Log4j was a fun one to watch unfold everywhere when things went haywire
this post was submitted on 22 Jun 2023
230 points (100.0% liked)
Programming
423 readers
6 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 1 year ago
MODERATORS
That was not a fun week to be a developer.
As a non-java company developer at the time, I think our biggest challenge was explaining to everyone that Log4j didn't affect us. It took a non-zero amount of effort because a lot of customers panicked. To be fair, it was also an industry where confidentiality is important.
Oh man. I missed it by like a month. I graduated with my bachelors in December, and started in January. I was hearing horror stories from my new coworkers about how people had to cancel vacations to get stuff patched asap
It was if none of your code used log4j. I remember being very grateful that I had chosen java.util.logging and Logback for my Java logging needs.
load more comments
(1 replies)
That one was so annoying because you had to be using the log server to have any issues. If your network was locked down, the log server was disabled, or if you happened to be using a version that was from before the log server was added, then there were no issues. But clients just heard "log4j" and thought it was unsafe.
load more comments
(1 replies)
Sci-Hub anyone?
Alexandra Elbakyan manages this truly awesome source of scientific papers completely on her own. She got sued twice and lost, had to change the URL multiple times due to takedowns and only gets along by donations.
It is a crime to humanity to lock knowledge behind a huge paywall. She does God's work.
And it's not like the actual scientists/academics support knowledge being locked away either, or profit from it.
load more comments
(1 replies)
She's the best thing that's happened to the s scientific publishing field. I'm no longer a student but I still enjoy reading scientific papers and I'll be damned if I have to pay $20 per article (which doesn't go to the authors) since I no longer have access to a library that maintains relationships with these big publishers.
Werner Koch, the guy who created, and who has maintained for 25 years now, pretty much all by himself, GnuPG, the modern email encryption replacement for PGP.
Just the other day, I realized I actually live just a few kms away from the guy, here in Germany ... very tempted to reach out to him someday and actually buy him an actual coffee.
load more comments
(1 replies)
Had GPT summarize what happened.
The "left pad" incident refers to a controversy that arose in 2016 when a developer named Azer Koçulu removed his JavaScript package called "left-pad" from the NPM (Node Package Manager) registry. This caused a ripple effect, breaking numerous projects that relied on this package and highlighting the potential risks of relying on external dependencies. The incident sparked a debate about the stability and trustworthiness of the open-source ecosystem and led to discussions about best practices for managing dependencies in software development.
This is the one I came to post about. The fact there's a library for this is so stupid to me.
I feel like it demonstrates how npm and modules have probably to some degree gotten out of hand.
From memory the NPM blokes had to have a think about how they handle important packages because of that. Didn't they revert the changes to left pad to ensure everything else didn't break?
Fascinating to see the house of cards some of these solutions / libraries are built off
Yes. They added it back. The policy now is that you can't remove packages that are depended on (or something to that extent, I don't know the specifics).
load more comments
(1 replies)
That's always the one I'm thinking of when anyone mentions the xkcd.
npm is one crazy infrastructure.
cURL was one of these for a while (according to my limited understanding)
It was made in the 90s and it didn't get commercial support until a few years ago.
A developer maintained a NodeJS package called left-pad that would add leading whitespace to strings. He unpublished the package and broke basically the entire Node ecosystem until the repo owner forcibly republished it against the author's wishes.
TzData is basically maintained by 2 guys. Pretty much every computer, phone and language relies on this database for timezone information.
The core-js library is used by 1000s of top websites and is maintained by one guy
https://github.com/zloirock/core-js
He also went to prison
It's honestly a fascinating read. We count so much on these kinds of people to keep our way of life intact, but when they ask for a little help in their own life, they get spat on.
It's really, really sad that this sort of stuff doesn't get picked up and funded for the greater good. Stuff like the NLnet Foundation exists, which has helped fund some pretty major projects (including the development of Lemmy), but something this critical I feel should be consistently funded by even larger entities in order to keep things working right.
