#log4shell — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #log4shell, aggregated by home.social.
-
You trust your dependencies? That’s the risk. From #Log4Shell to self-replicating worms, attacks don’t hit your code first — they hit your supply chain, often via packages.
@MohammadAliEN explains what to watch: https://javapro.io/2026/04/23/the-whispering-jar-java-security-lessons-hidden-in-a-fantasy-tale/
-
You trust your dependencies? That’s the risk. From #Log4Shell to self-replicating worms, attacks don’t hit your code first — they hit your supply chain, often via packages.
@MohammadAliEN explains what to watch: https://javapro.io/2026/04/23/the-whispering-jar-java-security-lessons-hidden-in-a-fantasy-tale/
-
Viele Java-Teams wissen nicht, welche Libraries wirklich produktiv laufen — bis die nächste #Log4Shell auftaucht. #SBOMs schaffen Transparenz über Abhängigkeiten & Risiken.
Sven Ruppert zeigt die Praxis:
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-1/
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-2/ -
Viele Java-Teams wissen nicht, welche Libraries wirklich produktiv laufen — bis die nächste #Log4Shell auftaucht. #SBOMs schaffen Transparenz über Abhängigkeiten & Risiken.
Sven Ruppert zeigt die Praxis:
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-1/
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-2/ -
FYI: Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
FYI: Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
Viele Java-Teams wissen nicht, welche Libraries wirklich produktiv laufen — bis die nächste #Log4Shell auftaucht. #SBOMs schaffen Transparenz über Abhängigkeiten & Risiken.
Sven Ruppert zeigt die Praxis:
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-1/
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-2/ -
Viele Java-Teams wissen nicht, welche Libraries wirklich produktiv laufen — bis die nächste #Log4Shell auftaucht. #SBOMs schaffen Transparenz über Abhängigkeiten & Risiken.
Sven Ruppert zeigt die Praxis:
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-1/
https://javapro.io/de/sbom-fuer-java-entwickler-was-bringt-mir-das-im-alltag-wirklich-teil-2/ -
ICYMI: Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
ICYMI: Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
You trust your dependencies? That’s the risk. From #Log4Shell to self-replicating worms, attacks don’t hit your code first — they hit your supply chain, often via packages.
@MohammadAliEN explains what to watch: https://javapro.io/2026/04/23/the-whispering-jar-java-security-lessons-hidden-in-a-fantasy-tale/
-
You trust your dependencies? That’s the risk. From #Log4Shell to self-replicating worms, attacks don’t hit your code first — they hit your supply chain, often via packages.
@MohammadAliEN explains what to watch: https://javapro.io/2026/04/23/the-whispering-jar-java-security-lessons-hidden-in-a-fantasy-tale/
-
If your #Java stack relies on “upstream will fix it”, you already lost time. @spoole167 shows how real-world Java systems survive on unmaintained code — and what to do instead.
Learn from the #SupplyChain reality: https://javapro.io/2026/01/08/the-myth-of-stability-javas-software-supply-chain-after-log4shell/
-
If your #Java stack relies on “upstream will fix it”, you already lost time. @spoole167 shows how real-world Java systems survive on unmaintained code — and what to do instead.
Learn from the #SupplyChain reality: https://javapro.io/2026/01/08/the-myth-of-stability-javas-software-supply-chain-after-log4shell/
-
Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
FYI: Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
FYI: Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
Log4Shell
TIL about the breakdown of the Log4Shell shared library.
- Date of occurence
- 24 November 2K21
- location of programmer at home with his son logging into minecraft (which failed)
- this vulnerability had existed unnoticed since 2013
- it was privately disclosed to the Apache Software Foundation { Log4j is a project}
- discloser: Chen Zhaojun of Alibaba Cloud's infosec team
- date 24 November 2021
- exploit severety MAXIMUM
- It's simple to execute
- estimation of affect ration of 50% of the internet (many hundreds of millions of devices)
- vulnerability abuses Log4j allowing requests to arbitrary LDAP and JNDI servers
- that allows attackers to
- execute arbitrary Java code on server / client
- leak sensitive data
Innerworkings
- Log4j
- open-source logging framework
- enables programmers to log data within their applications
- can include user input
- is used ubiquitously in Java programs especially enterprise software
- Originally written in 2001 by Ceki Gülcü
- part of Apache Logging Services
- project of the Apache Software Foundation
Tom Kellermann, a member of President Obama's Commission on Cyber Security
- Apache is "one of the giant supports of a bridge which facilitates the connective tissue between the worlds of applications and computer environments
Affected commercial services
- Amazon Web Services {AWS}
- Cloudflare
- iCloud {Apple infrastructure}
- Minecraft: {Java}
- Steam {multi platform gaming}
- Tencent QQ### Wiz and EY sate that the vulnerability affected 93% of enterprise cloud environments
The Log4Shell vulnerability's disclosure received strong reactions from cybersecurity experts.
Cybersecurity company Tenable stated
- exploit is "the single biggest, most critical vulnerability ever## Ars Technica
- arguably the most severe vulnerability ever
Quote
Log4j is foundational software. This 20+ year-old Java logging library quietly powers system events in applications worldwide, like user logins and calculation results. But this small piece of software had quietly become a dependency in thousands of projects across the Java ecosystem.Opinion & reaction
- I'm blown away by the events leading to the tornadoes & typhoons that followed shortly after in the OpenSource programming World
- Fifty percent of software was affected with 93% of enterprise software sub section
- Log4Shell is a critical infrastructure level shared library
- nearly everyone using java depends on it's functional I/O
Analysis
- why do most Open Source software users only contact programmers when bugs are detected?
- why do they (almost) never get compliments when it goes well?
- programmers burn out after a while and leave projects abandoned
- when you were a kid, your mom / dad / family complimented you on good results
- programmers need the same
- otherwise they will leave the projects
Open Source programming is a thankless job
- Zero cash influx
- no thank you's
- complaints even when software has long matured to stable levels
- entitled users
- threats to be Doxxed or worse
Be nice to Open Source programmers
- If you have following contact here on the Fediverse with one say thank you
- don't expect replies (esp when hundreds to thousands of followers are indicated)
- realize you either can't code programs of that caliber or don't want to invest the time
- I am lucky to have conversational contact ont the FediVerse with critical infrastructure programmers
- I always say thank you, because I know how hard it is to write software of that magnitude
- when I review their software, I am critical, but formulate my words and sentences in a manner I would want to read them if places were switched
- I am thankful first, thus send them Universal Love and Universal Energy
- My toot history stand for these statements (on my other Fediverse accounts)
Don't be a dick!
Be nice to programmers
Give them Love
Z
#Log4Shell #TIL #programming #data #Java #exploit #ZeroDay #technology #Enterprise #networking #OpenSource #POSIX #BSD #freeBSD #ghostBSD #openBSD #Linux #win64 #mac #history #reading
Sources:
-
Log4Shell
TIL about the breakdown of the Log4Shell shared library.
- Date of occurence
- 24 November 2K21
- location of programmer at home with his son logging into minecraft (which failed)
- this vulnerability had existed unnoticed since 2013
- it was privately disclosed to the Apache Software Foundation { Log4j is a project}
- discloser: Chen Zhaojun of Alibaba Cloud's infosec team
- date 24 November 2021
- exploit severety MAXIMUM
- It's simple to execute
- estimation of affect ration of 50% of the internet (many hundreds of millions of devices)
- vulnerability abuses Log4j allowing requests to arbitrary LDAP and JNDI servers
- that allows attackers to
- execute arbitrary Java code on server / client
- leak sensitive data
Innerworkings
- Log4j
- open-source logging framework
- enables programmers to log data within their applications
- can include user input
- is used ubiquitously in Java programs especially enterprise software
- Originally written in 2001 by Ceki Gülcü
- part of Apache Logging Services
- project of the Apache Software Foundation
Tom Kellermann, a member of President Obama's Commission on Cyber Security
- Apache is "one of the giant supports of a bridge which facilitates the connective tissue between the worlds of applications and computer environments
Affected commercial services
- Amazon Web Services {AWS}
- Cloudflare
- iCloud {Apple infrastructure}
- Minecraft: {Java}
- Steam {multi platform gaming}
- Tencent QQ### Wiz and EY sate that the vulnerability affected 93% of enterprise cloud environments
The Log4Shell vulnerability's disclosure received strong reactions from cybersecurity experts.
