Hacker News Reader

> Having not been in the Java world for many years, I was surprised log4j was still in widespread use.

It's Java; the ecosystem is, politely, rather conservative and slow moving.

It's a bit of conservative culture, and a bit the result of success. There is a lot of Java code out there, and a lot of it is quite old. Finding and replacing every single instance of log4j out there would be a lot of work, and before this incident of relatively low benefit to everyone involved.

Reply on news.ycombinator.com