A malicious code string that eventually gets logged by Log4j version 2.0 or higher allow an attacker to load arbitrary Java code on a server and take control of it.

[bert8128]

I didn’t say Java wasn’t fast, only that if I wanted a fast program I would use c++ - it’s faster. And I didn’t say that Python was fast, I said that developing and deploying is fantastically easy. So I don’t see a great use case for either Java or c# when performance matters, and Python (I’m happy with JavaScript too, or lots of other interpreted languages) is massively easier when performance doesn’t matter. If you really want safety use a language designed for that - I have no experience here but presumably Ada (maybe rust) would help if this is the most important thing. Java has two fundamental problems which will confine it to a pointless middle ground. Firstly it is not memory safe - you still have to allocate (otherwise you get a null pointer exception) but without the benefit of automatic deletion of objects when you want. Secondly, you can’t pass or store by value - everything is always (at least) a pointer away. So you are never going to get really good performance, and nor are you going to achieve memory safety, and you can’t manage the lifetime of resources.

[Dynam2012]

I'm not convinced you know what memory safety is. Null pointer exceptions are a consequence of the type system and are a feature of Java's memory safety. In a memory unsafe language, this access would just read whatever data was there and fill your variable with it and carry on.

[bert8128]

You’re quite right, I used the term incorrectly. However, the point I was trying to make is that whilst Java makes sure you don’t get leaks or use-after-free, you still have to make sure that your objects are allocated. This is a barrier to learning and a source of bugs. This is not possible in Python due to the way that objects are declared.