Re: Log4j 1.x compatibility

2021-12-16 Thread Leo Simons
Hey Gary, Thanks for your thoughts. TL;DR: I actually share your preference! But: how? Also, progress notes. In a "normal" situation I really think that the 99% drop in replacement that is already there is plenty. Especially from an ASF perspective where our primary deliverable is source code to

Re: Log4j 1.x compatibility

2021-12-16 Thread Vladimir Sitnikov
Migrating via compatibility layers is way harder for consumers, and it does not sound like a proper plan for fixing RCE. The scope of regression testing from 1.x to 2.x+compatibility would be much more for the consumers than the scope of 1.2.17 -> 1.2.18, so it would be way harder for them to test

Log4j 1.x compatibility

2021-12-16 Thread Gary Gregory
Hi all, [Reposting in a new thread] Log4j 2 provides a compatibility layer for the 1.2 API and for some configuration files. It is not a 100% drop in replacement, but it could be made much better with some work. So, I would prefer that brain power for 1.x be applied in this direction, instead of