You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@logging.apache.org by Robert Middleton <rm...@apache.org> on 2021/09/25 01:49:45 UTC
[log4cxx] Removal of log4j serialization?
I've been working on ABI compliance for log4cxx lately(LOGCXX-516),
and I'm running across a few classes that have to do with sending log
messages as Java serialized messages. Since we've removed the ability
to receive these messages through Chainsaw, and due to Java's known
security issues with object deserialization, is there any reason in
keeping this feature around?
Note: I'm currently imagining that this would be for the next major
release of log4cxx, which I wouldn't expect for at least another year.
Whenever that release is, I expect that the release would break a lot
of code, so removing the serialization at that time makes the most
sense to me.
-Robert Middleton
Re: [log4cxx] Removal of log4j serialization?
Posted by Robert Middleton <rm...@apache.org>.
That sounds like we're in agreement then. I'll go put in a merge
request for that sometime in the next few weeks(against a new
development branch) to track it. My thought is that all of these
new(and breaking changes) will be in a separate branch(log4cxx-next?)
so as to not mess with master, as there are a number of fixes that
will break things.
-Robert Middleton
On Mon, Sep 27, 2021 at 9:06 AM Thorsten Schöning <ts...@am-soft.de> wrote:
>
> Guten Tag Robert Middleton,
> am Samstag, 25. September 2021 um 03:49 schrieben Sie:
>
> > I've been working on ABI compliance for log4cxx lately(LOGCXX-516),
> > and I'm running across a few classes that have to do with sending log
> > messages as Java serialized messages. Since we've removed the ability
> > to receive these messages through Chainsaw, and due to Java's known
> > security issues with object deserialization, is there any reason in
> > keeping this feature around?
>
> I have the feeling that textual based log messages are preferred in
> most cases and formats like JSON(/XML) seem more interoparable and
> accepted these days. So if it makes anything easier, I vote for
> removing as well.
>
> Mit freundlichen Grüßen
>
> Thorsten Schöning
>
> --
> AM-SoFT IT-Service - Bitstore Hameln GmbH
> Mitglied der Bitstore Gruppe - Ihr Full-Service-Dienstleister für IT und TK
>
> E-Mail: Thorsten.Schoening@AM-SoFT.de
> Web: http://www.AM-SoFT.de/
>
> Tel: 05151- 9468- 0
> Tel: 05151- 9468-55
> Fax: 05151- 9468-88
> Mobil: 0178-8 9468-04
>
> AM-SoFT IT-Service - Bitstore Hameln GmbH, Brandenburger Str. 7c, 31789 Hameln
> AG Hannover HRB 221853 - Geschäftsführer: Janine Galonska
>
>
>
>
Re: [log4cxx] Removal of log4j serialization?
Posted by Thorsten Schöning <ts...@am-soft.de>.
Guten Tag Robert Middleton,
am Samstag, 25. September 2021 um 03:49 schrieben Sie:
> I've been working on ABI compliance for log4cxx lately(LOGCXX-516),
> and I'm running across a few classes that have to do with sending log
> messages as Java serialized messages. Since we've removed the ability
> to receive these messages through Chainsaw, and due to Java's known
> security issues with object deserialization, is there any reason in
> keeping this feature around?
I have the feeling that textual based log messages are preferred in
most cases and formats like JSON(/XML) seem more interoparable and
accepted these days. So if it makes anything easier, I vote for
removing as well.
Mit freundlichen Grüßen
Thorsten Schöning
--
AM-SoFT IT-Service - Bitstore Hameln GmbH
Mitglied der Bitstore Gruppe - Ihr Full-Service-Dienstleister für IT und TK
E-Mail: Thorsten.Schoening@AM-SoFT.de
Web: http://www.AM-SoFT.de/
Tel: 05151- 9468- 0
Tel: 05151- 9468-55
Fax: 05151- 9468-88
Mobil: 0178-8 9468-04
AM-SoFT IT-Service - Bitstore Hameln GmbH, Brandenburger Str. 7c, 31789 Hameln
AG Hannover HRB 221853 - Geschäftsführer: Janine Galonska
Re: [log4cxx] Removal of log4j serialization?
Posted by Volkan Yazıcı <vo...@yazi.ci>.
I have never used either Chainsaw or anything to do with Java serialization
of Log4j events. This said, you have my full support of ditching that
feature off from log4cxx – preferably in the next major release? Java
serialization, putting aside its good intentions, has been a generous
source of many security vulnerabilities.
On Sat, Sep 25, 2021 at 3:49 AM Robert Middleton <rm...@apache.org>
wrote:
> I've been working on ABI compliance for log4cxx lately(LOGCXX-516),
> and I'm running across a few classes that have to do with sending log
> messages as Java serialized messages. Since we've removed the ability
> to receive these messages through Chainsaw, and due to Java's known
> security issues with object deserialization, is there any reason in
> keeping this feature around?
>
> Note: I'm currently imagining that this would be for the next major
> release of log4cxx, which I wouldn't expect for at least another year.
> Whenever that release is, I expect that the release would break a lot
> of code, so removing the serialization at that time makes the most
> sense to me.
>
> -Robert Middleton
>