360° IT Check #25 — Log4j, Optimizing React, And More!
Table of Contents

360° IT Check #25 — Log4j, Optimizing React, And More!

Aleksander Jess
Senior Content Marketer & Technical Expert

Log4j Vulnerability

When your logging framework starts to execute arbitrary code, you know you’re in trouble.

Log4j, the popular Java framework, contained a vulnerability that compromised many apps you might have been using, including Twitter, iCloud, or Steam. The list is much shorter than it could have been. Log4j is likely present in “almost all” major Java-based enterprise apps, and servers. Not even the NSA was safe, as the popular GHIDRA, was vulnerable as a result as well.

According to GreyNoise, a company that analyzes “Internet background noise”, there are around 100 hosts actively scanning for servers with the aforementioned vulnerability.

To check whether your server got scanned, you may verify your visitors by checking this GitHub gist. These IPs, however, are IPs of Tor exit nodes; therefore it will be getting longer. 

Luckily, the way to patch the vulnerability is simple. As Cloudflare explained it:

1. Upgrade to Log4j v2.15.0

2. If you are using Log4j v2.10 or above, and cannot upgrade, then set the property:

log4j2.formatMsgNoLookups=true

Additionally, an environment variable can be set for these same affected versions:

LOG4J_FORMAT_MSG_NO_LOOKUPS=true

3. Or remove the JndiLookup class from the classpath. For example, you can run a command like

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
to remove the class from the log4j-core.

React’s Automatic Optimizations

React is a bit of a “you have to do everything yourself” UI library. Without explicit optimizations, such as memoization, it performs rather poorly, unnecessarily running a lot of code over, and over. Having to keep in mind this, and some other React-specific optimizations, can be a bit of a pickle.

Engineers at Meta seemed to have noticed that, and have showcased a tool to make React perform much better without all the mental overhead for developers. The solution is an automatic compiler, that performs memoization for you, automatically. For a demo, watch the video below.

Line’s Leak

If you ever push a commit with your private key to a public GitHub repository, believe it or not, this is not the worst thing that can happen. Line leaked payments data regarding 133,000 users to GitHub. The leaked data contained details of participants in a “LINE Pay” promotional program: date, time, and user IDs. Even though no cred card or bank account details saw the light of day, they could have been “traced with a little effort.”

The leak happened between September and November 2021; however, the news about it only surfaced last week. The company promised to do better in the future.

Tailwind CSS 3.0

Tailwind CSS, one of the web developers’ favorite tool for creating beautiful UI components, is getting a new major release. There are some improvements both making the developers’ lives easier, with some new features bringing new capabilities on board.

  • “Just-in-Time, all the time.” Faster build times, for the CSS framework. The JIT engine was optional until now, when it’s the only option available. It is also available as a script that one can get from the CDN, and run it in the browser
  • The introduction of the Scroll snap API
  • The styling of form elements without spending much time or effort
  • The introduction of RTL and LTR modifiers. Essential for complete control when building multi-directional websites.
  • “Touch-action” utilities for controlling how a user can zoom in, and scroll on devices with a touch screen

For the full list of features in the new release, take a look at the documentation.

Liked the article? subscribe to updates!
360° IT Check is a weekly publication where we bring you the latest and greatest in the world of tech. We cover topics like emerging technologies & frameworks, news about innovative startups, and other topics which affect the world of tech directly or indirectly.

Like what you’re reading? Make sure to subscribe to our weekly newsletter!
Categories:
Share

Join 17,850 tech enthusiasts for your weekly dose of tech news

By filling in the above fields and clicking “Subscribe”, you agree to the processing by ITMAGINATION of your personal data contained in the above form for the purposes of sending you messages in the form of newsletter subscription, in accordance with our Privacy Policy.
Thank you! Your submission has been received!
We will send you at most one email per week with our latest tech news and insights.

In the meantime, feel free to explore this page or our Resources page for eBooks, technical guides, GitHub Demos, and more!
Oops! Something went wrong while submitting the form.

Related articles

Our Partners & Certifications
Microsoft Gold Partner Certification 2021 for ITMAGINATION
AWS Partner Network ITMAGINATION
ISO 9001 ITMAGINATIONISO-IEC 27001:2013 ITMAGINATION
Great Place To Work
ITMAGINATION Winner Great Place To Work Best Workplaces Poland 2021
© 2022 ITMAGINATION. All Rights Reserved. Privacy Policy
// Opening all links in new tab // Syntax Highlighting Code