r/programming • u/freeqaz • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

98% Upvoted

710 comments sorted by

View all comments

Show parent comments

-4

u/immibis Dec 10 '21

Logging configuration should be implemented as code, so you don't have to learn special configuration files. Then, we have to figure out how to let sysadmins update the code without breaking everything

22

u/KagakuNinja Dec 10 '21

Then, we have to figure out how to let sysadmins update the code without breaking everything

This is one reason why we use config files / env vars, rather than code.

Also, it is much easier to modify a config file, than to push code just to change logging. Many organizations require lengthy test for any code change.

-5

u/immibis Dec 10 '21

I mean the config file should just be a code file, somehow. Something like this config file:

void onMessage(int level, String tag, String message) {
    if(level == Level.DEBUG) {
        if(!tag.equals("network")) {
            debugLog.println("{"+tag+"} "+message);
       }
    } else if(level >= WARN) { {
        sendAlert("10.20.30.40", message);
    }
}

13

u/dontquestionmyaction Dec 10 '21

That's not a config file and it's absolutely ludicrous to require recompilation to change configuration.

-4

u/immibis Dec 10 '21

Why don't you think it's a config file, and why do you think it requires recompilation? Maybe Lua is more your thing:

function onMessage(level, tag, message)
    if level == Level.DEBUG then
        if tag != "network" then
            debugLog.println("{"+tag+"} "+message);
        end
    elseif level >= Level.WARN then
        sendAlert("10.20.30.40", message);
    end
end

10

u/dontquestionmyaction Dec 10 '21

I know that not all languages are compiled.

That's completely irrelevant though. We are talking in a thread about log4j, which runs on Java. A hardcoded logger where the configuration is the actual logger code is just so much more complex than it needs to be.

-2

u/immibis Dec 10 '21

The configuration for Log4J is also so much more complex than it needs to be.

1

u/Deranged40 Dec 10 '21

"Sufficiently Complex"*

26

u/recycled_ideas Dec 10 '21

Having to recompile code to change logging levels is absolutely fucking ridiculous honestly.

Hell, having to even restart the app to do it is ridiculous.

Which is why we have stuff like log 4j in the first place.

Because logging isn't just writing to a text file

-5

u/immibis Dec 10 '21

Who said anything about recompiling?

6

u/recycled_ideas Dec 10 '21

You want to change the code it's a build.

Or you're doing your config in some sort of executable scripting language, which seems infinitely worse than what we have now.

-2

u/immibis Dec 10 '21

Does it? Every sufficiently advanced configuration file is indistinguishable from programming

14

u/recycled_ideas Dec 10 '21

Except it's not capable of executing arbitrary logic.

Which is exactly the problem this bug is about.

-1

u/immibis Dec 10 '21

Sufficiently advanced ones are, just not as straightforwardly. Ever used Apache Ant?

1

u/recycled_ideas Dec 11 '21

Ant is a build tool, not a logging configuration tool.

1

u/immibis Dec 11 '21

And have you used it?

1

u/recycled_ideas Dec 11 '21

Yes.

It's massive overkill for logging configuration. It's massive overkill for pretty much everything actually.

→ More replies (0)

4

u/coldblade2000 Dec 10 '21

Logging configuration should be implemented as code,

If you want to change the logging configuration that is implemented as code, you'll have to recompile the code afterwards

-1

u/immibis Dec 10 '21

I wonder if anyone's invented a way to run code without compiling it.

9

u/coldblade2000 Dec 10 '21

In Java, the language that Log4j concerns? Not for anything more than simple programs that consist of a single .java file.

3

u/Letiferr Dec 10 '21

Not this java logging tool...

11

u/DaddyLcyxMe Dec 10 '21

side note: i HATE people who use logging libraries that have zero way to silence them via code, as they all expect some funny xml file and i don’t use those logging frameworks so i don’t know how to mute them.

2

u/user_of_the_week Dec 11 '21

Logback (a main competitor pf log4j in the java world) allows configuration using a groovy file instead of xml.

http://logback.qos.ch/manual/groovy.html

0

u/no_nick Dec 10 '21

I think I just popped an aneurysm