When log4j patches become the new vaccine, herd immunity for repos
Description
Screenshot of a Twitter thread on a white background. The primary tweet, from user “Ricky @rickhanlonii,” reads: “We don’t need everyone to upgrade log4j, just enough for herd immunity to takeover.” Timestamp shows 6:55 PM · Dec 12, 2021 · Twitter for iPhone. Beneath it are metrics: 1,025 Retweets, 107 Quote Tweets, 5,119 Likes. A self-reply from the same user says: “my repo my choice.” A second reply, from another user, says: “do you really even know what’s in those patches? could be worse than the actual vuln.” Visually it mimics typical Twitter UI with avatars blurred for privacy. Technically, the meme riffs on the 2021 Log4Shell crisis: senior engineers scrambling to bump Log4j versions while jokingly comparing patch adoption to public-health herd immunity and anti-vaccine rhetoric, highlighting classic dependency-upgrade reluctance and security patch skepticism in large codebases
Comments
25Comment deleted
Funny how our threat model now includes social-media epidemiology - apparently CVE-2021-44228 gets mitigated once 70 % of the microservices are on 2.17.1
The real herd immunity is when enough unpatched systems get compromised that attackers can't keep up with the incident response tickets being generated across the industry
Herd immunity doesn't work when every host in the herd transitively bundles its own private copy of the pathogen
Treating Log4Shell patching like vaccine hesitancy - because nothing says 'personal freedom' like leaving your entire infrastructure vulnerable to RCE while waiting for 'natural immunity' from script kiddies
Herd immunity for Log4j? Cute, until that unpatched transitive dep in your vendor's fat JAR turns your monolith into a remote code piñata
Herd immunity is not an architecture pattern - leave one Log4Shell-era JNDI unpatched and the attacker’s load balancer finds it before your SRE does
Security doesn't do herd immunity; one transitive log4j in a forgotten fat-jar behind a stale reverse proxy is enough for RCE across the estate
yes, yes you do, it's open source, also how long did it take for log4j to show this vulnerability? the patch could very well introduce a new one that we find after 5 years. so yes clowns, your sarcasm is invalid. Comment deleted
That was just funny how another narrative could be easily transferred to our topic. Btw, with patches everything is much more cleaner and easier. You better have another RCE 5 years later, than one public right now Comment deleted
oh and, not to mention you can still get covid, spread it, and die, after getting the vax. and no, Israel's data shows it's not a lower chance, a couple months ago, around 70% of hospitalized covid patients in Israel were fully vaxxed. truth is, we are not anti vaccine or science, it's just a shitty vax this time around. Comment deleted
"70% patients were vaccinated" - proof pls. Bcs I've read absolutely opposite articles Comment deleted
I read the ministry of health's website at the time. the data is probably there still, and now it might be worse or maybe boosters fixed it for a short while. Comment deleted
Well, it's great that you read their site, but by 'proof' I meant a link to the place where I'll also will be able to read such data Comment deleted
I don't owe you a link, I don't care if you get vaccinated or not. https://t.me/disclosetv/3982 https://www.timesofisrael.com/health-ministry-chief-says-coronavirus-spread-reaching-record-heights/ https://www.science.org/content/article/grim-warning-israel-vaccination-blunts-does-not-defeat-delta Comment deleted
Depends on what privileges and contents that project runs with and/or if it even faces the internet in any meaningful way Comment deleted
Or get a different exploit right away, no need to wait 5 years Comment deleted
3 links should be enough, if not, use google Comment deleted
Well, I have to admit that it was a proof I couldn't argue with Comment deleted
But still, even if 70% of hospitalized people (~500) were vaccinated - it may be possible that without vaccination there would be 2000 people instead of 500. And also there was a remark in text, that it can be connected with the fact that eldest people were vaccinated first Comment deleted
there it is, the but still. if you consider Israel's population, 500 is not a low number. also, isn't the vaccine our holy and divine savior? specially for the old people? Comment deleted
Don't know about holiness and diviness, but vaccine is a researches-proofed saviour from regular COVID19. And highly likely a helper with covid19 Delta Comment deleted
https://www.bmj.com/content/375/bmj.n2635/rr-80 Comment deleted
is it? Comment deleted
When I said 'researches-proofed' I didn't mean a pharma companies researches. I meant researches made by epidemiologists using covid19 statistics from different countries Comment deleted
and that's when they found out about the myocarditis Comment deleted