> This was not caught by Dell, or even the STH team at first, it was a YouTube commenter. If that is how we as an industry are catching the easy plain-to-see stuff, that should scare everyone about what may be hard to see.

And this is why the people shouting that "the direct cause of the log4j bug is our collective failure to give open source maintainers bags of money" are wrong. Don't get me wrong, you should give people bags of money if you want them to drop everything and go fix a critical bug after it's been discovered.

But our collective ability to discover bugs is abysmal.