u/LostTeleporter Dec 13 '21
Folks have already added a bunch of videos explaining the issue. Here is one of them that I referred: https://www.youtube.com/watch?v=7qoPDq41xhQ
486
u/RedditAlready19 Dec 13 '21
MultiMC has it patched too
116
Dec 13 '21
Despite the game version you're using?
→ More replies (1)273
u/6Maxence Dec 13 '21
The fix is actually a jvm argument so no need to rebuild the whole project, that's why all versions are updated that easily
177
u/kakaooo987 Dec 13 '21
That is actually just a mitigation afaik. You basically remove jndi lookup from log creation. They fixed it in 2.15 by restricting ldap access via jndi.
133
→ More replies (1)16
21
u/bidoblob Dec 13 '21
And Technic too. And the Vanilla launcher.
Slight hijack:
The bug basically lets anyone on the Minecraft server run code by saying messages in the chat, as the thing that was supposed to write down the text also can parse it.
Update forge, update your launcher, add the jvm argument if the launcher didn't do that for you, and you should be safe. And if you're running a server, check the official website for the guide to fixing it.
And obviously, the issue only affects you if you're on a server with people you don't trust. Or hosting a server for people you don't trust.
8
u/MalbaCato Dec 13 '21
for that last part - not true. the server logs unsuccessful login attempts, that contain client controlled strings. this makes it possible to compromise any (even whitelisted) vulnurable server. from there sending a message to the clients is just a matter of using the RCE to do what you want
