Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide
I have taken some flak over the years for rolling my own basics like logging, telemetry, tracing, authentication, session management, etc...<p>Incidents like this remind me that it is sometimes OK to ignore those who constantly order you to "vendor it out" over some notion of principled development excellence wherein one <i>never</i> reinvents a single hypothetical wheel. Arguably, writing text to a log file on disk is a simple thing you dont want to keep implementing over and over. But, it <i>is</i> also a simple thing that doesn't take a whole lot to do correctly in many use cases.<p>DIY (in aggregate) would represent one of the largest barriers to any attacker producing a wormable/DDOS exploit of this log4j-style vulnerability. Imagine ten thousand plus unique implementations for how to get a string to disk and I can almost assure you that not one of them would contain an attack vector like this. Even if one of them did, the other 99.999% of implementations would be unaffected and nothing would have made the headlines.<p>Depending on the code paths that others have developed is <i>the</i> biggest liability in all of software engineering. We are going to have to get better at evaluating this cost relative to the benefits. This doesnt stop with Log4j. There are other things more ubiquitous and more complicated out there still. IMO, the best we can do is to stop producing new software that is exposed in these ways.