-9

I'm a developer that works with an institution that has been impacted by this vulnerability, and boy am I dissatisfied with how this blog post was presented.

Let's get the obvious out of the way - this is meant to be a blog post that showcases data. As in, the data around traffic increases to the site when this happened, and the fact that users come to the site as a resource when they need answers quickly. It's an "ooh, shiny" tale that on any other day for any other circumstance, wouldn't catch my attention.

There's two key points that I'm dissatisfied with in this post.

  1. The risk level and the mitigation are gravely underplayed.

    The bad news is the vulnerability could allow attackers to gain control of any system running specific versions of Log4j; potentially hundreds of millions of systems and projects were at risk. The good news is only some versions are vulnerable, and the solution is pretty simple: update Log4j to version 2.16+.

    Yes, all you have to do is update the version of your Log4j2 library and you're pretty much OK. But this oversimplifies the gravitas of the problem to the level of insult. You sound like a C-level executive who doesn't know the shredder from the copier.

    In a utopia, everything you develop has an associated build process, deploy process, review process, and you can turn around things quickly.

    Not everyone lives in a utopia.
    Not everything can "simply" be updated.
    Some of us are in the middle of building a better tomorrow for our applications, and we got blindsided by this.
    Some of us aren't fully aware of the scope of all of the applications we control or had to patch/update and thus can't update easy.
    Some of us would be fortunate to find the original source code that existed because someone had the foresight to convince the contractor not to keep it on their own machine and at least provide a tarball so that it could be imported into SVN at a later date.
    Some of us rely on third-party vendors who have this vulnerability in their application, and we explicitly cannot do anything until they do something.

    ...

    "Tell me you've never dealt with legacy code without telling me you've never dealt with legacy code."

  2. The company is - to no one's real surprise - implicitly encouraging this kind of behavior and traffic. I've said it before that we're really not in a position to parrot information about CVEs - no matter how major they are - because we're not the maintainer or vendor of that software. But it doesn't look like the Powers that Be really want to represent that or own that in any way.

    In a situation where accurate information matters and we need less guessing and more precision, lots and lots of people coming to Stack Overflow and asking the same question is...a symptom of an issue. It means that there is more panic and more heads melting and people wanting to take action now as opposed to figuring out what action to take. In situations of a crisis, this is characteristically bad as it can lead to advice becoming quickly deprecated and Stack Overflow in no position to quickly maintain the flood of solutions suggesting it.

    To be fair to the site, Stack Overflow's always been in that bind - information gets outdated and software becomes deprecated, yet people still rely on and leverage it. You're finally addressing it, but it's been a problem since time immemorial, and in this instance, we happened to have the worst case (e.g. not being able to clean up old/deprecated answers) play out in real time.

    And you're asking the curators to pick up the slack. In real-time. While they may also have their hands full, not the least being dealing with a massive security vulnerability.


Bonus shout-out to the fact that the blog referenced the Twitter followers. You managed a whole five responses and three-hundred and forty-five votes! Maybe if there was some other community you could have asked the question to who would've been more responsive to this situation...


One more thing. I didn't call out the fact that the actual vulnerability lives in the library, not . They are two separate versions and they are two different logging frameworks. Log4j2 is the successor of Log4j. Log4j2 is compromised.

But hey - it's simpler to type "log4j" than it is to get the actual library right.

14
  • 6
    To the last point, I think "Log4j" refers to the library regardless of version (1.x or 2.x). When the distinction matters, "Log4j 2" is the way to go.
    – M. Justin
    Jan 20, 2022 at 19:56
  • 8
    Your blog <del>post on the Log4shell vulnerability</del> is tone-deaf and keeps the actual community at arms' length — FTFY Jan 20, 2022 at 20:13
  • 4
    @Makoto that links seems to switch back and forth between using "Log4j2" and "Log4j 2". For example, in the "mitigation" section, they say "Upgrade to Log4j 2.3.2 (for Java 6), 2.12.4 (for Java 7), or 2.17.1 (for Java 8 and later)", while earlier referring to "...Log4j2 versions 2.17.1, 2.12.4, and 2.3.2." as being the versions that fix the issue.
    – Tyberius
    Jan 20, 2022 at 20:14
  • 2
    @Tyberius And sometimes they don't even mention the 2 even when it's a 2-specific feature: "Client code running on Java 8 can benefit from Log4j’s lambda support. Since Log4j will not evaluate a lambda expression […]"
    – M. Justin
    Jan 20, 2022 at 20:25
  • 1
    You don't know the conversion rate on those blog posts. I'm pretty sure they are laughing at HQ when the monthly stats role in. Compared to the SE devs stats, the blog is doing great. Hire more copy-writers to produce more fiction.
    – rene
    Jan 20, 2022 at 20:28
  • 24
    I don't know why you're so mad at Stack Overflow for a vulnerability they neither created nor fixed. I get it, Log4shell has been an enormous PITA and has required a massive amount of firefighting to fix. But your whole first bullet is akin to them saying, "Hurricane Katrina was bad," and you responding, "Bad? BAD?! Unbelievable. You're so out of touch. It was horrible! Entire neighborhoods were destroyed. People died, you stuffed suits!" You're not wrong, but why are you yelling at the dog? Jan 20, 2022 at 20:30
  • 6
    @JohnKugelman: Where did it imply that I was mad at them for the vulnerability? I'm mad at them for their gross misrepresentation of how "simple" the fix for the vulnerability is, for the fact that they decided to just gather statistics about it to really...not demonstrate much more than "people use Stack Overflow when something big in tech happens", and for their otherwise radio silence on why they think that using Stack Overflow as a platform to facilitate discussion on mitigating CVEs has ever been in scope. Don't create a strawman out of thin air, even if there's plenty of straw around.
    – Makoto
    Jan 20, 2022 at 21:49
  • 1
    Wow, they listened to you: stackoverflow.blog/2022/01/21/… ...
    – rene
    Jan 21, 2022 at 7:11
  • I think the best solution is to just ignore the blogs. The only reason I keep being reminded they exist is because of meta posts such as this :) Now I can't resist reading the trash, thanks a lot!
    – Gimby
    Jan 21, 2022 at 10:47
  • 1
    @Gimby I've already blocked them from appearing in the side bar. I just used uBlock Origin's element picker. I didn't really read it actively in any way but after that last article that sparked a meta Q I decided it was detracting value from the pages where it was shown.
    – VLAZ
    Jan 21, 2022 at 10:57
  • @VLAZ I hear that. After that particular meta post the yellow block in the top right became invisible to me in that Hitchhiker's Guide to the Galaxy "somebody else's problem" kind of way.
    – Gimby
    Jan 21, 2022 at 11:13
  • @rene: Tell me why I got my hopes up for a second there
    – Makoto
    Jan 21, 2022 at 16:36
  • 2
    @Makoto because we both love to hate this place or hate to love this place. Something like that.
    – rene
    Jan 21, 2022 at 17:07

