9 ms·

Home Depot successfully installs Tomcat 9 in production

86 points by victor106 5y ago

sgc 5y ago
Now I'm playing snake on home depot's dime!
mooreds 5y ago
Haha. Seems like there's a public server on the homedepot.com domain that hasn't had the default webapp removed. Oops. Given the hostname, looks like it is a staging server or infra server of some kind.
softwarebeware 5y ago
That’s great haha.
indigodaddy 5y ago
Mildly humorous perhaps, but default website on some random subdomain is an entirely commonplace occurrence.. you’ll find tens of thousands of these— yes even at huge corps/enterprises..
paxys 5y ago
Only two years out of date too!
- qbasic_forever 5y ago
  Let's hope their log4j is a bit more up to date.
tyingq 5y ago
Vodaphone also: https://unlock.vodafone.com.au/index.jsp https://unlock.vodafone.com.au/index.jsp And lots of other folks: https://www.google.com/search?q=intitle%3A%22apache+tomcat%22+%22for+security%22+%22users+are+defined%22 https://www.google.com/search?q=intitle%3A%22apache+tomcat%2...
- Nextgrid 5y ago
  If you think this isn't scary enough, that thing most likely has access to a privileged network segment that the rest of the mobile network equipment is on and the software on those is no better.
  - exikyut 5y ago
    *Runs away rapidly in slow motion, screaming*
- fragmede 5y ago
  Shodan's even better for that: https://www.shodan.io/search?query=tomcat https://www.shodan.io/search?query=tomcat https://www.shodan.io/search?query=product%3A%22Apache+Tomcat https://www.shodan.io/search?query=product%3A%22Apache+Tomca... if you have an account.
- exikyut 5y ago
  Why is... the first link... saying "(C) 1999-2002"??
- deleted 5y ago
  [deleted]
slimsag 5y ago
Incredibly funny. I actually think Home Depot, surprisingly, has increasingly good tech though. I saw they paid for a booth at the Gophercon conference in San Diego a few years back, and their website + mobile app + online shipping setup is actually pretty great and reasonably priced. I didn't expect it to be. I use them for a lot of small+large tool/supply orders for gardening, woodworking, etc. now. Dunno how that relates to stock value, but I've certainly thought twice that maybe I should buy some Home Depot stock because of this..
- stephenhuey 5y ago
  I heard that they’ve recently been transitioning from every store having its own local SQL Server database for inventory management to having a single database at HQ that all the stores use. Apparently it was quite arduous trying to sync all those store databases with a central one.
- deleted 5y ago
  [deleted]
bfung 5y ago
At least they're on a relatively updated version :) https://tomcat.apache.org/whichversion.html https://tomcat.apache.org/whichversion.html
jwhiz22 5y ago
Looks like they use AEM for their website. I had the displeasure of working with it in the past.
throwaway4good 5y ago
Notice how well it handles the traffic - unlike some of the other submissions that makes the hn front page.
jdoss 5y ago
We should cheer on teams in big enterprise that are pushing to upgrade their tech stacks. I worked at a security company that pulled in security scanner data from enterprise companies and as you can guess the results are not great. Any upgrade is a positive step forward. Don't hate on them for being behind the curve. Things are different at that level of business.
KennyBlanken 5y ago
I wonder if Home Depot still rejects plus symbols in email addresses. Someone coded their email fields to only accept A-Z, 0-9, and a limited set of punctuation (. _ - @)
silisili 5y ago
Funny or not, Home Depot should be lauded for their website, ecommerce, and inventory tracking. Lowe's is a complete joke in comparison. And it's not just public facing stuff. Home Depot tells you exactly where something is. Lowes just tells you an amount that may or may not be right. Three times this year I've went in to buy something with '15 in stock', and apparently that's all employees see also. They all briefly look around, then say I don't know check the endcaps.
- 1MachineElf 5y ago
