Антипатчество log4j

https://twitter.com/rickhanlonii/status/1470074730279546895

We don’t need everyone to upgrade log4j, just enough for herd immunity to takeover

My repo my choice

do you really even know what’s in those patches? could be worse than the actual vuln

patches don't always work, so why bother patching it?

It's unpatched servers that are mostly infecting patched servers.

But this upgrade doesn't fix the problem for good, it just blocks the hack for a few months ( but you still can be hacked and spread the hack). Then you have to pay to apply for the next upgrade every 6 months.

I already had one patch, now they're saying I need another. It'll never end. It's just control.

The patch was approved too quickly. This feels fishy. Didn’t Bill Gates fund it?

Those patches are so new, and were created so fast. Once they have been around for a few years I may decide to deploy them.

Have the patches been in a sufficient amount of long-term studies? Until they are I won't apply them! My app is not a guinea pig!

Can’t we just keep the servers 6’ apart?