I thus enjoyed a development career (mostly) free from this kind of needless pain and suffering.
The other example for those that are curious is micrometer. The basic API and the implementations (prometheus, statsd, etc.) are separate jars.
It took a simple problem and turned it into a clusterfuck of configuration and complexity.
It is worth mentioning, that any even very basic solution always has a possibility to shoot in the leg, and only professionalism of the developers of the client code can avoid it, so the real reason why this is happening now on a massive scale is that Java world is big and has probable hundreds of thousands, if not millions of developers, who do not have enough knowledge or experience to write better code, understanding all the possible side effects and other consequences of their decisions.
This was going to happen eventually. It will happen again, but maybe next time it will be a Python or TypeScript library. Would it be right to call their ecosystems toxic? I honestly do not know. But let's at least have some respect for people who have built it, almost for free.
Yes, it's free. No, the vast majority of users never actively opted into it. No, it's not disrespectful to suggest that a log library that interpolates parameters was never fit for purpose.
This class of problems was back then called DLL hell, and guess where the „DLL“ comes from? Hint: not Java. In any case, it is quite rare by now and calling ecosystem „toxic“ because of that?.. Pretty sure you haven’t seen the others long enough.
Why should I show respect for software I hate using and that causes problems for the entire tech community? I appreciate that they built it for free. I write open source code too, and glady accept criticism if I release something that sucks (which I do often)
This saga is a lesson in choosing the right tech, and switching off libraries built for use cases 100x more complex than what 99.9% users need.
What knowledge do you have, about this library which you've never used, which qualifies you to say that it's especially prone to security vulnerabilities - other than hindsight bias?
You aren't expected to. You're expected to show respect for the medium with which you are expressing those thoughts (HN), and the other people you are communicating with on that medium, by keeping the discussion civil and doing your part to keep it from devolving I to a flame-fest.
Almost nobody cares that you have and express dislike for this software. They care that you're doing it in a way which encourages additional discourse which isn't useful and wastes everyone's time.
At extremes it's the difference between staying you think a person is immoral or untruthful with reasons and calling someone an asshole. One of those is easier to have an actual discussion over than the other.