I totally got this from your alt text, without needing to expand and look at the image itself -- thank you (I have all images collapsed on Slack).

p.s. "log4j on the Mars Rover!" 🙂

Are they going to do that REPL thing in space again? :)

Oh man, that would be a rad story. Sadly, the folklore laments that the days of Lisping at the JPL / NASA are long past. I read something about FORTH flying on their spacecraft in the 2010s, but not about Lisps.

Maybe they secretly do, but let everyone believe it's all really just C and Python.

What I meant was, this log4j thing is actually a REPL by accident

they should use the vulnerability to patch the vulnerability

🤯

> What I meant was, this log4j thing is actually a REPL by accident Aaah ok... by "REPL thing in space 'again'" I thought you meant this: https://flownet.com/gat/jpl-lisp.html

Not sure if it's exactly what you're looking for, but I believe the idea is to just understand the flow of things visually as part of the design process. Tangentially, I don't know if it was used to create this specifically, but Rich has mentioned Omnigraffle many times.

no, i am quite clear on the tool and the general idea. i thought that usually there is someone else's book behind the idea, which goes in details about the topic.

It's not really based on anything afaik

Other than just basic data flow diagrams or ERD

so the notation is adhoc. i see.

Woah I had not seen Stuart's flowing locks before!!

he's a man of many hair styles

Rich often uses Omnigraffle on a Mac for drawings, so I've heard, but that isn't the crucial factor in these drawings, other than look & feel

I've heard one or more of the Clojure core team emphasize the importance of drawings in software system design work.

Although not specifically industry standard kinds of things like UML diagrams. Mainly any drawing that makes the ideas and structure clear.

At the risk of making this more than it sounds, nowhere in the ticket, nor announcement does it mention it is a critical update.

they link to a PoC for RCE with logback. they don't call it critical but I do https://github.com/cn-panda/logbackRceDemo

Whilst you do, it's not up to us how we label such things.

It may cause undue panic.

who says it's not up to us?

Who says it is?

I do

I can call a vulnerability, and the associated update, critical if I want to. I have hereby claimed that authority

You don't speak for the authors of the library I imagine. I would let them speak for themselves on how they announce it to the world.

you would, and if you were announcing it to people then you could, but you didn't and I did and I feel like I'd be doing an injustice by not stressing that it's critical

call it a difference of opinion

see the thread in #announcements about why it's not overblown to call it critical

Unfortunately, what you post reaches a larger audience than deeming it a difference of opinion. What is shared here matters, so the choice of words and how we communicate that out to the channel has to be thought of carefully. The ticket (in jira) does not mark it as critical. I would rather hear from the authors who are responsible for the library than some 3rd party voice in some other community.

Yes, I have read your comment in #announcements too.

I linked to it, read at your leisure

and your replies in here stand as a contrary opinion for anyone who wants to read more about it, so you've done your duty for where you place authority. I can assess security threats myself and my organization is treating it as critical

How you treat it in your organisation is entirely up to you. I go by the authors of the library. They have not said at all it is a "critical" update.

👍

Thanks for posting, @U02N27RK69K — I must admit, I spit out my coffee when I read this: > We have also removed all database (JDBC) related code in the project with no replacement. Logback can reach out to JDBC? 😂😂 😭😭😱😱:face_vomiting::face_vomiting: