3 ms·

I'm really happy that Paypal ops is not upgrading anything just for the sake of upgrading it. At that scale, changes should be approached with extreme caution.

• jmgrosen 7y ago
  Well, perhaps they should upgrade it for the sake of the ~170 CVEs that have been published against Java 1.8.0_60? https://www.cvedetails.com/vulnerability-list.php?vendor_id=93&product_id=19116&version_id=&page=4&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=597&sha=52d5e2189c154fbfa1e3d4ba0a13fc6b00642bc4 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... Sure, a lot of those probably don't apply to how they're using Java, but I'd bet at least a couple do.
  • sroussey 7y ago
    Vendors often backport CVEs without changing version numbers.
    • viraptor 7y ago
      Or review the details and decide that the specific issue doesn't apply to them. This actually makes sense in larger environments.
• Rebelgecko 7y ago
  They're missing out on probably dozens of security fixes from the past 4 years. Unless they depend on buggy behavior, it is incredibly unlikely that they'll have any backwards compatibility issues, and hopefully they would have tests they could run against a newer JVM to help surface those issues.
• yjftsjthsd-h 7y ago
  > changes should be approached with extreme caution. It's good to make updates carefully, with full testing and a rollback plan. It is also important to actually push updates.