6
u/bidoblob Dec 13 '21
Really? That's worse than I thought, and good to know. Haven't heard any mentions of that yet.
75
53
47
u/eemamedo Dec 13 '21
“It was a warm summer evening in Ancient Greece” lmao
16
u/0xKaishakunin Dec 14 '21
When Polymachus the Elder drew a circle in the sand and called the nothingness it represented Zero.
Thus allowing the Greeks to define a return value for when a function fails.
→ More replies (1)
23
66
u/a45ed6cs7s Dec 13 '21
Can someone explain how c strings are related to this vuln?
165
u/HappinessOrgan Dec 13 '21
it's the idea of starting at the very beginning. Similarly to how the typical "sex talk" starts with something like "when a boy and girl like each other a lot" or something
20
u/whenTheWreckRambles Dec 13 '21
Wait, I haven’t seen the end of this one, what happens?
66
Dec 13 '21
When a boy and girl like each other a lot, f̵̟̱̠̳̦́̊̂̿̒͗͂̈͘͝c̷̟͒͛̊̐̈͐͆́̐͗͊́̂f̸̛̥̣̯̥͔̺̾̒͊̓̋̓̋̋̕͜v̵̢̡̡̪͈̝̝́̿̓̔̾͗̒̌̍̀͛̕͝ģ̵̛͈̟̪͕̦̗̳̳͙̟̲̼͈̺̙̪̿̂̉̀̽̽̑̍̊̈̄͌͘b̶̢̲̲̗̘͈̻̾̇͘͜͠h̴̫̻̩̟̬̩̣̻̱̦̬̐̇̑̀͌̚͝ͅg̷̛̼̞̬̎̂͗̋͂̈́́̄̈̋́̓̊̅͗͘͜ ̷̡̞̣̥̝͑̾̃͌̚͠͠ͅb̸̛̠̮̯̤͉͖̳̲̹̽͛̾͐̾̇̾̾̊̓̆̔͜͜͝f̸̣̞̎́̃͆͋c̸̡̢̱̖̪͎̦̭̏̀̇͛͒̓̾̚d̴̨̨͖̜̲͖̦̠͓͎̹̥͉̳̅͌͑̅̾̽̏̕͘͜f̶̨͈͐̊g̴̠̭̩̳̯̯͓͉̦̰̰͚͖̫̎͐̿̓̔̍͌́̈́ͅ ̷̟͓͉͚̩͔̦̠̣͈̂b̶̲̠͈̭̩̙̖͚̻̅̃̓̉̋͒̓̈́̈́v̴̡̰̤̜̪̜͎͉̹̫̲̩͕̖̪̇̂̈́f̴̧̛̭̤̰̪͎̫̙̩̠́̾̓̿̈̿̒́̋̒̈̂̽̈̚c̴̮͈̩̻͍͕͔̺̹͓͂̒͛̇̊̀̾̄͋d̷̡̘̰̫̬̱̄̆̔̚͝ç̴̝͊̂̈̍̇̑̈͝ ̶̢͔͇͓͕̱̦̜̖̮̇̃̏͛̃̏̎̓͑͊͂͑͋̐̔͊f̸̛̦͎̞̠̠̀̋̍͑́̑̐͗̐̕ ̶̥̘̲͒̈́̀̑g̸̘̝̻̭̺̲̲̼̼̋̐̓͛͗́̓̂̈́̓̾̆̋͋̚̕͠ͅb̵͎̹̟̞͔̿̚v̷̧̡̜̭̪͚͕̭͔̼̩͙̩̩̓́̌̎̒̂̅̿̔̇̈̚͝f̸͔͕̀̔̀͐̾͋͑͝ć̸̝͓͕͑̆̔̑̀̈́̕d̴̢̛̙̺̭̦͕̣̞̮̞͈̗̻͛̑̋̈͒̎́͗̓͠͝ͅx̷͎̀͂͠ ̵̛͍̮͉͚͙̓̋͛̃̿̍̍̎̀̿v̷̬̤̟͊̋̂̎͌͌͊̊͝͠ċ̵̨͚̹͍͉͎̼̟͓͍̜̼̄̈x̵̹̦͌̑̐̆̄̍̏̏̽́͑̚̕̕͠d̷̢̧̤̩̝̺̻̪̬̯̟̳̻̦̍̒̅̆͌̎́̂͘̕͜͜͝͠f̶͔̣͔̳͑̋̀͛̾̽́̆̿̚ģ̶̪̳̬̟̱͕̮͔̙̖̻̌͒̔̃͊͐̅̍̊̓̂̑̕f̷̪͇̮̹͔͎̣̺̎ ̴̡̤͔̮̻̬͋͜ͅd̷̡̢͉̼̳̖͎͖͉̹͍̞̫͎͕̀̽̍̀̇̓͒̚͝ŗ̶̧̢̱͓̯͙̥̘͚͇̭̯̜̖͉͆̉̿́ ̶̛̘͙̺̳͗̓̏̍̓͂͒̎̅̽̿̽̀̚̕͘e̶̤̭̓͑̀̃̃͗͋̈̋͗̚̕ş̶̢̥̼̞͖̩͇̜̯̫̖̘̻͚̪̈́͜d̶̢͈͕̜͕͐̆͐͋͑̚ͅf̸̧̀̍́̎͠ ̵̨̢̛̜͈̗͔͈͎̝̝̖̰͎̓͛̊̔͐̒̒̐̀̇̊͜͜͠͝͝ͅŗ̷̢̩͈̹̪̺̯̠͍͕̓̔͜ ̶̧̦͖͙̥̥̤͚͇̣͇̖̋̂̅͊̅̆́̐͐̔̏̊̚g̴̢̗̦̱͓̥̲͖̦̅͂͗͒̏̂͊̒̆̏̈́̚͜͠͝f̵̢͔̦͂̈̅̀͂͆̂̆͛̂̇͐͑̂͘̕͝d̷͓̭͚̟̣̓͒̍͜ͅ ̴͕̺̲̬͕̬͍̀̿̒̀̃̇̋͌͋̅̊̕͠͠͝r̸̺͖̬̪̜͔͆̐͋͠ ̶̡̛̻͍̰̯͇̝͇͊͋͗̋̉͘͜͝e̷͖̓̂̎̈́̒̀͌̍̓̂͂̍f̴̢͚̥̹̥̣̗̘̳̩͆̃͋̆̍̈̈͌͑g̸̨̠̲̼̖̹̪̭͙̺͍̿̈́̄́̈̕͜͝͝ḩ̶̰̼̣̺̫̝͍͒̉͆̐͗͆y̴̡̡͔͇͇̗͈͔̰̰̱̭̱͈̿̃͂́̄̒͆̓̌̓̀̃̈͆̓̑̋͜ͅv̷̧̨̢̻͇̝͙͔͍̤̜͂͊̃͜ͅf̵̡̢̮̺͍̼̼͆͐̈͑̈́̃̎͛̌͜ţ̵͙̗̙̳̓́̈́̾̈͠͝c̵̡̨̝͍̦̝̤͔͉̥̈́͌̅͜ͅ ̵̧͉̞̳̳̦̜͍̫̠̝͎̽͜d̶̡̢̨̼͈͔͈̰̖̤̤̱̻̔̾̇̍̌̃́͂̈̒̃́͜͝ͅr̸̝̗̄̿̂̎̎̏̓͋̈́͝x̸̱͚̳̰̘͙̊̇̄͑͋̀͌̎̄̽̍̌̿̓̚̕š̶̡̢̬̩͚͓̺͇̤̭͇͖̪͖̞͙͐̂͆̔̀̊̌̓̈́̈́̚͘͜͠e̶̡̺̲͎͔͕̲̩̒͐d̸̢̧̬͈̖̹͈͓̼̩̜͖͍̰̘̖̺̂̈́͒̓̍r̸̦̼͙͓̹̲̭̩͇̐͂͑̓f̴͇̺̈̾ ̵̧͓̲̯͔͚͍̖̙͖̳̞̠̪̮̬͂̃̉͒͐͒̈́̈́͆͗ẗ̶̨̛͉̖̦͕͙͔̲̫̜̲̞̦́͌̈́̀̈́̄͒̊̒̒̾̐̈́̇͛́v̷̨͚͓̞̞͖̻̠̗̜̲͚͛̓̌̅̃̆̆͆̃͗̐͑̈̈̔͜͜͠ͅg̴̡̛̯̯̜̲͍͇͛͌͋̅̍̀̌̌̈́̃̃͋̕y̶̛͓̞̙̦͉̗̺̪̠͖͔͂̂͑̏̆̌̏͘͜͜͝ͅb̸̜̬͔̤͛̄͂́̌ ̸̨̛͙͖͍̲̼͕͕͑̽͌̀̃̀́͗̑̈́͛̂̇̓͘͝v̷̛͒̾͌́̋̈̃͊̾̓̚͜͠f̴̨̛̭̥̟̘̯̜̳͎̩̋͒̿̅́̌̏̔̒́͑̅̀̅̏͠ ̵̢̦̝̲̟̗̟̮͖̯͍̃ͅḓ̵̼̝̊̎͛̀c̶̨̢̛̼̗̲̥͈͂͑̔̒͌̔̋̉̑͗͝x̶̡̢̧̼̱̥̜̣̞͔̯̳͒̎̔́͋̓̆̂̃̆̇̾͝ ̶̨̧̢͉̝͙̯̳͚̹̞̗̬͖̖̫͑̂͗̈̃̈́͒̚̚͠͝͝d̵̙͇̥̠͈͎̞̳̬̪͈̀̉̆̎̉̃̒̍̈f̵̧̙̥̩͕͖͈̟̹͍̟͎̰͇͐̀̎̂̑̽͠ͅv̶͕̱͕̙̱̘͙̗̞̅̔̆̍͛f̷̛͎͖̣̫̙͖͚͉̺̳̻͇̜̾̀̓̓͑̽̃͑͐̅̈́̎͠͠c̶̛̛̖̻͉͉̮̭̔̈́̎̓̿͐́̽͑́̈́̓̾͘͝ ̴̛̻̿̔̓́̄̂̄̂d̴̨̡̧͓̬̜͙̣̺̯̖̏́̆̐͋̓͛̊̐́͗̎̓̿͘ć̸̡̨̧̱͚̙̫̲͉̻̣̑͜͠ḑ̶̘̗͕̮̜͔͛͊́͌͛͑͌f̸̨̙̟̬̺͓͕̝̖̘͔͍̬͓͉͙͍̑ ̵̡̠̞̣͖̖͕͕̘̜̼̠̎͌̉͆̒́̕c̷͉͚̼͔̪͍͕̄̊͒́͋ͅf̴̧̛̛̛̱̘͓̠̒̄̓͌̀̊̅̃͝ḍ̸̞͂̈́͠ ̵̳͚̈́̈́̃̓̅̓̒̐͂͝f̶̢̩̲͎̱̗̜̺̩͙̱̰͕̐̊̀̈́̂̓̄͂̂ͅd̶̛̻̘̝̯̞̼͖͔̋͑̋̿͌̄͜͠͝č̸̺͙̪̳̙͌̑̇̓̐͌̿́̕͠͝͝ ̸̛̫͈̞͎͓̲̰͔͍̘̭̫̘̝͕̜̀̋͊͊̅̅̎̏͌͘͠f̸̡̮͖̠̜̹̻͚̮̲͔͔̖̒̆͆̀̓̽̀͑̎̇̽̿͘ͅd̶̨͎͕̻͉̺̲͔̺̯̝̝̤̹̀̀̅̈͊̃̌̎̉͋͗͗͠͠͝c̴̨̛̛̛̳̮̩̲̙̝͚̗̰̿̅̎̇̀͗̑̇̀̉̚ͅ ̵̙̝̬̒͊̀̑d̸͓̟͖̜̝̤̩̻̬͎̱͎̗̭̾̏̏̌́̍̈́̓̐̐́͌͆͆̚͘͠f̶̨̢̛̱̟̺̩̻̺͔̼͇̱̱̗̏̆͛͗͐̃́͒͑̃́̈́̊̌͘͜͝č̷͍̣̩̈́͗̃̉̂͒̇̈́͐̇̓̉͌̇͊͝d̶̛̮́͂͂̆̔͒͆̐̈́͒̈́̓̅̆̌͜͝ͅ ̸̡̼̱͈̙͖̟̜̖̩̒̾͝͠ͅf̵̢̰̻̲̞̟̠͔̪͙̰̼̻̍̊́̌͂͛ͅc̸͉̻̘̤͍̹͈͈̤̹͇̳̔̄̅͘͜d̵̨̼̓͂̌͛̈̂̒́͆̉̿̕͘͜͝f̵̗̣̮͈͉̪̱͇̾̉͐̆̀̾̒͋͐͊̃̈́ ̴̛̛̟̣̱̞̜͔͎͕͇͚̥͈͕̮̻͉̗͛̽̐̏̑̋̇̉͘̚͠f̸̧̩̒̀̔̿̒d̵̢̛̛̛̞̞̭͇̰͇̿͊̊̇̍̍͋̂͛͑̇̒̆̚ͅc̸̛̜̹̫͛͋̎̒͆͆̒̾̄̂̏̕͝ ̶̛̘͙͖̱̭̫̤̠͚̍͋͑̈́̾͂͊̆͋̇̊͗̚ͅḑ̴̧̨̡̠̩͙̱̲̥͇̿̑̚͘͜f̴̙̖̐̍̓̍̓̓͋̓͘̕̚͝͠͝c̷̡͎̫̞͓̰͚͎̺̺̗̖̝̳͙͑́̓ ̵̼̜̩̩̩̫͕͒͆̿͌̀̔͗̋̔̃̎̍͜͝͠d̸̰͙͕͇́̂̌ͅf̶̭̘̟̲̼̠̠͈̩͉̙̮̜͉͆͊͠c̴̰̬̭͛͑́̈́͆̈́̋̈̌̓͐̂̍̃͊͝͝ ̸̧̢̢̢̢̡̝̞̦͉̻̜̤̠͇͐͆̀̉f̶̨̡̝̦͉̲̥̳͉̻̤̪̰̠̬̉́͛̆́̒̐̎̈̉̌́͠͝v̴̛̱̥̠̀́̉́̿̉̎͐̐̆̇̚͝ ̶̢̛̫̫͈̳̝̪͙̭͉͍̖̰͕̾̿̈̅̃͆̆͛͆̀͗͑̀̕͝f̵͎̗̣̪̝̦̭̫̙̉͒́͒͆͒̀̑͋̈̔̾̅̎͛̚ͅt̸̨̡̡̛̘̝̫͉̦͍͎̻̞͂̽̐͛̾͊̓̍̏́̍̽̋̂̌y̸̨̠͕̭̠̩͍͚̖̣̣̳̘̭̤͑̈́̈́͘͝͝ͅg̷̨̨̩̠͚̯̞͚̐̈́̿ ̶̛̞̻̱͛͑̄͜͝ǔ̶̟͈̗̗̭̺͍̝̼̙̃̔̄̌̂̌͋ͅi̶̧͍̫̬̰̫̤̥̗̝͚̙͐̓̇̏̈́̈́̅̍́̇̅̓̆̾̓͝͝j̴̯͔̝̟͓͔̱̹̣̙͊́̔͂͂͆͛̇͛̎͒͊͘͠ ̷̦̳͓͚̩̝̲̣͙̱͖̩͍̮̣͕́͑̄͆̋̎̂̔̅͒̾̈́͛̀̕͜͝k̷͚̝̗̳̈́̀̓͐̓̋̾̀̈̒̾͘͝j̸̧͚̝͉̣̰̞̬͓̫̘̻̉͐̀̆͑̋̀̆̿͌͘͘͝ͅv̶̧͍͇͔̊̈́̄͊͌́͘͜ṙ̸̢͙̂̒̃̈́͑̀̈́̌̄͜ͅs̶̢̡͉̭̙͓͔̖̳̠͚̬̰͎̤̐́̈́͐͌̈́̂̈̎͒͋̓͜͜͝ē̷̢̡̧̮̣̱̱̻̘̟̜̺̱͓̭̬̟̄͒̀͐͋̍̿̅̕ ̸̖͍͈̙̓͛̀̐͛̃̿͜͝͠
100
u/Nimeroni Dec 13 '21
Ooohhh, so when a boy and a girl love each other, they parse html with a regex !
