Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Log4jmemes.com: for those of us that need a laugh

log4jmemes.com

Post reply on HN
Print view View original

21–30 of 115 posts

Re: Log4jmemes.com: for those of us that need a laugh

#21

Post by Finnucane »

yCombLinks wrote: post #13
pddpro wrote: post #6

Is there any comprehensive article that covers what log4j is and just what happened that is so critical that seems to have set the entire world on fire? Disclaimer: I have never heard of or used log4j before in my life.

I don't have an article but here's a super quick rundown. Log4j is a very common logging framework used in java. It very often gets pulled in along with other dependencies, so it's easy to be using it without even realizing it. It has a feature that allows it to download and run code just by logging specially formatted strings. So if someone get cause your server to log these strings, it will run whatever code they w…

Okay, I know I am not a Real Programmer, but even I know that user content is to be Not Trusted. Isn't it like a Security 101 principle that user content is always potentially dangerous, and to be treated accordingly?

Re: Log4jmemes.com: for those of us that need a laugh

#23

Post by interestica »

hwers wrote: post #8

Somewhat with shame in the back of my mind, memes like these always tend to help me get the bigger picture of something faster than a long article.

No shame! Memes are language. Memes (when correctly used) give awesome explanation and context.

Re: Log4jmemes.com: for those of us that need a laugh

#24

Post by iudqnolq »

linkdd wrote: post #7

The one about using print/console.log/whatever lol. I've always done this, never have I used a library for this, because: - running manually? >myapp.log 2>&1 - using systemd? use journalctl - using docker/kubernetes? capture automatically the stdout/stderr of your containers and pipe them through logstash or something Real question: why would an application need to know where its logs go? This is not in the business…

For me the biggest nuisance is keeping multi-line logs together.

Re: Log4jmemes.com: for those of us that need a laugh

#25

Post by exabrial »

linkdd wrote: post #7

The one about using print/console.log/whatever lol. I've always done this, never have I used a library for this, because: - running manually? >myapp.log 2>&1 - using systemd? use journalctl - using docker/kubernetes? capture automatically the stdout/stderr of your containers and pipe them through logstash or something Real question: why would an application need to know where its logs go? This is not in the business…

The real value is parameterized logging, sanitation of sensitive strings, logs per module, and automatic contextual value adds like function name, parameters, line number in the source code. Sysout is good for simple stuff, but a healthy set of audit logs (IE after every branch, and essentially replacing code comments with log statements) really cuts down on time needed to debug production problems.

> This is not in the business perimeter, but the ops perimeter.

That is a great point. Logging configuration should be provided at runtime, not compiled into the application. That's why most places provide the logging configuration as a runtime parameter.

Re: Log4jmemes.com: for those of us that need a laugh

#26

Post by junon »

linkdd wrote: post #7

The one about using print/console.log/whatever lol. I've always done this, never have I used a library for this, because: - running manually? >myapp.log 2>&1 - using systemd? use journalctl - using docker/kubernetes? capture automatically the stdout/stderr of your containers and pipe them through logstash or something Real question: why would an application need to know where its logs go? This is not in the business…

I think you misunderstand the point of log4j. Logging is not free, and outputting to all three of those is quite expensive (especially in the Docker case, and it can even be dangerous as Docker - at least for a long time - did not implement proper backpressure and instead dropped logs).

log4j allows libraries to implement logging and allow the end user to worry about where the logs go, at the application level, usually via config on the command line (e.g. modifying classpaths).

Re: Log4jmemes.com: for those of us that need a laugh

#27

Post by pdpi »

linkdd wrote: post #7

The one about using print/console.log/whatever lol. I've always done this, never have I used a library for this, because: - running manually? >myapp.log 2>&1 - using systemd? use journalctl - using docker/kubernetes? capture automatically the stdout/stderr of your containers and pipe them through logstash or something Real question: why would an application need to know where its logs go? This is not in the business…

There’s a whole enormous feature set that goes with Java logging that rapidly becomes a huge pain, but being able to easily adjust log levels on a per-class basis is a godsend for debugging certain issues.

Re: Log4jmemes.com: for those of us that need a laugh

#28

Post by gwbas1c »

linkdd wrote: post #7

The one about using print/console.log/whatever lol. I've always done this, never have I used a library for this, because: - running manually? >myapp.log 2>&1 - using systemd? use journalctl - using docker/kubernetes? capture automatically the stdout/stderr of your containers and pipe them through logstash or something Real question: why would an application need to know where its logs go? This is not in the business…

Some log libraries allow user configuration of logging. Some configurations can be as mundane as altering logging levels when debugging; other configurations could redirect the logs away from text files to something that preserves semantics.

But, depending on what your program is doing, printf/whatever can be "good enough."

Coming from the C# world, one of the nice things about log4net is that it has a standard exception formatter, and callbacks whenever anything logs to error. This makes it easier to log unexpected errors and phone home when they happen.

Re: Log4jmemes.com: for those of us that need a laugh

#29

Post by VWWHFSfQ »

linkdd wrote: post #7

The one about using print/console.log/whatever lol. I've always done this, never have I used a library for this, because: - running manually? >myapp.log 2>&1 - using systemd? use journalctl - using docker/kubernetes? capture automatically the stdout/stderr of your containers and pipe them through logstash or something Real question: why would an application need to know where its logs go? This is not in the business…

> pipe them through logstash or something

logstash is also vulnerable to this though

Re: Log4jmemes.com: for those of us that need a laugh

#30

Post by lostcolony »

Finnucane wrote: post #21
yCombLinks wrote: post #13

Earlier quoted context omitted.

I don't have an article but here's a super quick rundown. Log4j is a very common logging framework used in java. It very often gets pulled in along with other dependencies, so it's easy to be using it without even realizing it. It has a feature that allows it to download and run code just by logging specially formatted strings. So if someone get cause your server to log these strings, it will run whatever code they w…

Okay, I know I am not a Real Programmer, but even I know that user content is to be Not Trusted. Isn't it like a Security 101 principle that user content is always potentially dangerous, and to be treated accordingly?

Yes, but oftentimes you want to log user generated events (especially ones that might otherwise be ephemeral) to create, well, logs, of what has happened. You expect the log library to dump whatever string you direct it to to the correct location (based on config and log level and etc), with any necessary sanitizing, and you otherwise forget about it. You don't expect the log library to try and execute any part of the string.
Post reply on HN