Cybersecurity company Tenable stated
- exploit is "the single biggest, most critical vulnerability ever## Ars Technica
- arguably the most severe vulnerability ever
Quote
Log4j is foundational software. This 20+ year-old Java logging library quietly powers system events in applications worldwide, like user logins and calculation results. But this small piece of software had quietly become a dependency in thousands of projects across the Java ecosystem.Opinion & reaction
- I'm blown away by the events leading to the tornadoes & typhoons that followed shortly after in the OpenSource programming World
- Fifty percent of software was affected with 93% of enterprise software sub section
- Log4Shell is a critical infrastructure level shared library
- nearly everyone using java depends on it's functional I/O
Analysis
- why do most Open Source software users only contact programmers when bugs are detected?
- why do they (almost) never get compliments when it goes well?
- programmers burn out after a while and leave projects abandoned
- when you were a kid, your mom / dad / family complimented you on good results
- programmers need the same
- otherwise they will leave the projects
Open Source programming is a thankless job
- Zero cash influx
- no thank you's
- complaints even when software has long matured to stable levels
- entitled users
- threats to be Doxxed or worse
Be nice to Open Source programmers
- If you have following contact here on the Fediverse with one say thank you
- don't expect replies (esp when hundreds to thousands of followers are indicated)
- realize you either can't code programs of that caliber or don't want to invest the time
- I am lucky to have conversational contact ont the FediVerse with critical infrastructure programmers
- I always say thank you, because I know how hard it is to write software of that magnitude
- when I review their software, I am critical, but formulate my words and sentences in a manner I would want to read them if places were switched
- I am thankful first, thus send them Universal Love and Universal Energy
- My toot history stand for these statements (on my other Fediverse accounts)
Don't be a dick!
Be nice to programmers
Give them Love
Z
#Log4Shell #TIL #programming #data #Java #exploit #ZeroDay #technology #Enterprise #networking #OpenSource #POSIX #BSD #freeBSD #ghostBSD #openBSD #Linux #win64 #mac #history #reading
Sources:
-
#Log4Shell didn’t break #Java — it revealed it. @spoole167 shows how decades of “it still works” thinking left the Java #SupplyChain exposed & why maintenance is now a legal obligation.
See what regulators expect from Java teams: https://javapro.io/2026/01/08/the-myth-of-stability-javas-software-supply-chain-after-log4shell/
-
#Log4Shell didn’t break #Java — it revealed it. @spoole167 shows how decades of “it still works” thinking left the Java #SupplyChain exposed & why maintenance is now a legal obligation.
See what regulators expect from Java teams: https://javapro.io/2026/01/08/the-myth-of-stability-javas-software-supply-chain-after-log4shell/
-
🔍 CVE-2021-44228 (Log4Shell)
Three years later, Log4Shell is still being scanned for on the internet every single day.
Why?
Legacy Java apps
Forgotten containers
Vendors who never backported fixes👉 Breakdown & mitigation:
https://cvedatabase.com/cve/CVE-2021-44228
#CVE #Log4Shell #CyberSecurity -
ICYMI: Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
ICYMI: Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
Software Composition Analysis: Protecting Against Log4Shell #shorts: Discover how software composition analysis can help prevent Log4Shell-like attacks. Learn how it could've helped your organization avoid the scramble. #Log4Shell #SoftwareAnalysis #Cybersecurity #Vulnerability https://www.youtube.com/shorts/3g9H_Gitv-8
-
Who is responsible for your #Java dependencies when upstream disappears? @spoole167 traces how #Log4Shell exposed the reality of #OpenSource maintenance and why SBOMs, CRA & NIS2 changed the rules.
Learn what “responsibility” means now: https://javapro.io/2026/01/08/the-myth-of-stability-javas-software-supply-chain-after-log4shell/
-
Who is responsible for your #Java dependencies when upstream disappears? @spoole167 traces how #Log4Shell exposed the reality of #OpenSource maintenance and why SBOMs, CRA & NIS2 changed the rules.