That feels it went seriously bad
load more comments
(1 replies)
I didn't even know about core-js until the dev complained about all the sites which use it. https://github.com/zloirock/core-js/blob/master/docs/2023-02-14-so-whats-next.md
Not a package but FileZilla is developed by Tim Kosse for over 20 years. I know that there are a lot of other FTP-Clients but FileZilla is my favorite. Easy to use and very very stable. There is a pro version sure, but most of the time the regular one does the job. My company throws thousands of dollars a month at Adobe, Microsoft and others. But they would never even think about giving anything to Tim Kosse and others, even though I've probably saved days of work with tools like this.
Who maintains ffmpeg?
Looks like there has at least been a small team working on ffmpeg for some time. https://en.m.wikipedia.org/wiki/FFmpeg#History
load more comments
(1 replies)
Node frameworks are famous for this purely because of a lack of standard library. I feel like most languages have a standard library that balance being generic but still providing utilities of common used stuff. So a company that doesn’t want to rely on a random guy’s library can build their own with only the features they want. But with Node, any complicated feature is using a tree of hundreds of random packages that you have no idea who created them.
Someone ought to write a Node.js fork that includes native implementations of popular modules that are unlikely to need maintenance like isodd. Then come with a custom version of NPM that refuse to install the packages.
Deno basically did this by including a standard library that removes the need for the most popular modules. It's the best js/ts experience I've ever had.
load more comments
(1 replies)
Would you like to hear an OpenSSL joke?
It's 64k letters long and you can repeat it back to me when I'm done.
It's "A".
load more comments
(4 replies)
Basically every Windows sysadmin is indebted to Mark Russinovich and SysInternals. Fortunetly, PowerToys has come a long way because I'm pretty sure sysinternals haven't been updated since Windows XP.
Mark Russinovich now works for Microsoft and they own Sysinternals. Also the tools get updated quite regularly.
"Mark works for MS" is a massive understatement. He's CTO of Azure now.
And speaking of Sysinternals, arguably the most exciting update was when ProcessExplorer got a dark mode late last year :)
load more comments
(1 replies)
In the same kind of vein as imagemagick, Dave Coffin's dcraw tool at least partly underlies almost every non-proprietary RAW image decoder, and some of the commercial ones (if they don't use code, they use constant matrices and such).
He's not a sole maintainer to any of his major projects anymore, but honorable mention to Fabrice Bellard who initiated both ffmpeg and qemu among other notable activities.
IIRC the Expat XML parser that's embedded everywhere was basically on spare-time maintenance by Clark Cooper and Fred Drake for a couple decades, but I think they have a little more resources now.
SQLite is a BDFL situation more than single-maintainer, but D. Richard Hipp still has his hands on everything, and there are only a relatively small number of folks with commit access.
Edit: maybe it was core js. I don't remember the name exactly.
Standard JS. It's a library maintained by one guy in Russia who went to jail for some car accident (I don't have the full context). He needed money and had trouble getting it. Then the Ukraine invasion happened and that only made it more difficult for him to get money. Also he was harassed by less technical people seeing his code on websites thinking it was malicious.
It's really a sad story to me.
Yeah it was quite shocking for me to read his story. Link for everyone who hasn't come across it yet. https://github.com/zloirock/core-js/blob/master/docs/2023-02-14-so-whats-next.md
Edit: Just noticed that he used the exact same comic in this write up.
As a game developer ImGui comes to mind.
Look up a machine called Therac-25. great example of this. Terrifying.
That's terrifying!
I'll save the next guy a search https://en.wikipedia.org/wiki/Therac-25
Tl;dr:
The Therac-25, a radiation therapy machine produced by Atomic Energy of Canada Limited (AECL), was implicated in six accidents between 1985 and 1987 where patients received massive radiation overdoses due to software errors.
Salvatore Sanfilippo - creator of Redis.
Well, he actually received many appreciations from the community. But it's worth knowing IMO.
The Network Time Protocol was certainly one of these for a long time, although I think it gets reasonable support now.
Having the clock read the same on all the computers in the world makes so many thing possible.
load more comments
(3 replies)
I believe a great example is... you know... the entire internet.
RenderDoc is made by one person. It's used by every graphics programmer. It's free, open source, faster + better than anything else. I love it.
view more: next ›