Here's the answer of someone I know more than I know anyone else to someone having an attitude for a free library, with a weird tone, and interpreting a sentence in the worst possible way... Telling them there wasn't even a repo or a license.
>When I said "I understand", I meant that I understand that you can't use software without a license. I made a note to add a license and put the project in a GitHub repository.
>I also understand that when someone refrains from using a childish tone and a thumbs down, the thought of telling them to go suck a bag of dicks would be less likely to have crossed someone else's mind.
> If I ever release some open source project that achieves the same success as Log4j, and, at any time, gets a similarly dangerous vulnerability, I'll make sure not to release the hotfix for free.
Uh... Isn't the point of open source software to release the code, and thus to be able to make modifications of it?
For an economically rational actor, they'd have to compare the costs of the hotfix (not free) and the costs of writing it themselves (takes at least some amount of dev time, which costs money). Unless of course there is some other open source dev who makes their patch available for free.
The internet is ruthless, yes, it goes overboard easily. But, whoever came up with the idea to do LDAP queries from your logs should be ashamed right now. I would be mortified if that was me. I would consider changing my profession.
If ever there was a pointless feature that could lead to disaster, this is it.
I mean inserting URL("https://www.google.com") in a Dictionary might trigger DNS resolution in Java, this was probably a very on-brand piece of functionality probably from a different time.
-
URL.hashCode was implemented by actually resolving the hostname to an IP address. Put a URL object in a dictionary? DNS resolution. Compare two URL objects with equals? DNS resolution.
It's the internet, memes will happen. Are there actual incidents of log4j developers being abused by the larger community because of this incident, or is the author just making up fake outrage?
>So, my dear haters, I need to inform you that Log4j comes with a license that says "You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License". You shouldn't blame Log4j developers
Moving beyond the petulance of the post, I'm not sure why including an as-is clause implies that you should be free from criticism or blame forever. Faulty design is faulty design, regardless of the price tag or licenses.
Of course, the developers are under no obligation to fix it if they don't want to, or if they are put-off by the criticism. That is their choice to make. But you don't get to just slap on a clause like that and be forever free from blame or criticism.
8 comments
[ 3.4 ms ] story [ 31.3 ms ] thread>When I said "I understand", I meant that I understand that you can't use software without a license. I made a note to add a license and put the project in a GitHub repository.
>I also understand that when someone refrains from using a childish tone and a thumbs down, the thought of telling them to go suck a bag of dicks would be less likely to have crossed someone else's mind.
>The repo is at [xxxx]
Uh... Isn't the point of open source software to release the code, and thus to be able to make modifications of it?
If ever there was a pointless feature that could lead to disaster, this is it.
-
URL.hashCode was implemented by actually resolving the hostname to an IP address. Put a URL object in a dictionary? DNS resolution. Compare two URL objects with equals? DNS resolution.
The fix is use the updated `URI` api
Moving beyond the petulance of the post, I'm not sure why including an as-is clause implies that you should be free from criticism or blame forever. Faulty design is faulty design, regardless of the price tag or licenses.
Of course, the developers are under no obligation to fix it if they don't want to, or if they are put-off by the criticism. That is their choice to make. But you don't get to just slap on a clause like that and be forever free from blame or criticism.