https://dirkriehle.com/2021/12/15/who-to-blame-for-the-log4j-vulnerability/