Indeed, it is extremely used.
This new threat seems to behave like a worm. What was the last worm-like virus?
I recall sql slammer or something like that in early 2000.
Was there any other very popular worm between 2003 and now?
Thanks
Jean
From: NANOG <nanog-bounces+jean=ddostest.me@nanog.org> On Behalf Of Alain Hebert
Sent: December 13, 2021 3:01 PM
To: nanog@nanog.org
Subject: Re: Log4j mitigation
Well,
In my experience, it is a really widely used library. It has been pretty much the de-facto standard for logging for a long while.
IMHO
So anything Java (and exposed obviously) need a review...
Best Practices
As a standard we always tent to push our customers to more light-weight logging library with less magic.
PS: And it is not the first time Log4j ended causing headaches... For those wondering. I remember back in 2017 when everyone was angrily saying they'll change for something else...
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=log4j
-----
Alain Hebert ahebert@pubnix.net
PubNIX Inc.
50 boul. St-Charles
P.O. Box 26770 Beaconsfield, Quebec H9W 6G7
Tel: 514-990-5911 http://www.pubnix.net Fax: 514-990-9443
On 12/13/21 14:24, Owen DeLong via NANOG wrote: