35% of Log4j downloads are grabbing the vulnerable version (opens in new tab)

(writing.gonze.com)

19 pointslucasgonze4y ago4 comments

4 comments

4 comments · 1 top-level

jimmySixDOF4y ago· 3 in thread

Begging the question of why the vulnerable version is still available to be grabbed in the first place?

Deleting them would break builds ;)

this, companies who are hosting known vulnerable libraries should be charged criminally imo

That's one of the open questions. YES. Absolutely.

j / k navigate · click thread line to collapse