Home Depot successfully installs Tomcat 9 in production | Hacker News Reader

Home Depot successfully installs Tomcat 9 in production

pr-mstr-scm-vendor.homedepot.com

86 pointsvictor10636 comments

Funny or not, Home Depot should be lauded for their website, ecommerce, and inventory tracking. Lowe's is a complete joke in comparison.

And it's not just public facing stuff. Home Depot tells you exactly where something is. Lowes just tells you an amount that may or may not be right. Three times this year I've went in to buy something with '15 in stock', and apparently that's all employees see also. They all briefly look around, then say I don't know check the endcaps.

FWIW I've had similar frustrating experiences in both companies' stores. Could just be a matter of specific locations simply being run better than others.

They may be able to track their inventory, but they've also leaked 3 of my credit cards over the years, so it's not like they have reached the level of competency, they just know how many widgets they have.

Do you happen to know for sure that Home Depot was the actor that allowed the leak to occur, or a third party vendor (like their payments processor)?

I'm not insinuating that they aren't responsible either way. On the contrary - their internal stuff seems really good, so if it's a vendor issue, maybe the world needs a "Home Depot Payments".

Notice how well it handles the traffic - unlike some of the other submissions that makes the hn front page.

We should cheer on teams in big enterprise that are pushing to upgrade their tech stacks. I worked at a security company that pulled in security scanner data from enterprise companies and as you can guess the results are not great. Any upgrade is a positive step forward. Don't hate on them for being behind the curve. Things are different at that level of business.

Mildly humorous perhaps, but default website on some random subdomain is an entirely commonplace occurrence.. you’ll find tens of thousands of these— yes even at huge corps/enterprises..

Seems that they use Google Cloud Platform.

    pr-mstr-scm-vendor.homedepot.com. 3644 IN A 35.244.200.97

https://www.gstatic.com/ipranges/goog.json "35.240.0.0/13"

I wonder if "SCM" might stand for "supply chain management" here? A quick DDG search returned some relevant press:

- https://cloud.google.com/customers/the-home-depot/

- https://globalcloudplatforms.com/2021/12/18/the-sap-migratio...

- https://services.google.com/fh/files/misc/the_home_depot_sap...

Ooooh, so that's what's going on there.

I wanted to see evidence of the actual upgrade, so asked IA.

There are only two archives: https://web.archive.org/web/*/https://pr-mstr-scm-vendor.hom...

The second one is from today, presumably thanks to an automated HN crawler :)

The first one is from Sep 2019, and is a Google 404: https://web.archive.org/web/20190920171313/http://pr-mstr-sc...

Now I wonder where the URL came from if the page was a 404 at the time. (IA says it got crawled as part of the Alexa Crawls project.)

> Now I wonder where the URL came

I've had stuff like this crawled in the past because it was linked from internal (but not private) documentation, which in turn was indexed because of a link that found its way into a public page.

The Chat, Multiplayer Snake, and Multiplayer Drawing board examples for Tomcat WebSocket API are working. Is there someone out there who wants to play?

See: https://pr-mstr-scm-vendor.homedepot.com/examples/websocket/...

Lol that's a great find

Haha. Seems like there's a public server on the homedepot.com domain that hasn't had the default webapp removed.

Oops.

Given the hostname, looks like it is a staging server or infra server of some kind.

Incredibly funny. I actually think Home Depot, surprisingly, has increasingly good tech though.

I saw they paid for a booth at the Gophercon conference in San Diego a few years back, and their website + mobile app + online shipping setup is actually pretty great and reasonably priced. I didn't expect it to be. I use them for a lot of small+large tool/supply orders for gardening, woodworking, etc. now.

Dunno how that relates to stock value, but I've certainly thought twice that maybe I should buy some Home Depot stock because of this..

I heard that they’ve recently been transitioning from every store having its own local SQL Server database for inventory management to having a single database at HQ that all the stores use. Apparently it was quite arduous trying to sync all those store databases with a central one.

It’s been a long time since I’ve heard of Tomcat. Seems to have drastically fallen out of favor, much like Java itself for web hosting, but I’m guessing various bigcos still use it.

Tomcat is still very much alive, although it tends to be used as an embedded web server, rather than as a platform for deploying war files.

You have to use it sometimes for a lot of apache-ish apps like Gucamole.

Isn’t it still the weapon of choice for all those enterprisey Java apps, like Jenkins, Artifactory, and the Atlassian suite?

Very much correct. Java/tomcat is absolutely entrenched in the Enterprise and Telcos/ISPs..

Tomcat is a common embedded server for Spring Boot applications, and included in the default web stack from Spring Initialiser.

Vodaphone also: https://unlock.vodafone.com.au/index.jsp

And lots of other folks: https://www.google.com/search?q=intitle%3A%22apache+tomcat%2...

If you think this isn't scary enough, that thing most likely has access to a privileged network segment that the rest of the mobile network equipment is on and the software on those is no better.

*Runs away rapidly in slow motion, screaming*

Shodan's even better for that: https://www.shodan.io/search?query=tomcat

https://www.shodan.io/search?query=product%3A%22Apache+Tomca... if you have an account.

I know of a rather large bank who still use NT 4.0 in their contact centres.

I'd take NT 4.0 over Windows 11 any day.

Other Home Depot discussion this week

Home Depot finds DIY success with Vector Search

https://news.ycombinator.com/item?id=30698065

At least they're on a relatively updated version :)

https://tomcat.apache.org/whichversion.html

I wonder if Home Depot still rejects plus symbols in email addresses. Someone coded their email fields to only accept A-Z, 0-9, and a limited set of punctuation (. _ - @)

Looks like they use AEM for their website. I had the displeasure of working with it in the past.

Only two years out of date too!

Let's hope their log4j is a bit more up to date.

Now I'm playing snake on home depot's dime!

That’s great haha.

Reply on news.ycombinator.com