Hello On Thu, Dec 23, 2021, at 18:07, Vladimir Sitnikov wrote: > Dominik> There are fixes for the flaws of log4j1 available: migrate to > log4j2 > > How does migration help me if I want to get 1.x fixed? > log4j2 is a different product, created by a different team. > Why should I migrate to log4j2 at all?
There is many reasons why we think log4j2 is better than log4j1 or forked products. To get the whole discussion, have a look at the mailing lists around 2014 or something. Different team - how does this affect the quality of a product? I remember the lengthy discussions about what is good and bad. I can tell that I feel that the original committers of log4j2 have spent many thoughts on how to improve things. Anyway, if you feel there is an urgent need to work on log4j1 then I think so be it. The ASF is meritocracy, when there are people around supporting code, this code can get released. Personally I don't see a reason to resurrect log4j1, but if you see a reason, go ahead. > Dominik>Is there a concrete need for log4j1 to be patched > > 1. I request to get log4j 1.x patched. I can't show my code as it is under > NDA, so you have to trust me here. Trust with what exactly? Sorry if I missed something. > 2. Enrico Olivelli: > https://lists.apache.org/thread/llgp7b9v1t081o3215o7xq4zpct1x0b4 > 3. 张铎(Duo Zhang): > https://lists.apache.org/thread/j8dzoymo5z26sl08o3mvdf0353shcl2m > 4. Andrew Purtell: > https://lists.apache.org/thread/kv71f8vrqrhn6tlotqg76gz6khjs11vh What I see here is basically the need to give better instructions on how to upgrade and improve the log4j1 bridge. Why not working on that but going through the pain of an incubator again? That said, I feel incubator is wrong, send in patches, become a committer here. > Do you know migration to 2.x is not a drop-in replacement? > It might require code or non-trivial configuration changes? > For instance, if the application extends 1.x appenders, implements > non-trivial re-configuration logic, > then it can't upgrade to 2.x in a matter of days or weeks. People had 7 years to do this. Any help for an upgrade from 1.x to 2.x is very welcome I think. Anyway, despite I am not a big fan of resurrecting a buggy old software if you send in patches there are people who would apply them. If we feel there is community building around log4j1 we never had a problem with voting in new committers, pmc members etc. You are welcome here, I am looking forward to patches and contributions to discuss. Cheers Christian > > Vladimir
