andrewducker | Interesting Links for 16-12-2021

Crossposts: https://andrewducker.livejournal.com/4125340.html

Entry tags:

6) [word for "looking something up on Wikipedia and still being clueless as to what it is"]

I shall attempt to explain. Apologies if I fail!

Log4j is a free library of code designed to be used by other applications to provide logging functionality (where "log" means "make a note of", not "chop down trees"). It's been around for 20-odd years and is used in an awful lot of applications, as it became somewhat of a standard library that everyone who needed to log information used.

When it was first created, there was a lot less worry about security, and a bunch of functionality was included to allow it to do very powerful things, without thinking "How would a determined hacker make use of this?"

And then, a week ago, someone worked out a really easy way to make it do *anything*, from a remote computer, effectively allowing them to take over the computer it was running on.

As it is a code library, and thus included inside other applications, lots of companies are now desperately scanning all of their computers to see if they have anything that uses it - and finding it in everything from software they have bought in to things that were written internally up to 20 years ago and haven't been touched since. All of these need to be fixed, and there might be hundreds of them across a larger company.

There's also a lesson in all of this, which is that programmers are subject to the same herd instincts as everybody else. This isn't even a weird or hard-to-detect security bug -- it's just that, since everybody has been using this library for such a long time, everyone figured it was safe and didn't poke at it hard enough.

Flat | Top-Level Comments Only

Interesting Links for 16-12-2021

no subject

no subject

no subject