Thread by @ErrataRob

So many misconceptions in this story:
1. log4j wasn't a software development issue
2. CEOs aren't going to help you solve the problem
3. the problem doesn't need government help
cnn.com/2021/12/23/pol…

The log4j vulnerability wasn't an accidental bug, but a deliberate feature. Trying to apply heavy-weight secure software development practices would require 10x as many engineers and still would let problems like this slip through.

It's not "process" but "clue" that was missing. You could bring your engineers together for weeks of "threat modeling", but unless an engineer had a clue about how injection vulnerabilities work, or how JNDI works, you aren't going to get anywhere.

Secure software development is like "Agile": it works if you've got skilled talent, but 90% of the time you don't, so people are wasting a lot of time going through the motions pretending they are doing it without getting the benefits.

Now let's talk CEOs: they are useless. Their sole job is to further the interests of their company. When you bring them together in order to ask what to do about the log4j, each CEO is trying to exploit the situation to the advantage of their company.

No, they aren't bad people. It's the same reason you don't put your lovely fluffy cat inside the bird cage. It's simply about recognizing their nature.

Whenever there is a major cyber event, the government tries to help. But most of these things resolve themselves on their own. We haven't seen a repeat of Mirai, for example.

Essentially, log4j met those security standards. Such executive orders raise the price of products while doing little to solve the problem. Such standards mean the government makes itself worse of a threat than the hackers, comply or else!