Learn what “responsibility” means now: https://javapro.io/2026/01/08/the-myth-of-stability-javas-software-supply-chain-after-log4shell/
-
Still calling unmaintained #Java libraries “stable”? After #Log4Shell, that myth collapsed. @spoole167 explains why Java’s software #SupplyChain is fragile & why regulation now forces real accountability.
Understand what changed (and why it matters): https://javapro.io/2026/01/08/the-myth-of-stability-javas-software-supply-chain-after-log4shell/
-
Still calling unmaintained #Java libraries “stable”? After #Log4Shell, that myth collapsed. @spoole167 explains why Java’s software #SupplyChain is fragile & why regulation now forces real accountability.
Understand what changed (and why it matters): https://javapro.io/2026/01/08/the-myth-of-stability-javas-software-supply-chain-after-log4shell/
-
For my fellow Log4j victims celebrating 4 years #log4shell PTSD: CVE-2025-68161
"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName configuration attribute or the log4j2.sslVerifyHostName system property is set to true."
https://logging.apache.org/security.html#CVE-2025-68161
(It's not that terrible. Seeing the string "log4j" just makes me twitch. :-)
-
For my fellow Log4j victims celebrating 4 years #log4shell PTSD: CVE-2025-68161
"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName configuration attribute or the log4j2.sslVerifyHostName system property is set to true."
https://logging.apache.org/security.html#CVE-2025-68161
(It's not that terrible. Seeing the string "log4j" just makes me twitch. :-)
-
FYI: Log4Shell: 4 Years Later, Are You Still Vulnerable? #shorts: When the Log4Shell attack hit, teams scrambled. Older Log4j versions needed manual workarounds. What if a bot could try upgrades and run tests? Teams with test suites stay up-to-date, owning their security. #Log4Shell #security #cybersecurity #Dependabot #vulnerability https://www.youtube.com/shorts/IJs6EZgoogk
-
FYI: Log4Shell: 4 Years Later, Are You Still Vulnerable? #shorts: When the Log4Shell attack hit, teams scrambled. Older Log4j versions needed manual workarounds. What if a bot could try upgrades and run tests? Teams with test suites stay up-to-date, owning their security. #Log4Shell #security #cybersecurity #Dependabot #vulnerability https://www.youtube.com/shorts/IJs6EZgoogk
-
We haven't seen a CVSS 10.0 this scary since #Log4Shell. 🚨
So we launched the exploit and here is the proof. 👇👇👇Everyone talks about detecting #React2Shell (CVE-2025-55182). But detection can only take you so far.
To *truly* know if you are exposed to this CVSS 10.0 RCE, you need to validate it.
So we launched the exploit.
We updated our offensive security suite to safely execute the full attack chain against your infrastructure.
Here is how you validate your risk in seconds (see the evidence below 👇):
🚀 Validate directly with Sniper: Auto-Exploiter
Action: Launch Sniper: Auto-Exploiter on the target.
Result: The smoking gun. It executes the payload and confirms RCE.
Proof: As you can see from the report highlights, it achieves code execution as user Next.js and captures full command history.
This isn't a simulation. It's a confirmed RCE path on a Linux target running Next.js.
Why this matters: Standard scanners might flag your safe apps as vulnerable (FPs) or miss modified instances (false negatives). Validation removes the doubt.
Don't guess. Exploit it (safely) before they do.
Run the validation now https://pentest-tools.com/exploit-helpers/sniper
-
We haven't seen a CVSS 10.0 this scary since #Log4Shell. 🚨
So we launched the exploit and here is the proof. 👇👇👇Everyone talks about detecting #React2Shell (CVE-2025-55182). But detection can only take you so far.
To *truly* know if you are exposed to this CVSS 10.0 RCE, you need to validate it.
So we launched the exploit.
We updated our offensive security suite to safely execute the full attack chain against your infrastructure.
Here is how you validate your risk in seconds (see the evidence below 👇):
🚀 Validate directly with Sniper: Auto-Exploiter
Action: Launch Sniper: Auto-Exploiter on the target.
Result: The smoking gun. It executes the payload and confirms RCE.
Proof: As you can see from the report highlights, it achieves code execution as user Next.js and captures full command history.
This isn't a simulation. It's a confirmed RCE path on a Linux target running Next.js.
Why this matters: Standard scanners might flag your safe apps as vulnerable (FPs) or miss modified instances (false negatives). Validation removes the doubt.
Don't guess. Exploit it (safely) before they do.
Run the validation now https://pentest-tools.com/exploit-helpers/sniper
-
ICYMI: Log4Shell: 4 Years Later, Are You Still Vulnerable? #shorts: When the Log4Shell attack hit, teams scrambled. Older Log4j versions needed manual workarounds. What if a bot could try upgrades and run tests? Teams with test suites stay up-to-date, owning their security. #Log4Shell #security #cybersecurity #Dependabot #vulnerability https://www.youtube.com/shorts/IJs6EZgoogk
-
ICYMI: Log4Shell: 4 Years Later, Are You Still Vulnerable? #shorts: When the Log4Shell attack hit, teams scrambled. Older Log4j versions needed manual workarounds. What if a bot could try upgrades and run tests? Teams with test suites stay up-to-date, owning their security. #Log4Shell #security #cybersecurity #Dependabot #vulnerability https://www.youtube.com/shorts/IJs6EZgoogk
-
Log4Shell: 4 Years Later, Are You Still Vulnerable? #shorts: When the Log4Shell attack hit, teams scrambled. Older Log4j versions needed manual workarounds. What if a bot could try upgrades and run tests? Teams with test suites stay up-to-date, owning their security. #Log4Shell #security #cybersecurity #Dependabot #vulnerability https://www.youtube.com/shorts/IJs6EZgoogk
-
Log4Shell: 4 Years Later, Are You Still Vulnerable? #shorts: When the Log4Shell attack hit, teams scrambled. Older Log4j versions needed manual workarounds. What if a bot could try upgrades and run tests? Teams with test suites stay up-to-date, owning their security. #Log4Shell #security #cybersecurity #Dependabot #vulnerability https://www.youtube.com/shorts/IJs6EZgoogk
-
What is this? 2021?
-
What is this? 2021?
-
I never imagined GitHub would ask me to speak about Log4Shell.
But it happened.GitHub asked me to share the story as I lived it, for the benefit of all maintainers and users of open source. How could I say no?
I hope it helps build a more secure future.
No more Log4Shell.
#opensource #log4j #Log4Shell #programming #security #hacking #Github
-
I never imagined GitHub would ask me to speak about Log4Shell.
But it happened.GitHub asked me to share the story as I lived it, for the benefit of all maintainers and users of open source. How could I say no?
I hope it helps build a more secure future.
No more Log4Shell.
#opensource #log4j #Log4Shell #programming #security #hacking #Github
-
JUnit 6 broke 50 repos. I’m delighted.
If a dependency bump can shatter your stack, you don't need fewer updates. You need better tests.
I maintain 50+ OSS repos as one human. I don't babysit them. I automated everything, including updates and minor releases. Many repos haven't been touched in 6 years. AS now JUnit 6 rolled in, a chunk failed. Perfect.
Why perfect? Because failure is a signal, not a disaster. Good tests mean breakage never escapes. I've had repos fail on a Java date parser change. Beautiful. I saw it before release, fixed it, moved on. During Log4Shell and Spring4Shell I didn't panic. I just waited for the next update. That's what behaviour tests are for. And no, they are not slow. If your tests crawl, your design does too.
I trust code I write. I do not trust magic. I remove convenience glue that silently rots:
I don't need MultiValueMap when Map<List> is clearer.
I don't need StringUtils.isEmpty when a simple null or empty check is obvious.
I don't need annotations that smuggle in half a framework.Every extra library is a future liability: CVEs, Licences, Security, Data Privacy, Performance, breaking changes, mental overhead. Use them to start, then delete them to last. Fewer moving parts mean fewer ways to die.
After 6 years my micro systems still boot in micro seconds, still read clean, still behave. CI pipelines aged, sure, but the code stayed boring. Boring is freedom. Quiet, peaceful, done.
If your stack cannot auto-update without heart palpitations, the problem isn't updates. It's architecture.
Principles I ship by
Automate updates and everything else I can. Let tests be the gate, not fear.
Push behaviour tests to the edges. If it's slow, refactor until it isn't.
Prefer primitives and standard libs. Delete decorative wrappers.
