What does log4j teach us about the software supply chain?
summary
Claims that Log4j acts as a real-world stress test of the software supply chain, validated by Sonatype's analysis of Maven Central download data. Uses dependency-update experiments and historical supply-chain reports to track adoption, finding 40–50% updated in 1–2 days then a long plateau as exemplar and laggard cohorts diverge. Shows measurement by download traces actually works to reveal propagation delays, and that fast-updating projects fix quickly while many linger for months.
AI-written summary · about
related talks
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target
31mOpen Source Supply Chain Threat Landscape - A Moving Target
37mIt’s Not Open Source, It’s You. Where Open Source Risk Comes From
36mBuilding a Trusted and Resilient Software Supply Chain
17mLog4j - A Placement Student's Baptism by Fire
40mWhat Log4j taught me
54mSupply Chain Sec /w Dependency Track