  FWIW I've had similar frustrating experiences in both companies' stores. Could just be a matter of specific locations simply being run better than others.
- CamJN 5y ago
  They may be able to track their inventory, but they've also leaked 3 of my credit cards over the years, so it's not like they have reached the level of competency, they just know how many widgets they have.
  - Ancapistani 5y ago
    Do you happen to know for sure that Home Depot was the actor that allowed the leak to occur, or a third party vendor (like their payments processor)? I'm not insinuating that they aren't responsible either way. On the contrary - their internal stuff seems really good, so if it's a vendor issue, maybe the world needs a "Home Depot Payments".
azinman2 5y ago
It’s been a long time since I’ve heard of Tomcat. Seems to have drastically fallen out of favor, much like Java itself for web hosting, but I’m guessing various bigcos still use it.
- mikepurvis 5y ago
  Isn’t it still the weapon of choice for all those enterprisey Java apps, like Jenkins, Artifactory, and the Atlassian suite?
  - indigodaddy 5y ago
    Very much correct. Java/tomcat is absolutely entrenched in the Enterprise and Telcos/ISPs..
- WatchDog 5y ago
  Tomcat is still very much alive, although it tends to be used as an embedded web server, rather than as a platform for deploying war files.
- _8j50 5y ago
  You have to use it sometimes for a lot of apache-ish apps like Gucamole.
- wfriesen 5y ago
  Tomcat is a common embedded server for Spring Boot applications, and included in the default web stack from Spring Initialiser.
hestefisk 5y ago
I know of a rather large bank who still use NT 4.0 in their contact centres.
- 1MachineElf 5y ago
  I'd take NT 4.0 over Windows 11 any day.
1MachineElf 5y ago
The Chat, Multiplayer Snake, and Multiplayer Drawing board examples for Tomcat WebSocket API are working. Is there someone out there who wants to play? See: https://pr-mstr-scm-vendor.homedepot.com/examples/websocket/index.xhtml https://pr-mstr-scm-vendor.homedepot.com/examples/websocket/...
- ykevinator2 5y ago
  Lol that's a great find
Lammy 5y ago
Seems that they use Google Cloud Platform. pr-mstr-scm-vendor.homedepot.com. 3644 IN A 35.244.200.97 https://www.gstatic.com/ipranges/goog.json https://www.gstatic.com/ipranges/goog.json "35.240.0.0/13" I wonder if "SCM" might stand for "supply chain management" here? A quick DDG search returned some relevant press: - https://cloud.google.com/customers/the-home-depot/ https://cloud.google.com/customers/the-home-depot/ - https://globalcloudplatforms.com/2021/12/18/the-sap-migration-journey-from-on-prem-to-google-cloud-for-the-home-depot/ https://globalcloudplatforms.com/2021/12/18/the-sap-migratio... - https://services.google.com/fh/files/misc/the_home_depot_sap_migration_to_google_cloud.pdf https://services.google.com/fh/files/misc/the_home_depot_sap...
- exikyut 5y ago
  Ooooh, so that's what's going on there. I wanted to see evidence of the actual upgrade, so asked IA. There are only two archives: https://web.archive.org/web/*/https://pr-mstr-scm-vendor.homedepot.com https://web.archive.org/web/*/https://pr-mstr-scm-vendor.hom... The second one is from today, presumably thanks to an automated HN crawler :) The first one is from Sep 2019, and is a Google 404: https://web.archive.org/web/20190920171313/http://pr-mstr-scm-vendor.homedepot.com/ https://web.archive.org/web/20190920171313/http://pr-mstr-sc... Now I wonder where the URL came from if the page was a 404 at the time. (IA says it got crawled as part of the Alexa Crawls project.)
  - Ancapistani 5y ago
    > Now I wonder where the URL came I've had stuff like this crawled in the past because it was linked from internal (but not private) documentation, which in turn was indexed because of a link that found its way into a public page.
ChrisArchitect 5y ago
Other Home Depot discussion this week Home Depot finds DIY success with Vector Search https://news.ycombinator.com/item?id=30698065 https://news.ycombinator.com/item?id=30698065

86 points by victor106 5y ago

sgc 5y ago

Now I'm playing snake on home depot's dime!

Haha. Seems like there's a public server on the homedepot.com domain that hasn't had the default webapp removed. Oops. Given the hostname, looks like it is a staging server or infra server of some kind.

softwarebeware 5y ago

That’s great haha.

indigodaddy 5y ago

Mildly humorous perhaps, but default website on some random subdomain is an entirely commonplace occurrence.. you’ll find tens of thousands of these— yes even at huge corps/enterprises..

paxys 5y ago

Only two years out of date too!

qbasic_forever 5y ago
Let's hope their log4j is a bit more up to date.

tyingq 5y ago

Vodaphone also: https://unlock.vodafone.com.au/index.jsp https://unlock.vodafone.com.au/index.jsp And lots of other folks: https://www.google.com/search?q=intitle%3A%22apache+tomcat%22+%22for+security%22+%22users+are+defined%22 https://www.google.com/search?q=intitle%3A%22apache+tomcat%2...

Nextgrid 5y ago
If you think this isn't scary enough, that thing most likely has access to a privileged network segment that the rest of the mobile network equipment is on and the software on those is no better.
- exikyut 5y ago
  *Runs away rapidly in slow motion, screaming*
fragmede 5y ago
Shodan's even better for that: https://www.shodan.io/search?query=tomcat https://www.shodan.io/search?query=tomcat https://www.shodan.io/search?query=product%3A%22Apache+Tomcat https://www.shodan.io/search?query=product%3A%22Apache+Tomca... if you have an account.
exikyut 5y ago
Why is... the first link... saying "(C) 1999-2002"??
deleted 5y ago
[deleted]

slimsag 5y ago

Incredibly funny. I actually think Home Depot, surprisingly, has increasingly good tech though. I saw they paid for a booth at the Gophercon conference in San Diego a few years back, and their website + mobile app + online shipping setup is actually pretty great and reasonably priced. I didn't expect it to be. I use them for a lot of small+large tool/supply orders for gardening, woodworking, etc. now. Dunno how that relates to stock value, but I've certainly thought twice that maybe I should buy some Home Depot stock because of this..

stephenhuey 5y ago
I heard that they’ve recently been transitioning from every store having its own local SQL Server database for inventory management to having a single database at HQ that all the stores use. Apparently it was quite arduous trying to sync all those store databases with a central one.
deleted 5y ago
[deleted]

bfung 5y ago

At least they're on a relatively updated version :) https://tomcat.apache.org/whichversion.html https://tomcat.apache.org/whichversion.html

jwhiz22 5y ago

Looks like they use AEM for their website. I had the displeasure of working with it in the past.

throwaway4good 5y ago

Notice how well it handles the traffic - unlike some of the other submissions that makes the hn front page.

jdoss 5y ago

We should cheer on teams in big enterprise that are pushing to upgrade their tech stacks. I worked at a security company that pulled in security scanner data from enterprise companies and as you can guess the results are not great. Any upgrade is a positive step forward. Don't hate on them for being behind the curve. Things are different at that level of business.

KennyBlanken 5y ago

I wonder if Home Depot still rejects plus symbols in email addresses. Someone coded their email fields to only accept A-Z, 0-9, and a limited set of punctuation (. _ - @)

silisili 5y ago

Funny or not, Home Depot should be lauded for their website, ecommerce, and inventory tracking. Lowe's is a complete joke in comparison. And it's not just public facing stuff. Home Depot tells you exactly where something is. Lowes just tells you an amount that may or may not be right. Three times this year I've went in to buy something with '15 in stock', and apparently that's all employees see also. They all briefly look around, then say I don't know check the endcaps.

