Comment by hansvm

2 days ago

You mean this log4j [0] with major vulnerabilities the industry missed for nearly a decade?

[0] https://en.wikipedia.org/wiki/Log4Shell

So you don’t use any software that has had a security vulnerability?

What operating system and browser did you use to write your post?

Have you used ever OpenSSL? :-D

The thing is: A bug does not invalidate enterprise adoption - Microsoft ist a good example.

  • That was less my point, and more that "battle-tested" doesn't have to be a cudgel to argue against in-house projects, especially when considering defect rates (the more-general solution is very often slower and buggier to support the features you don't need).

    • Maybe we should differ the terms:

      "industry proven" -> MS/Windows -> yes

      "battle tested" -> MS Windows -> you may discuss? :-D

      If there is an inhouse solution available and which is really working, then Id not introduce an externa component here. If you start from zero, then using a pre-existing component should be the path, in my perception. Sure, one can waste time write a logger, but should have e.g. Bezos spent time coding on a logging lib or care about the webshop and use an existing lib for that - but in most cases it does not payoff to do whatever self-implementation-voodoo someone imagines: its just a waste of time. (Esp. since most companies do not take off enough to make such an investment plausible)