<story><title>Third High Severity CVE in Log4j Is Published</title><url>https://logging.apache.org/log4j/2.x/security.html</url></story><parent_chain></parent_chain><comment><author>alanfranz</author><text>Thanks to all Log4j developers. As users of your free software since ~20 years, we&amp;#x27;re sure that, if this vuln disclosure had been better and there were no sign of widespread in-the-wild exploitation, you would have done a better job at patching it, and a single release would have been enough.&lt;p&gt;We won&amp;#x27;t hold a grudge against you; open source means collaboration, and you don&amp;#x27;t blame hard-working people that give away their software for free for honest mistakes. Your software still did far more good than bad to the software world.&lt;p&gt;Thanks!</text></comment>
<story><title>Third High Severity CVE in Log4j Is Published</title><url>https://logging.apache.org/log4j/2.x/security.html</url></story><parent_chain></parent_chain><comment><author>Kreotiko</author><text>If information security people would spend the same amount of time they are spending complaining about this vulnerability trying to educate their organisations on the importance of supporting open source solutions they depend on we wouldn’t be in this situation.
 I am sick of reading of very senior people complaining about the impact this vulnerability has had on their week when their companies don’t even contribute a penny to open source projects.</text></comment>