If you're surprised about the log4j vulnerability, just wait until you hear what happens when you put a java.net.URL into a hashtable
25
294
114
1,564
You mean the behavior as clearly documented since Java 1.0 (1996)? And with an alternative, java.net.URI, since Java 1.4 (2001)?
6
4
39
Replying to @brunoborges @floydophone
It’s still fascinating how something that was at least acceptable enough initially, and worth maintaining compatibility for since forever, is now such an obviously bad idea. Hindsight is genius, as usual, but still …

Dec 14, 2021 · 7:15 AM UTC

4
1
1
53
Replying to @stilkov @brunoborges
yeah i can 100% understand the thinking at the time. but it is really a super dangerous footgun now.
4
4
more replies
Replying to @stilkov @brunoborges @floydophone
Remember: That outlived from a time, when entity beans had remote interfaces.
2
Replying to @stilkov @brunoborges @floydophone
I can’t even understand the thinking at the time. Hashing a value/object shouldn’t depend on an network service.
1
Replying to @stilkov @brunoborges @floydophone
I think that will keep happening, as the whole IT technosphere is growing into more and more complexity where even a small number of bad actors can do incredible harm. In a few decades, plugin systems and npm in its current form will seem like utter madness.
1
3