TIL #Log4j depends on some Java SE modules that IMO shouldn't.
- java.desktop
- java.management
IMO, all logging frameworks (core functionalities) should depend only on java.base and java.logging.
Anything else should be a separate extension/artifact.
#Java #OpenJDK
- java.desktop
- java.management
IMO, all logging frameworks (core functionalities) should depend only on java.base and java.logging.
Anything else should be a separate extension/artifact.
#Java #OpenJDK
While 'java.naming' is also a dependency, #Log4j works fine without it.
It won't operate at all if java.desktop and java.management are missing.
Removing 'java.naming' module from a jlinked runtime is the ultimate protection against JNDI attacks in Java.
It won't operate at all if java.desktop and java.management are missing.
Removing 'java.naming' module from a jlinked runtime is the ultimate protection against JNDI attacks in Java.
Of course, all this is understandable given these are logging frameworks that predate Java 9.
But as we think forward and evaluate new major versions and libraries, we should be mindful of using only what we need.
But as we think forward and evaluate new major versions and libraries, we should be mindful of using only what we need.
Feedback formally registered: issues.apache.org/jira/browse/LO…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
