throwaway_JiY4E's comments

On: How to Be Useless

[throwaway_JiY4E]

> sad trend recently > Who are these people who are turning communities into sad opposites of these values?

it's not about sad versus happy, but "doing" versus "being". And it's not a multiple choice test. Just you cannot ignore the other polarity.

On: How to Be Useless

[throwaway_JiY4E]

> if you only view yourself in terms of your utility to others, you will be consumed for your usefulness.

I have seen what you say firsthand in myself over the years. Concepts about treating yourself like a business and over emphasizing your "brand" are part of this. I'm not demonizing those concepts, just they can be overdone or overemphasized.

[gumby → throwaway_JiY4E]

Mistaking the path for the journey.

(Or more prosaically, mistaking the how for the what or the process for the goal)

On: Log4Shell Log4j vulnerability (CVE-2021-44228) – c...

[throwaway_JiY4E]

Could it be you already are on Java 8u121? They say it:

> protects against remote code execution by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false".

On: Log4Shell Log4j vulnerability (CVE-2021-44228) – c...

[throwaway_JiY4E]

as I understand, if we are running Java 8u121 this is not an issue... or is it?

that's what the CVE (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4422...) says:

> protects against remote code execution by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false".

[layer8 → throwaway_JiY4E]

It’s still an issue with current JDKs in certain environments (e.g. Tomcat), see https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Inj... and https://www.veracode.com/blog/research/exploiting-jndi-injec....

Also, 8u121 was an incomplete fix, the complete fix (still with limitations as noted above) is in 8u191 (see second link above).

[detaro → throwaway_JiY4E]

As I understand it that prevents the RCE, but not other variants like leaking environment variables.

[throwaway_JiY4E → detaro]

> other variants like leaking environment variables.

I'll google/search more about these. I assume if we say RCE is a 10 for risk, then maybe others are 5 or 3?

[detaro → throwaway_JiY4E]

CORRECTION: apparently latest Java is also vulnerable: https://twitter.com/_MG_/status/1470452714203086851