This is a problem in open source: everybody wants the fruits of labor without paying for it. The log4j vulnerability is what happens when you don't pay for it.
That's right. It is open source and, when it breaks, you get to keep both pieces.
but being open source, you can pull out the crazy glue and stick them back together. if you feel generous, you can submit your crazy glue solution to the devs. if they like it, they can then make it part of the package.
On the other hand, I expect that most people running log4j didn't know about or want this feature. What should they pay for something they don't want?
Maybe it makes more sense to fund system-wide efforts?
That's why I don't contribute to open source that is used by big corps. I don't like the idea of working for free for the benefit of billionaires.
You give away your work with a price tag of $0. So people/companies pay $0 for it. What’s hard to understand about that?