Hacker News Reader

Comment by geekpowa | Hacker News Reader

"PayPal really doesn't care that the world's most popular browser no longer displays the EV visual indicator."

OT but hopefully interesting: Paypal doesn't care about many things. Like keeping their callback JVMs up2date, or changing their UAs from defaults to disguise their enabling tech.

2019.05.20 xxxx|173.0.81.33|xxxx|POST xxxx/paypal/callback HTTP/1.1|200|954|-|Java/1.8.0_60|xxx|xxxxxxx 2

View on HN

Hi! We have two callback options - for 'Classic' and REST. I checked both of them and they both return the proper UA.

Can you let me know if this is Webhooks or IPN and if you saw this in production or sandbox?

Thanks!

'Classic' NVP and this is in production right now.

Gotcha. I'll check it out - in my tests that's returning "PayPal IPN ( https://www.paypal.com/ipn)". Thanks for getting back to me.

I'm really happy that Paypal ops is not upgrading anything just for the sake of upgrading it. At that scale, changes should be approached with extreme caution.

Well, perhaps they should upgrade it for the sake of the ~170 CVEs that have been published against Java 1.8.0_60? https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

Sure, a lot of those probably don't apply to how they're using Java, but I'd bet at least a couple do.

Vendors often backport CVEs without changing version numbers.

Or review the details and decide that the specific issue doesn't apply to them. This actually makes sense in larger environments.

They're missing out on probably dozens of security fixes from the past 4 years. Unless they depend on buggy behavior, it is incredibly unlikely that they'll have any backwards compatibility issues, and hopefully they would have tests they could run against a newer JVM to help surface those issues.

> changes should be approached with extreme caution.

It's good to make updates carefully, with full testing and a rollback plan. It is also important to actually push updates.

Reply on news.ycombinator.com