Miracle · November 24 2021

The Miracle of the Log4Shell Report

The wonder

On 24 November 2021 Chen Zhaojun of the Alibaba Cloud Security Team privately emailed the Apache Log4j maintainers to report that JNDI lookups in log messages allowed remote code execution. The private report gave the project's volunteers time to prepare a fix before the flaw became public in December. China's Ministry of Industry and Information Technology (MIIT) later suspended a partnership with Alibaba Cloud for not informing the government first.

The miracle worker

Chen Zhaojun and the Alibaba Cloud Security Team, with the volunteer maintainers of Apache Log4j who worked on the fix.

Thanksgiving

For an email sent to the right people before the whole world, and for the volunteers who spent the holidays fixing everyone's code, we give thanks. Amen.