#supply-chain
grep -l "supply-chain" /portfolio/* · 2 entriesLog4Shell: finding every Java app we ran
The patch was the easy part. The hard part of Log4Shell was finding every place log4j-core existed, including inside jars inside jars.
1 min readThe day a dependency disappeared from the registry
What I took from left-pad: an eleven-line package was unpublished, builds broke everywhere, and a private mirror would have made it a non-event.
1 min read