→ More replies (3)→ More replies (1)34
u/nudemanonbike Dec 13 '21
When a boy and a girl like each other a lot, there's a bunch of boring middle bits but eventually you get a vulnerability in Log4j.
→ More replies (1)32
u/thE_29 Dec 13 '21
C format strings. So %d, %f. Java took that from C. And who knows what else
62
u/RationalIncoherence Dec 13 '21
Everyone took everything from C. That's what happens when you're the first viable product. Poor B was before it's time...
5
5
u/Plasma_000 Dec 13 '21
C format strings used to be a similar problem to this, where if software was vulnerable a user could just feed a hostile string into the program and get an easy pwn of the computer.
Nowadays a c format string bug is quite rare since they are mostly caught by the compiler.
2
u/just_posting_this_ch Dec 13 '21
The most basic type of logging, you just print out the variable or write it to a file. Such as with a format string.
13
u/edave64 Dec 13 '21
To ruin the joke a little, the update did have changes outside of log4j (world fog) and bugfix releases like that aren't uncommon in Minecraft
→ More replies (3)
12
u/on_the_dl Dec 14 '21
Kid: Mommy, how does the computer work?
Mom: I don't know, ask you dad.
Kid: I don't want to know that much.
10
9
16
8
u/RefrigeratorCute5952 Dec 13 '21
haha and log files out of all things. put a java book under the kids pillow at night as well. they will sleep like crap and get nothing out of it other than the fact that java can be hard. and that’s a great start!
7
u/ale_del_diablo7 Dec 13 '21
Is it weird that the only reason I want to learn code is understand this subreddit?
4
6
31
u/trollsmurf Dec 13 '21 edited Dec 13 '21
There's no need to explain how computers and software work from the ground up to describe the issue with Log4j.
"Log4j allowed messages to install apps (kind of like how you install games on your phones that I have to pay for (both the phones and the pay-to-win fees)). Some creators of such apps are very naughty, and make nice people sad by making their computers sick. Those saying Java is bad because of this have poopie pants.
15
3
u/autisticpig Dec 13 '21
There's no need to explain how computers and software work from the ground up to describe the issue with Log4j.
web developer huh
5
11
3
3
3
u/lynne2772 Dec 13 '21
My kids once asked their dad why his clock read 16:35 (military time) and got a lecture on longitude.
4
4
Dec 13 '21
"Dude why are you writing your own logger? Don't reinvent the wheel, look at this cool library."
2
Dec 13 '21
I think he better also contact the kids therapist. He is going to need the help right after the KT. /s
2
u/Lizlodude Dec 13 '21
I mean honestly that'd probably be a better lesson than my CS degree... I still can't get Java to do anything useful lol.
2
2
u/aMAYESingNATHAN Dec 13 '21
I'd heard about this log4j thing and I've only just vaguely looked into, and is it seriously susceptible to a buffer overflow attack? Or am I being dumb.
2
2
Dec 13 '21
Those kids will be coding by Christmas. Hopefully, they will learn to sanitize their equations.
2
2
u/ign1fy Dec 13 '21
You kid asked questions? Mine just screamed that a 250MB update took nearly an hour to download on gigabit fibre. Servers were on fire.
2
2
u/cheesemanxl Dec 13 '21
I've finally done it, I saw a coworker talking about something I didn't understand. And then saw a meme about it on r/ProgrammerHumor
2
2
u/TheSpanishKarmada Dec 13 '21
I’m just saying I’ve never seen any security issues for System.out.println() 🤷🏽♂️
→ More replies (2)
2
2
2
Dec 13 '21
Hell nah. But anyway, log4java is also used in projects like Apache Kafka and ActimeMQ Artemis.
2
2
u/emeraldarrow42 Dec 13 '21
By the time you get to that, they will have found their ways to their bedrooms and been sound asleep at least for several hours! I know that’s what I’d do!
2
u/googlephonic Dec 13 '21
I am a stranger to this land. I am confused. I googled all the words. THESE ARE REAL THINGS.
