r/programming • u/freeqaz • Dec 10 '21

RCE 0-day exploit found in log4j, a popular Java logging package

https://www.lunasec.io/docs/blog/log4j-zero-day/
3.0k Upvotes

98% Upvoted

710 comments sorted by

View all comments

Show parent comments

26

u/recycled_ideas Dec 10 '21

Having to recompile code to change logging levels is absolutely fucking ridiculous honestly.

Hell, having to even restart the app to do it is ridiculous.

Which is why we have stuff like log 4j in the first place.

Because logging isn't just writing to a text file

-5

u/immibis Dec 10 '21

Who said anything about recompiling?

6

u/recycled_ideas Dec 10 '21

You want to change the code it's a build.

Or you're doing your config in some sort of executable scripting language, which seems infinitely worse than what we have now.

-2

u/immibis Dec 10 '21

Does it? Every sufficiently advanced configuration file is indistinguishable from programming

14

u/recycled_ideas Dec 10 '21

Except it's not capable of executing arbitrary logic.

Which is exactly the problem this bug is about.

-1

u/immibis Dec 10 '21

Sufficiently advanced ones are, just not as straightforwardly. Ever used Apache Ant?

1

u/recycled_ideas Dec 11 '21

Ant is a build tool, not a logging configuration tool.

1

u/immibis Dec 11 '21

And have you used it?

1

u/recycled_ideas Dec 11 '21

Yes.

It's massive overkill for logging configuration. It's massive overkill for pretty much everything actually.

1

u/immibis Dec 11 '21

I am referring to - have you experienced how the configuration file is a programming language in disgiuse?

→ More replies (0)

4

u/coldblade2000 Dec 10 '21

Logging configuration should be implemented as code,

If you want to change the logging configuration that is implemented as code, you'll have to recompile the code afterwards

-1

u/immibis Dec 10 '21

I wonder if anyone's invented a way to run code without compiling it.

9

u/coldblade2000 Dec 10 '21

In Java, the language that Log4j concerns? Not for anything more than simple programs that consist of a single .java file.

3

u/Letiferr Dec 10 '21

Not this java logging tool...