Design for micro systems, not micro monoliths. Start fast, stay fast.
Fewer tools, fewer surprises, fewer nights on fire.Congratulations. The system failed safely. After fix, you may proceed to do literally anything else with your life.
#java #junit #testing #oss #automation #developerexperience #simplicity #minimalism #microservices #security #log4shell #spring4shell #cleanarchitecture
-
JUnit 6 broke 50 repos. I’m delighted.
If a dependency bump can shatter your stack, you don't need fewer updates. You need better tests.
I maintain 50+ OSS repos as one human. I don't babysit them. I automated everything, including updates and minor releases. Many repos haven't been touched in 6 years. AS now JUnit 6 rolled in, a chunk failed. Perfect.
Why perfect? Because failure is a signal, not a disaster. Good tests mean breakage never escapes. I've had repos fail on a Java date parser change. Beautiful. I saw it before release, fixed it, moved on. During Log4Shell and Spring4Shell I didn't panic. I just waited for the next update. That's what behaviour tests are for. And no, they are not slow. If your tests crawl, your design does too.
I trust code I write. I do not trust magic. I remove convenience glue that silently rots:
I don't need MultiValueMap when Map<List> is clearer.
I don't need StringUtils.isEmpty when a simple null or empty check is obvious.
I don't need annotations that smuggle in half a framework.Every extra library is a future liability: CVEs, Licences, Security, Data Privacy, Performance, breaking changes, mental overhead. Use them to start, then delete them to last. Fewer moving parts mean fewer ways to die.
After 6 years my micro systems still boot in micro seconds, still read clean, still behave. CI pipelines aged, sure, but the code stayed boring. Boring is freedom. Quiet, peaceful, done.
If your stack cannot auto-update without heart palpitations, the problem isn't updates. It's architecture.
Principles I ship by
Automate updates and everything else I can. Let tests be the gate, not fear.
Push behaviour tests to the edges. If it's slow, refactor until it isn't.
Prefer primitives and standard libs. Delete decorative wrappers.
Design for micro systems, not micro monoliths. Start fast, stay fast.
Fewer tools, fewer surprises, fewer nights on fire.Congratulations. The system failed safely. After fix, you may proceed to do literally anything else with your life.
#java #junit #testing #oss #automation #developerexperience #simplicity #minimalism #microservices #security #log4shell #spring4shell #cleanarchitecture
-
#Log4j could have failed many times. But it survived. Not because of money, but because of people. An honest look behind the scenes — from the first line of code to the project’s greatest crisis.
Read Christian Grobmeier’s new piece: https://javapro.io/2025/06/10/the-long-history-of-log4j/
-
#Log4j could have failed many times. But it survived. Not because of money, but because of people. An honest look behind the scenes — from the first line of code to the project’s greatest crisis.
Read Christian Grobmeier’s new piece: https://javapro.io/2025/06/10/the-long-history-of-log4j/
-
After #Log4Shell hit, I dreamed of writing a Java Logging book.
Beginner-friendly and full of what I’ve learned as a trainer.Today, that dream became real.
@ManningPublications just launched my book in their MEAP program, and I’m incredibly proud and grateful.After all these years at the ASF, it feels like a circle has closed.
Get it 50% off:
-
After #Log4Shell hit, I dreamed of writing a Java Logging book.
Beginner-friendly and full of what I’ve learned as a trainer.Today, that dream became real.
@ManningPublications just launched my book in their MEAP program, and I’m incredibly proud and grateful.After all these years at the ASF, it feels like a circle has closed.
Get it 50% off:
-
„Was, wenn wir im Urlaub gewesen wären?“ #Log4Shell traf 2021 Millionen Systeme – ein paar Freiwillige retteten das Netz. Christian Grobmeiers Rückblick auf 30 Jahre #Log4j zeigt, was #OpenSource leisten kann & dessen Grenzen, wenn Firmen nur konsumieren!
-
„Was, wenn wir im Urlaub gewesen wären?“ #Log4Shell traf 2021 Millionen Systeme – ein paar Freiwillige retteten das Netz. Christian Grobmeiers Rückblick auf 30 Jahre #Log4j zeigt, was #OpenSource leisten kann & dessen Grenzen, wenn Firmen nur konsumieren!