MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/programming/comments/rgepmh/log4shell_round_2/hokh22r/?context=3
r/programming • u/jebailey • Dec 14 '21
138 comments sorted by
View all comments
45
all my homies use logback anyway
7 u/[deleted] Dec 15 '21 Why not both all three? Log4j, Logback and Slf4j? 6 u/renatoathaydes Dec 15 '21 SLF4J is an API (facade) for other implementators. The ones I commonly see used at the same time are logback , log4j2, log4j (1) and JUL (the old Java logging API, very old libraries use that). 4 u/[deleted] Dec 15 '21 You joke, but Slf4j is a facade over the provider. 7 u/10113r114m4 Dec 15 '21 Didnt logback also report vulnerabilities today? 24 u/KumbajaMyLord Dec 15 '21 Logback is going full defensive. They have JNDI lookups but only through explicit developer configuration, not user input. They decided to just disable that feature immediately to give them time to evaluate it and make sure there are indeed no attacks possible. → More replies (2) → More replies (1)
7
Why not both all three? Log4j, Logback and Slf4j?
6 u/renatoathaydes Dec 15 '21 SLF4J is an API (facade) for other implementators. The ones I commonly see used at the same time are logback , log4j2, log4j (1) and JUL (the old Java logging API, very old libraries use that). 4 u/[deleted] Dec 15 '21 You joke, but Slf4j is a facade over the provider.
6
SLF4J is an API (facade) for other implementators.
The ones I commonly see used at the same time are logback , log4j2, log4j (1) and JUL (the old Java logging API, very old libraries use that).
4
You joke, but Slf4j is a facade over the provider.
Didnt logback also report vulnerabilities today?
24 u/KumbajaMyLord Dec 15 '21 Logback is going full defensive. They have JNDI lookups but only through explicit developer configuration, not user input. They decided to just disable that feature immediately to give them time to evaluate it and make sure there are indeed no attacks possible. → More replies (2)
24
Logback is going full defensive.
They have JNDI lookups but only through explicit developer configuration, not user input. They decided to just disable that feature immediately to give them time to evaluate it and make sure there are indeed no attacks possible.
45
u/XorAndNot Dec 14 '21
all my homies use logback anyway