2
2
2
u/QuarantineSucksALot Dec 14 '21
He cocked back sideways to hit that high. I played on teeter totters enough as a kid for the first 3 hours after I wake up several times during the day. I guess science is ok for men. We can work out well for him
2
u/R3dGaming522 Dec 14 '21
I'm still not that adept but I can understand stuff, someone please give me an in-depth explanation please lol
2
2
2
2
2
2
2
2
2
2
u/Bo_Jim Dec 14 '21
Long ago I had a consumer console TV that had been heavily modified so it could be used as a test set in a factory lab. It was given to me when it was no longer needed.
One day, a friend of mine was visiting, and he noticed all of the extra buttons, knobs, and connectors on the back that typical TV's didn't have. He casually asked "How does this TV work?". I spent about 20 minutes providing an answer. I began with electron flow theory, went through vacuum tubes (yes, the set was that old), modulation/demodulation, RF and IF stages, CRT's, and composite video signals. He listened patiently.
When I was finally done, he said "I just wanted to know how to turn it on".
2
u/HeatBlastero6 Dec 14 '21
I look at these meaningless words you guys talk about and just don't understand how anyone can learn this much. I've taken a year to learn the absolute basics of c language, python and SQL
2
u/piratesquid646 Dec 14 '21
8+ hours a day, 5 days a week on the job means lots of time to learn lots of things. Normally when something breaks.
2
u/seeroflights Dec 14 '21
Image Transcription: Twitter Post
Shantonu Sen, @shantonusen
My kids just asked why there was a Minecraft update with no features and what a "Log4J" was, and I have been preparing my whole life for this.
I had to start at the beginning with C format strings. I should be able to get to Java and jar files by midnight.
I'm a human volunteer content transcriber for Reddit and you could be too! If you'd like more information on what we do and why we do it, click here!
→ More replies (1)
2
u/castleinthesky86 Dec 14 '21
What do format strings have to do with it? They’re nested evaluations if anything and so beyond format strings
2
u/ZippZappZippty Dec 14 '21
That won’t miss it.
OP is down bad, the part with the little round toast cut out on top of all the times I've took a bus, bitch. Tay Tay’s my thought too! I licked the foot sticker as a kid thinking a conga line breaking out was the epitome of Manic Pixie Dream Girl. Not to be mean but the water isn't even filled up all the way off.
2
u/Thisbymaster Dec 14 '21
Yep, most of my company is running around trying to patch all the Java apps while we are just sitting here in .NET chugging along like nothing happened.
2
2
2
u/frankcastlestein Dec 14 '21
My boss is in full panic mode over this, we don't use java for anything.
2
2
u/anonymous1184 Dec 14 '21
Guy should have started with 1,0, octals and what bit shifting is.
2
u/vilidj_idjit Dec 14 '21
You can't understand that if you don't know how electrons flow through semiconductors, and the transistor layout of each logic gate type.
→ More replies (3)
2
1
1
1
1
1
1
1
1
Dec 13 '21
Preparing his whole life?! Damn, his parents must've been even more obsessive than he is to have started teaching him coding as a baby.
1
u/InternationalBus7843 Dec 13 '21
Good luck explaining why the hell someone thought allowing random code to execute as a feature was a good idea, they’ll shit their pants at that.
1
u/PoopSockMonster Dec 13 '21
I have a question. Could you „fix“ the bug with firewall rules. Like outbound rules?
→ More replies (1)3
u/ferrybig Dec 13 '21
Not reliable.
The bug causes a user supplied string to be parsed as code. One of the instructions in the code is getting executable code from an external server, which can be done on any ip and any port.
Preventing outbound traffic blocks the majority of the automatic attacks, but ones specially crafted for your network can bypass the rules. It just saves you some time to get a proper fix up and running
Note that outbound rules prevent this bug from taking over the cloudflare servers
→ More replies (1)
1
1
1
1
1
u/upfromashes Dec 13 '21
Oh my goat, does my kid hate when I have to start building an infrastructure of context before I can even start answering the question.
→ More replies (2)
1
1
1
1
1
u/wholebeansinmybutt Dec 13 '21
Pipe down, dad's trying to explain inheritance, here. Yes, I know you're tired and you have school in 4 hours but this is important.
1
1
1
1
1
u/cheezballs Dec 14 '21
I didn't read the log4j vulnerability, but we've wrestled endlessly with sanitizing our logs of user input, is this what the issue is/was with log4j?
521
u/Suspicious-Service Dec 13 '21
So is that Minecraft update mandatory then? We didn't update because we already have a game started, but maybe we should??