Thinking about Log4J here. The vulnerability was with an obscure functionality that I’ve never seen used. Sometimes simpler is safer.

Of course, sometimes simpler is “I stored the passwords unhashed”, so you have to find the middle ground.

> overdesigned/overcomplicated because everybody wants the library to do everything for everybody.

Also a source of significant dependency churn even excluding security bugs.

Whereas with my own code I don't have to worry about scheduling work that's only arisen because somebody outside my organisation has decided to make a breaking change in a dependency. Paying that tax got old over a decade ago, and my patience with it now is close to zero.

100% our thinking too.

cough OpenSSL cough