Hacker News Reader

2.20 would stand for 2^20 vulnerabilities.

I decided to just ditch it and write from scratch something api-compatible, but extremely cut-down on "features".

Maybe someone would release something along this line. I can't.

You could consider alternatives such as logback instead of writing your own.

A case of scare of old codebases. Decision was made to have at least some control.

this is basically what the openbsd community as done with several protocols/systems.

LibreSSL is a complete rewrite of the openssl functionality with drastically fewer features. Same goes for CARP.

Maybe running software with minimal defaults is a good thing, as it forces the users of the system/library/whatever to think about its behaviour and usecase.

LibreSSL is a fork, not a complete rewrite.

Use logback, spring boot default.

Logback isn’t entirely immune: https://cve.report/CVE-2021-42550, although access to the configuration file is required.

I wonder how difficult will it be to increment the major version and turn off all features that can lead to these vulnerabilities.