Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Log4jmemes.com: for those of us that need a laugh

log4jmemes.com

Post reply on HN
Print view View original

11–20 of 115 posts

Re: Log4jmemes.com: for those of us that need a laugh

#13

Post by yCombLinks »

pddpro wrote: post #6

Is there any comprehensive article that covers what log4j is and just what happened that is so critical that seems to have set the entire world on fire? Disclaimer: I have never heard of or used log4j before in my life.

I don't have an article but here's a super quick rundown. Log4j is a very common logging framework used in java. It very often gets pulled in along with other dependencies, so it's easy to be using it without even realizing it. It has a feature that allows it to download and run code just by logging specially formatted strings. So if someone get cause your server to log these strings, it will run whatever code they want. On minecraft servers for example, all chat messages get logged at some point, so just posting the right string in chat will cause the server to execute the code you tell it to download.

Re: Log4jmemes.com: for those of us that need a laugh

#14

Post by dijit »

linkdd wrote: post #7

The one about using print/console.log/whatever lol. I've always done this, never have I used a library for this, because: - running manually? >myapp.log 2>&1 - using systemd? use journalctl - using docker/kubernetes? capture automatically the stdout/stderr of your containers and pipe them through logstash or something Real question: why would an application need to know where its logs go? This is not in the business…

Not entirely wrong, but supporting log levels natively is a fairly decent “niceness” instead of parsing text to do it.

Text, though, is a pretty universal interface and I would rather wrap a binary and stream it’s output than integrate a logging library natively.

I did work with a product once that had local logs in a ring buffer and only shipped “important” logs to centralised storage, and that was nice but required context which can’t be easily gleaned from the content of a message.

Re: Log4jmemes.com: for those of us that need a laugh

#15

Post by djKianoosh »

pddpro wrote: post #6

Is there any comprehensive article that covers what log4j is and just what happened that is so critical that seems to have set the entire world on fire? Disclaimer: I have never heard of or used log4j before in my life.

Here are a couple of good ones, with good diagrams of how the attack works:

- https://blogs.juniper.net/en-us/enterprise-cloud-and-transfo...

- https://www.govcert.ch/blog/zero-day-exploit-targeting-popul...

Re: Log4jmemes.com: for those of us that need a laugh

#18

Post by baskire »

linkdd wrote: post #7

The one about using print/console.log/whatever lol. I've always done this, never have I used a library for this, because: - running manually? >myapp.log 2>&1 - using systemd? use journalctl - using docker/kubernetes? capture automatically the stdout/stderr of your containers and pipe them through logstash or something Real question: why would an application need to know where its logs go? This is not in the business…

There’s some scaling constraints using stdout with kubernetes. That logging load hits the kublet/control plane. This is an issue for those already pushing k8s up to the edge of its current scalability.
Post reply on HN