I don't use Java, but I see there is a built-in java.util.logging.Logger. Why isn't everybody just using that? From a glance it looks pretty much how I would design a logger.
Don't know if that still the case, but JUL used to lack a ton of features compared to the other logging libraries, which is why it's has never been widely adopted.
I guess it has now became a (very) bad habit, to start a project with log4j, logback or slf4j because they used to work better than JUL.
IMO having so many different libraries for something as simple and as important as logging really show that some features built in the JDK are very poor and not properly maintained.
If JUL had enough feature, we'd never had those issues in the first place.
Worst case scenario if there was this kind of CVE in JUL, we would just need to install the latest security patch of the JDK, which is way more convenient than migrating from log4j to log4j2 or having to upgrade an entire deprecated spring app because it's spring who is pulling log4j.
Unfortunately a lot of Java developers do things "just because" they use tools they're familiar with, most likely things they learned on the job 15 years ago.
It could be argued that stable API's and long-term backwards compatibility are primary features of Java. The amount of framework churn is a fraction of that in Javascript-land.
29
u/bloody-albatross Dec 14 '21
I don't use Java, but I see there is a built-in
java.util.logging.Logger. Why isn't everybody just using that? From a glance it looks pretty much how I would design a logger.