Hacker News Reader

> Making something work in Java is easy. Proving it is secure is not.

Ok, so which language it is easy to prove secure?

Prove secure to a corporate procurement process. Not a formal logic proof.

Any use of Java will trigger additional diligence work to prove it does not use vulnerable log4j. So in this sense almost anything else is better.

That's like 15 minutes of work tho

Perhaps — explaining that to people in procurement and convincing them is months of work. Corporate procurement doesn't actually care about the risk in many cases, they care about having someone to blame.

None are.

But, we do have sufficient resources to justify and defend decisions made with our primary development language.

In this context, "prove" is more like "convince".

Is there any interest in bringing back that feature? No wizard here, but I dealt with Log4shell for our product. Reach out if you'd like someone to take a look.

Reply on news.ycombinator.com