We don’t need everyone to upgrade log4j, just enough for herd immunity to takeover