As a Python developer, I am so happy right now.
But what TYPE of happy are you?
Don't trust his hints.
Log4jmemes.com: for those of us that need a laugh
71–80 of 115 posts
Re: Log4jmemes.com: for those of us that need a laugh
#72What is the one template with the guy in the pink suit called? I see it all the time, can't imagine where on earth it might have come from.
It looks like some sort of David v Goliath thing but often I see the template where it implies the pink guy is gonna get owned.
Re: Log4jmemes.com: for those of us that need a laugh
#73The one about using print/console.log/whatever lol. I've always done this, never have I used a library for this, because: - running manually? >myapp.log 2>&1 - using systemd? use journalctl - using docker/kubernetes? capture automatically the stdout/stderr of your containers and pipe them through logstash or something Real question: why would an application need to know where its logs go? This is not in the business…
> Example: Python's default logging module. That's actually a log4j derivative, and imho quite bad.
Care to elaborate?
Re: Log4jmemes.com: for those of us that need a laugh
#74Earlier quoted context omitted.
You seriously think that the multi-million dollar Apache foundation, which oversaw this mess and whose "Apache Way" supposedly should have prevented it but in fact is a joke, needs more money? There are of course many worse causes, but among umbrella organisations which just exist to provide some services to Free Software projects, Apache doesn't stand out as particularly good and I doubt that "Security vulnerabiliti…
You would expect the foundation to prevent bugs? When did Apache even even claimed to be bug free?
I would expect the foundation's "Apache Way" to have the effects it claims, rather than in fact being a way to dismiss concerns and pretend everything is on track when it isn't.
In particular the Apache Way includes: Responsible Oversight and The ASF Security Committee which you might think would be trying to stop stuff like this happening but really exists so that they can say they're responding to whatever new horrible problem has been found and so the system works.
What did the Responsible Oversight do with the idea of adding "lookups" to log4j which by the nature of the language and design of the API can't be safe? They accepted it and cheerfully documented this obviously bad idea. You can still go back and look at their documentation with the Wayback Machine, short of just writing "Look at this amazing remote execution security bug we added to our software" it could not be any clearer.
Re: Log4jmemes.com: for those of us that need a laugh
#75As a Python developer, I am so happy right now.
There's nothing about Python that actually stops this kind of attack. It just happens to be Java this time around. But providing expansive evaluation of variables is definitely something Python should be concerned about. This would be a good time to check if poor patterns around logging and having untrusted strings in trusted contexts exists in your code base, no matter the language.
Re: Log4jmemes.com: for those of us that need a laugh
#76Earlier quoted context omitted.
I don't have an article but here's a super quick rundown. Log4j is a very common logging framework used in java. It very often gets pulled in along with other dependencies, so it's easy to be using it without even realizing it. It has a feature that allows it to download and run code just by logging specially formatted strings. So if someone get cause your server to log these strings, it will run whatever code they w…
Okay, I know I am not a Real Programmer, but even I know that user content is to be Not Trusted. Isn't it like a Security 101 principle that user content is always potentially dangerous, and to be treated accordingly?
As best I've been able to tell, this was not an intentional feature; it was added by the original author for configuration, so that they could drop LDAP URL's into the log4j configuration file, thus using LDAP as a "configuration server". I don't think they realized this would cross paths with every single log message as well.
Mind you, I also think that original intention was idiotic: Now your java application can't boot up unless your LDAP server is working, and for what? That's the kind of thing that makes global restarts & outage recovery a disaster.
Re: Log4jmemes.com: for those of us that need a laugh
#77What is the one template with the guy in the pink suit called? I see it all the time, can't imagine where on earth it might have come from. It looks like some sort of David v Goliath thing but often I see the template where it implies the pink guy is gonna get owned.
> Bane vs. Pink Guy, also known as Bane vs. Filthy Frank, is an image macro series based on a screenshot from the film The Dark Knight Rises altered to include the Filthy Frank character Pink Guy. In the image, the Batman villain Bane is preparing to fight to Pink Guy.
Re: Log4jmemes.com: for those of us that need a laugh
#78What is the one template with the guy in the pink suit called? I see it all the time, can't imagine where on earth it might have come from. It looks like some sort of David v Goliath thing but often I see the template where it implies the pink guy is gonna get owned.
Re: Log4jmemes.com: for those of us that need a laugh
#79What is the one template with the guy in the pink suit called? I see it all the time, can't imagine where on earth it might have come from. It looks like some sort of David v Goliath thing but often I see the template where it implies the pink guy is gonna get owned.
[deleted]
Re: Log4jmemes.com: for those of us that need a laugh
#80The one about using print/console.log/whatever lol. I've always done this, never have I used a library for this, because: - running manually? >myapp.log 2>&1 - using systemd? use journalctl - using docker/kubernetes? capture automatically the stdout/stderr of your containers and pipe them through logstash or something Real question: why would an application need to know where its logs go? This is not in the business…
> pipe them through logstash or something logstash is also vulnerable to this though
Fluent-bit/fluentd are written in C and ruby :)