Log4Shell Shows the Need for “Trustworthy Java”

People don't like to work on fixing security. Security improvements mostly come from corporate backing. (Just look at how many security patches Google has added to the Linux kernel). Unfortunately, log4j falls outside the corporately-backed JVM core. Nobody has the authority to make fixes to log4j (and communicate fix strategy to the community) other than the log4j maintainers, who are volunteers. So we had to wait.

Oracle could have made a website that tracks the state of fixes, and tells people how to apply fixes (as the article suggests). But Oracle seems completely disinterested in promoting Java adoption. I think Oracle maintains ownership of Java the same way Google had Guido van Rossum on staff: pure vanity.

The community won't prepare for another log4j. How many people suffered consequences from it? How many people were hacked? Many programmers had to work nights and weekends to update their stack. Great. Now those programmers are tired and won't be interested in contributing to an effort to stop the next log4j.

The real solution is to be conservative in your use of 3rd party dependencies. Identify organizations that don't do proper code review (I.E. Don't use Apache Software Foundation projects without added scrutiny).