{"thread":{"id":"57147","subject":"[RFC] squelch log4j inquiries","startedAt":"2021-12-23T23:52:25Z","lastAt":"2021-12-25T00:38:58Z","messageCount":4,"participants":["Junio C Hamano","rsbecker@nexbridge.com","Philip Oakley"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"444890","messageId":"xmqqmtkq6frf.fsf@gitster.g","threadId":"57147","inReplyTo":null,"subject":"[RFC] squelch log4j inquiries","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2021-12-23T23:52:20Z","receivedAt":"2021-12-23T23:52:25Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"I wonder if we should do something like this, for limited time like\na few months or so, so that we have something prominently shown at\nplaces like https://github.com/git/git/\n\nSigned-off-by: Junio C Hamano \n---\n README.md | 3 +++\n 1 file changed, 3 insertions(+)\n\ndiff --git c/README.md w/README.md\nindex f6f43e78de..76e99fe5bb 100644\n--- c/README.md\n+++ w/README.md\n@@ -7,6 +7,9 @@ Git is a fast, scalable, distributed revision control system with an\n unusually rich command set that provides both high-level operations\n and full access to internals.\n \n+No part of Git is written in Java, hence it is not susceptible to\n+the log4j vulnerability that has been causing sensation recently.\n+\n Git is an Open Source project covered by the GNU General Public\n License version 2 (some parts of it are under different licenses,\n compatible with the GPLv2). It was originally written by Linus\n"},{"id":"444891","messageId":"01d201d7f85b$4bffb2c0$e3ff1840$@nexbridge.com","threadId":"57147","inReplyTo":"xmqqmtkq6frf.fsf@gitster.g","subject":"RE: [RFC] squelch log4j inquiries","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2021-12-24T00:14:57Z","receivedAt":"2021-12-24T00:15:09Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On December 23, 2021 6:52 PM, Junio C Hamano wrote:\n> I wonder if we should do something like this, for limited time like a few\n> months or so, so that we have something prominently shown at places like\n> https://github.com/git/git/\n> \n> Signed-off-by: Junio C Hamano \n> ---\n> README.md | 3 +++\n> 1 file changed, 3 insertions(+)\n> \n> diff --git c/README.md w/README.md\n> index f6f43e78de..76e99fe5bb 100644\n> --- c/README.md\n> +++ w/README.md\n> @@ -7,6 +7,9 @@ Git is a fast, scalable, distributed revision control\nsystem\n> with an unusually rich command set that provides both high-level\noperations\n> and full access to internals.\n> \n> +No part of Git is written in Java, hence it is not susceptible to the\n> +log4j vulnerability that has been causing sensation recently.\n> +\n> Git is an Open Source project covered by the GNU General Public License\n> version 2 (some parts of it are under different licenses, compatible with\nthe\n> GPLv2). It was originally written by Linus\n\nThis is a good idea. I have had to reassure a whole bunch of people in my\ncommunity about this, not really because of git itself but because of the\nMaven build associated with EGit/JGit that may (do) have this issue if the\nwrong version of log4j is available. I would rather not discuss the\nparticulars of the attack vector in this mailing list.\n\n--Randall\n\n"},{"id":"444900","messageId":"3c5ef210-8908-e96f-e201-a7d8e79985fb@iee.email","threadId":"57147","inReplyTo":"xmqqmtkq6frf.fsf@gitster.g","subject":"Re: [RFC] squelch log4j inquiries","fromName":"Philip Oakley","fromEmail":"philipoakley@iee.email","sentAt":"2021-12-24T10:59:30Z","receivedAt":"2021-12-24T10:59:33Z","isPatch":false,"sender":{"key":"philipoakley@iee.email","avatar":"https://avatars.githubusercontent.com/u/914343?v=4"},"body":"On 23/12/2021 23:52, Junio C Hamano wrote:\n> I wonder if we should do something like this, for limited time like\n> a few months or so, so that we have something prominently shown at\n> places like https://github.com/git/git/\n>\n> Signed-off-by: Junio C Hamano \n> ---\n> README.md | 3 +++\n> 1 file changed, 3 insertions(+)\n>\n> diff --git c/README.md w/README.md\n> index f6f43e78de..76e99fe5bb 100644\n> --- c/README.md\n> +++ w/README.md\n> @@ -7,6 +7,9 @@ Git is a fast, scalable, distributed revision control system with an\n> unusually rich command set that provides both high-level operations\n> and full access to internals.\n> \n> +No part of Git is written in Java, hence it is not susceptible to\n> +the log4j vulnerability that has been causing sensation recently.\n> +\n> Git is an Open Source project covered by the GNU General Public\n> License version 2 (some parts of it are under different licenses,\n> compatible with the GPLv2). It was originally written by Linus\n\nWould it be worth adding a section to the SECURITY.md file that could\ncover these 'non-issue' concerns. The README could point to the\nnon-issue section. Just a thought.\n\nPhilip\n"},{"id":"444931","messageId":"xmqqo8551psz.fsf@gitster.g","threadId":"57147","inReplyTo":"01d201d7f85b$4bffb2c0$e3ff1840$@nexbridge.com","subject":"Re: [RFC] squelch log4j inquiries","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2021-12-25T00:38:52Z","receivedAt":"2021-12-25T00:38:58Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":" writes:\n\n>> +No part of Git is written in Java, hence it is not susceptible to the\n>> +log4j vulnerability that has been causing sensation recently.\n>> +\n> ...\n> This is a good idea. I have had to reassure a whole bunch of people in my\n> community about this, not really because of git itself but because of the\n> Maven build associated with EGit/JGit that may (do) have this issue if the\n> wrong version of log4j is available. I would rather not discuss the\n> particulars of the attack vector in this mailing list.\n\nAs you can point those people at the message that started this\nthread at the lore archive, I actually think that I already have\ndone enough to achieve our goal ;-)\n\n\n\n"}]}