Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Matt Sicker
I think it would be great to hear what the expected changes are to be made here. It still seems like a huge amount of work that nobody cared about until we published a CVE for v2 which was only applicable to v2 (something I tend not to see in smaller projects who rarely if ever bother filing CVEs w

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Christian Grobmeier
Hi On Thu, Jan 6, 2022, at 15:05, Ceki Gülcü wrote: > On 06/01/2022 14:42, Christian Grobmeier wrote: >> Which ones? The JMSAppender issue or the SockerServer issue? Both have been >> there >2012. What is suddenly so critical it requires re-releasing EOL >> software? Or did you mean the multith

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Ceki Gülcü
On 06/01/2022 15:17, Ralph Goers wrote: Our repos aren’t open to any ASF committer, only Logging Services committers. We have very few committers who are also not PMC members. So you would likely be the only person with commit rights who might be interested in doing the work required to do

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Ralph Goers
> On Jan 6, 2022, at 7:05 AM, Ceki Gülcü wrote: > > > > On 06/01/2022 14:42, Christian Grobmeier wrote: >> Which ones? The JMSAppender issue or the SockerServer issue? Both have been >> there >2012. What is suddenly so critical it requires re-releasing EOL >> software? Or did you mean the

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Ceki Gülcü
On 06/01/2022 14:42, Christian Grobmeier wrote: Which ones? The JMSAppender issue or the SockerServer issue? Both have been there >2012. What is suddenly so critical it requires re-releasing EOL software? Or did you mean the multithreading issues? Certain things have changed during the mo

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Ralph Goers
Ceki, Thank you for posting this. Your input here is always welcome so far as I am concerned. This is a much better place to hold discussions than Twitter. See below. > On Jan 6, 2022, at 3:00 AM, Ceki Gülcü wrote: > > > Dear Ron, > > Thank you for this detailed and very well crafted messa

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Christian Grobmeier
Hello Ceki On Thu, Jan 6, 2022, at 11:00, Ceki Gülcü wrote: > The fact that the decision was unanimous on such a delicate matter is > quite surprising and very interesting in itself with respect to group > dynamics. You haven't been at the meeting. That's why you don't know anything about this

Re: [ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-06 Thread Ceki Gülcü
Dear Ron, Thank you for this detailed and very well crafted message. I would like to make the following observations. The fact that the decision was unanimous on such a delicate matter is quite surprising and very interesting in itself with respect to group dynamics. Coming back to the i

[ANNOUNCE] Log4j 1 End-of-Life Statement

2022-01-05 Thread Ron Grabowski
Dear Log4j community, While working on the December 2021 Apache Log4j 2 releases the Apache Logging Services PMC received requests to reevaluate the 2015 End-of-Life (EOL) decision for Apache Log4j 1, which has seen its latest release in 2012. We have considered these requests and discussed vario