Hacker News new | ask | show | jobs
by oldcigarette 1649 days ago
Is there a more generous perspective than this? I've been reading but from what I can tell this was just a terrible idea. Hindsight is 20/20 and all - but really?
2 comments

I think the "generous" perspective is that there was a JRE update once which disabled the remote code execution feature by default. Note, this was a JRE update, not a log4j update.
Note, as others have commented, the JRE change prevented the fully open-ended RCE where you could download classfiles from an external server and run them. However, the log4j bug does still allow posting of environment variables to external servers, even with the JRE changes, which could be just as catastrophic.

That was my understanding anyway, someone correct me if I'm wrong.

No, the log4j devs really seem to have thought it was a good idea to have this (1) built, and (2) enabled by default. One of them was on twitter whinging that they needed it for backcompat. I just can't.