1 Answer 1

-12

The question got bumped after a year, so it's a good time to to update the answer as well. It's now 2023, the blog is still full of bad posts, the CEO posts on there are still useless fluff, and there is no shortage of posts pushing garbage such as pluralshite (dear editors, that's not a typo).

Expecting any of this to change seems unrealistic, as the blog is primarily a marketing endeavor. Looking at this product brief about sponsored blog posts should be enough to understand what to expect from the blog - bad ads from companies lured by phrases such as "Establish your brand as a thought leader". Given that SE ignored feedback over a bunch of other marketing-driven things such as the SO landing page (which I personally find more important than the blog), the chances of bringing meaningful change to the blog by complaining about it on meta are practically zero. So I'd suggest spending that time on more fruitful endeavours.

Original answer below...


Let me preface this answer by stating I have not read anything more than the title of your post. But then, why would I need to?

The central issue here seems to be that you expect the SO blog not to contain bad content, or maybe you're expecting the people who write the posts to know anything of value about the topic they're writing about. As there are already many past blog posts that disprove these expectations, I'm unsure why you're still clinging to them. Thus far, the blog has already featured a large selection of crap posts. Some examples: useless fluff pieces from the SE CEO and other management, posts disparaging experts and volunteer moderators in various forms, and some (maybe sponsored?) tech posts that read like bad advertorials. There's probably decent content in between there too. But overall, if you pick a blog post at random you have a pretty good chance that it's crap.

So, SO posted a blog entry about the Log4j vulnerabilities, and you think it's bad. I wouldn't know; I didn't read it because I have better things to do with my time. However, my reaction to that falls somewhere in between "yep, as expected" and "lol, you read the blog" and "why would you expect a company that actively tries to drive away subject matter experts to produce anything of value". Bad blog posts are just yet another symptom of the transition of SE from a small startup that valued experts, knowledge, and quality content, to a faceless tech company valued in billions of dollars with an MBA CEO that's ruled by corporate interests and isn't in touch with its users anymore.

I just opened one of the CEO blog posts at random that was linked in the "Related" section under the OSS security blog post and found this quote in the first few paragraphs:

One of my biggest learnings is that organizations and leaders have a responsibility to ensure people are heard, to build high levels of trust and enable them to show up authentically— all so they can do their best work.

Compare that to the reality of the interactions between the company and the community in the last few years, and it will tell you everything you need to know about the company and its blog posts.

TL;DR: a bad blog post is just a tiny drop in the ocean of shit that SO has become over the last years. If you have the capacity to care about that, I suggest you redirect that energy to something else.

4
  • 22
    Let me preface my comment by stating I haven't read anything more than the first sentence of your answer. But then, why would I need to? You don't seem that interested in engaging with the actual conversation I'm trying to have of facilitate.
    – Makoto
    Jan 21, 2022 at 16:35
  • 6
    The blog, which exists on SO, the leading place developers go for help/recognition (whether warranted or not,) being so laughably awful, isn't an excuse to not want it to be better, or to not openly criticize it. You may have given up all hope, but that doesn't mean we all should just roll over and let this malpractice continue unabated.
    – Kevin B
    Jan 21, 2022 at 16:41
  • 2
    @Makoto the "conversation" is useless though as the entity you're trying to converse with (SO) is not interested in this conversation, as has been shown time and time again over the years.
    – l4mpi
    Jan 24, 2022 at 9:36
  • 3
    @KevinB you might have failed to notice but that fight was already lost a few years ago when they created the SO landing page against heavy community pushback (open stackoverflow.com in a private window if you don't know what I'm talking about). The blog is basically a marketing / CR endeavour, as was the landing page. If you think they're going to enact actual change on the blog due to a bit of criticism after a bad article or 20, I would question where this baseless optimism comes from.
    – l4mpi
    Jan 24, 2022 at 9:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .