4 ms·

"PayPal really doesn't care that the world's most popular browser no longer displays the EV visual indicator." OT but hopefully interesting: Paypal doesn't car

"PayPal really doesn't care that the world's most popular browser no longer displays the EV visual indicator." OT but hopefully interesting: Paypal doesn't care about many things. Like keeping their callback JVMs up2date, or changing their UAs from defaults to disguise their enabling tech. 2019.05.20 xxxx|173.0.81.33|xxxx|POST xxxx/paypal/callback HTTP/1.1|200|954|-|Java/1.8.0_60|xxx|xxxxxxx 2

nikanj 7y ago
I'm really happy that Paypal ops is not upgrading anything just for the sake of upgrading it. At that scale, changes should be approached with extreme caution.
- jmgrosen 7y ago
  Well, perhaps they should upgrade it for the sake of the ~170 CVEs that have been published against Java 1.8.0_60? https://www.cvedetails.com/vulnerability-list.php?vendor_id=93&product_id=19116&version_id=&page=4&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=597&sha=52d5e2189c154fbfa1e3d4ba0a13fc6b00642bc4 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... Sure, a lot of those probably don't apply to how they're using Java, but I'd bet at least a couple do.
  - sroussey 7y ago
    Vendors often backport CVEs without changing version numbers.
    - viraptor 7y ago
      Or review the details and decide that the specific issue doesn't apply to them. This actually makes sense in larger environments.
- Rebelgecko 7y ago
  They're missing out on probably dozens of security fixes from the past 4 years. Unless they depend on buggy behavior, it is incredibly unlikely that they'll have any backwards compatibility issues, and hopefully they would have tests they could run against a newer JVM to help surface those issues.
- yjftsjthsd-h 7y ago
  > changes should be approached with extreme caution. It's good to make updates carefully, with full testing and a rollback plan. It is also important to actually push updates.
draw_down 7y ago
The point is not about PayPal, really. The point is demonstrating that people don't care about the EV certificate not being present when they use PayPal to pay for things. Payments is presumably an area where people would most care about security.
pp_rglastra 7y ago
Hi! We have two callback options - for 'Classic' and REST. I checked both of them and they both return the proper UA. Can you let me know if this is Webhooks or IPN and if you saw this in production or sandbox? Thanks!
- geekpowa 7y ago
  'Classic' NVP and this is in production right now.
  - pp_rglastra 7y ago
    Gotcha. I'll check it out - in my tests that's returning "PayPal IPN ( https://www.paypal.com/ipn)" https://www.paypal.com/ipn)". Thanks for getting back to me.

nikanj 7y ago

I'm really happy that Paypal ops is not upgrading anything just for the sake of upgrading it. At that scale, changes should be approached with extreme caution.

jmgrosen 7y ago
Well, perhaps they should upgrade it for the sake of the ~170 CVEs that have been published against Java 1.8.0_60? https://www.cvedetails.com/vulnerability-list.php?vendor_id=93&product_id=19116&version_id=&page=4&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=597&sha=52d5e2189c154fbfa1e3d4ba0a13fc6b00642bc4 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... Sure, a lot of those probably don't apply to how they're using Java, but I'd bet at least a couple do.
- sroussey 7y ago
  Vendors often backport CVEs without changing version numbers.
  - viraptor 7y ago
    Or review the details and decide that the specific issue doesn't apply to them. This actually makes sense in larger environments.
Rebelgecko 7y ago
They're missing out on probably dozens of security fixes from the past 4 years. Unless they depend on buggy behavior, it is incredibly unlikely that they'll have any backwards compatibility issues, and hopefully they would have tests they could run against a newer JVM to help surface those issues.
yjftsjthsd-h 7y ago
> changes should be approached with extreme caution. It's good to make updates carefully, with full testing and a rollback plan. It is also important to actually push updates.

draw_down 7y ago

The point is not about PayPal, really. The point is demonstrating that people don't care about the EV certificate not being present when they use PayPal to pay for things. Payments is presumably an area where people would most care about security.

pp_rglastra 7y ago

Hi! We have two callback options - for 'Classic' and REST. I checked both of them and they both return the proper UA. Can you let me know if this is Webhooks or IPN and if you saw this in production or sandbox? Thanks!

geekpowa 7y ago
'Classic' NVP and this is in production right now.
- pp_rglastra 7y ago
  Gotcha. I'll check it out - in my tests that's returning "PayPal IPN ( https://www.paypal.com/ipn)" https://www.paypal.com/ipn)". Thanks for getting back to me.