1MachineElf 5y ago
FWIW I've had similar frustrating experiences in both companies' stores. Could just be a matter of specific locations simply being run better than others.
CamJN 5y ago
They may be able to track their inventory, but they've also leaked 3 of my credit cards over the years, so it's not like they have reached the level of competency, they just know how many widgets they have.
- Ancapistani 5y ago
  Do you happen to know for sure that Home Depot was the actor that allowed the leak to occur, or a third party vendor (like their payments processor)? I'm not insinuating that they aren't responsible either way. On the contrary - their internal stuff seems really good, so if it's a vendor issue, maybe the world needs a "Home Depot Payments".

azinman2 5y ago

It’s been a long time since I’ve heard of Tomcat. Seems to have drastically fallen out of favor, much like Java itself for web hosting, but I’m guessing various bigcos still use it.

mikepurvis 5y ago
Isn’t it still the weapon of choice for all those enterprisey Java apps, like Jenkins, Artifactory, and the Atlassian suite?
- indigodaddy 5y ago
  Very much correct. Java/tomcat is absolutely entrenched in the Enterprise and Telcos/ISPs..
WatchDog 5y ago
Tomcat is still very much alive, although it tends to be used as an embedded web server, rather than as a platform for deploying war files.
_8j50 5y ago
You have to use it sometimes for a lot of apache-ish apps like Gucamole.
wfriesen 5y ago
Tomcat is a common embedded server for Spring Boot applications, and included in the default web stack from Spring Initialiser.

hestefisk 5y ago

I know of a rather large bank who still use NT 4.0 in their contact centres.

1MachineElf 5y ago
I'd take NT 4.0 over Windows 11 any day.

1MachineElf 5y ago

The Chat, Multiplayer Snake, and Multiplayer Drawing board examples for Tomcat WebSocket API are working. Is there someone out there who wants to play? See: https://pr-mstr-scm-vendor.homedepot.com/examples/websocket/index.xhtml https://pr-mstr-scm-vendor.homedepot.com/examples/websocket/...

ykevinator2 5y ago
Lol that's a great find

Lammy 5y ago

Seems that they use Google Cloud Platform. pr-mstr-scm-vendor.homedepot.com. 3644 IN A 35.244.200.97 https://www.gstatic.com/ipranges/goog.json https://www.gstatic.com/ipranges/goog.json "35.240.0.0/13" I wonder if "SCM" might stand for "supply chain management" here? A quick DDG search returned some relevant press: - https://cloud.google.com/customers/the-home-depot/ https://cloud.google.com/customers/the-home-depot/ - https://globalcloudplatforms.com/2021/12/18/the-sap-migration-journey-from-on-prem-to-google-cloud-for-the-home-depot/ https://globalcloudplatforms.com/2021/12/18/the-sap-migratio... - https://services.google.com/fh/files/misc/the_home_depot_sap_migration_to_google_cloud.pdf https://services.google.com/fh/files/misc/the_home_depot_sap...

exikyut 5y ago
Ooooh, so that's what's going on there. I wanted to see evidence of the actual upgrade, so asked IA. There are only two archives: https://web.archive.org/web/*/https://pr-mstr-scm-vendor.homedepot.com https://web.archive.org/web/*/https://pr-mstr-scm-vendor.hom... The second one is from today, presumably thanks to an automated HN crawler :) The first one is from Sep 2019, and is a Google 404: https://web.archive.org/web/20190920171313/http://pr-mstr-scm-vendor.homedepot.com/ https://web.archive.org/web/20190920171313/http://pr-mstr-sc... Now I wonder where the URL came from if the page was a 404 at the time. (IA says it got crawled as part of the Alexa Crawls project.)
- Ancapistani 5y ago
  > Now I wonder where the URL came I've had stuff like this crawled in the past because it was linked from internal (but not private) documentation, which in turn was indexed because of a link that found its way into a public page.

ChrisArchitect 5y ago

Other Home Depot discussion this week Home Depot finds DIY success with Vector Search https://news.ycombinator.com/item?id=30698065 https://news.ycombinator.com/item?id=30698065