I don't understand how people today would use a library as large as log4j and not hassle taking a look at what is while in the box, and whatever they need to allow/disable. Blaming it over the opensource merchandise seems Odd any time you grabbed it free of charge and https://prohactive.com