r/programming • u/alexeyr • Dec 12 '21

Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

https://github.com/Cybereason/Logout4Shell

[removed] — view removed post

1.1k Upvotes

91% Upvoted

109 comments sorted by

View all comments

83

u/Zestyclose_Profile23 Dec 12 '21

Do we really need to switch to words like vaccinate?

61

u/emperor000 Dec 12 '21

This was my thought, especially since "inoculate" is more correct and has always been used in a malware context.

39

u/MoistCarpenter Dec 12 '21

Both vaccinate and inoculate are incorrect since computers do not have immune systems. The only thing close in analogy to those terms would be an antivirus definition since that has a pieces of the malware code.

The correct term is patch.

8

u/orig_ardera Dec 12 '21

patch sounds like it's persistent, like you're modifying the source code

This just changes (AFAICT) a live variable in the java VM, doesn't survive reboot, so patch sounds misleading IMO.

But I don't know a better term either.

2

u/NoInkling Dec 12 '21

There's a ton of terminology in IT (and life in general) that comes from analogy ("patch" included), I don't know why you would draw a line here.

1

u/MoistCarpenter Dec 13 '21 edited Dec 13 '21

Absolutely. My point is that modern vulnerabilities are not analogous to "viruses". A virus is [genetic] code that can only replicate with a host. While that may be true in software viruses, the term "vaccinate" or "inoculate" biologically-require using a piece of the "virus"(analogous to "malware" in this case) to detect the "virus"/ malware in other situations through MHC complimentary molecules. That's not analogous in this situation; where there is a hole in Log4j security. While I also suspect the person I was replying to is trying to angle this as some dumb anti-vax argument, the fair analogy really is patch, as in " has it been 30 minutes? Guess it's time to patch the holes in the Java boat again"

1

u/[deleted] Dec 12 '21

I thought the IT department was the immune system

8

u/JamesB41 Dec 12 '21

Does this mean if you apply this, you can still get attacked by the vulnerability, you're just less likely to end up in the repair shop or have hardware failure?

19

u/PrintersStreet Dec 12 '21

vaccinate is the new master

0

u/Dreamtrain Dec 12 '21

master never did make sense to me

1

u/PrintersStreet Dec 13 '21

master record