# [RFC] squelch log4j inquiries 4 messages from 2021-12-23 to 2021-12-25. Participants: Junio C Hamano, rsbecker@nexbridge.com, Philip Oakley. Thread: https://gitlist.dev/t/57147 ## Junio C Hamano, 2021-12-23 23:52 Subject: [RFC] squelch log4j inquiries Message-ID: URL: https://gitlist.dev/e/xmqqmtkq6frf.fsf%40gitster.g ``` I wonder if we should do something like this, for limited time like a few months or so, so that we have something prominently shown at places like https://github.com/git/git/ Signed-off-by: Junio C Hamano --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git c/README.md w/README.md index f6f43e78de..76e99fe5bb 100644 --- c/README.md +++ w/README.md @@ -7,6 +7,9 @@ Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. +No part of Git is written in Java, hence it is not susceptible to +the log4j vulnerability that has been causing sensation recently. + Git is an Open Source project covered by the GNU General Public License version 2 (some parts of it are under different licenses, compatible with the GPLv2). It was originally written by Linus ``` ## rsbecker@nexbridge.com, 2021-12-24 00:14 Subject: RE: [RFC] squelch log4j inquiries Message-ID: <01d201d7f85b$4bffb2c0$e3ff1840$@nexbridge.com> URL: https://gitlist.dev/e/01d201d7f85b%244bffb2c0%24e3ff1840%24%40nexbridge.com In-Reply-To: ``` On December 23, 2021 6:52 PM, Junio C Hamano wrote: > I wonder if we should do something like this, for limited time like a few > months or so, so that we have something prominently shown at places like > https://github.com/git/git/ > > Signed-off-by: Junio C Hamano > --- > README.md | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git c/README.md w/README.md > index f6f43e78de..76e99fe5bb 100644 > --- c/README.md > +++ w/README.md > @@ -7,6 +7,9 @@ Git is a fast, scalable, distributed revision control system > with an unusually rich command set that provides both high-level operations > and full access to internals. > > +No part of Git is written in Java, hence it is not susceptible to the > +log4j vulnerability that has been causing sensation recently. > + > Git is an Open Source project covered by the GNU General Public License > version 2 (some parts of it are under different licenses, compatible with the > GPLv2). It was originally written by Linus This is a good idea. I have had to reassure a whole bunch of people in my community about this, not really because of git itself but because of the Maven build associated with EGit/JGit that may (do) have this issue if the wrong version of log4j is available. I would rather not discuss the particulars of the attack vector in this mailing list. --Randall ``` ## Philip Oakley, 2021-12-24 10:59 Subject: Re: [RFC] squelch log4j inquiries Message-ID: <3c5ef210-8908-e96f-e201-a7d8e79985fb@iee.email> URL: https://gitlist.dev/e/3c5ef210-8908-e96f-e201-a7d8e79985fb%40iee.email In-Reply-To: ``` On 23/12/2021 23:52, Junio C Hamano wrote: > I wonder if we should do something like this, for limited time like > a few months or so, so that we have something prominently shown at > places like https://github.com/git/git/ > > Signed-off-by: Junio C Hamano > --- > README.md | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git c/README.md w/README.md > index f6f43e78de..76e99fe5bb 100644 > --- c/README.md > +++ w/README.md > @@ -7,6 +7,9 @@ Git is a fast, scalable, distributed revision control system with an > unusually rich command set that provides both high-level operations > and full access to internals. > > +No part of Git is written in Java, hence it is not susceptible to > +the log4j vulnerability that has been causing sensation recently. > + > Git is an Open Source project covered by the GNU General Public > License version 2 (some parts of it are under different licenses, > compatible with the GPLv2). It was originally written by Linus Would it be worth adding a section to the SECURITY.md file that could cover these 'non-issue' concerns. The README could point to the non-issue section. Just a thought. Philip ``` ## Junio C Hamano, 2021-12-25 00:38 Subject: Re: [RFC] squelch log4j inquiries Message-ID: URL: https://gitlist.dev/e/xmqqo8551psz.fsf%40gitster.g In-Reply-To: <01d201d7f85b$4bffb2c0$e3ff1840$@nexbridge.com> ``` writes: >> +No part of Git is written in Java, hence it is not susceptible to the >> +log4j vulnerability that has been causing sensation recently. >> + > ... > This is a good idea. I have had to reassure a whole bunch of people in my > community about this, not really because of git itself but because of the > Maven build associated with EGit/JGit that may (do) have this issue if the > wrong version of log4j is available. I would rather not discuss the > particulars of the attack vector in this mailing list. As you can point those people at the message that started this thread at the lore archive, I actually think that I already have done enough to achieve our goal ;-) ```