Home Depot successfully installs Tomcat 9 in production

https://pr-mstr-scm-vendor.homedepot.com

by victor106 • 4 years ago

86 36 4 years ago

pr-mstr-scm-vendor.homedepot.com

mooreds• 4 years ago

Haha. Seems like there's a public server on the homedepot.com domain that hasn't had the default webapp removed.

Oops.

Given the hostname, looks like it is a staging server or infra server of some kind.

softwarebeware• 4 years ago

That’s great haha.

indigodaddy2• 4 years ago

Mildly humorous perhaps, but default website on some random subdomain is an entirely commonplace occurrence.. you’ll find tens of thousands of these— yes even at huge corps/enterprises..

paxys• 4 years ago

Only two years out of date too!

qbasic_forever• 4 years ago

Let's hope their log4j is a bit more up to date.

tyingq• 4 years ago

Vodaphone also: https://unlock.vodafone.com.au/index.jsp

And lots of other folks: https://www.google.com/search?q=intitle%3A%22apache+tomcat%2...

Nextgrid• 4 years ago

If you think this isn't scary enough, that thing most likely has access to a privileged network segment that the rest of the mobile network equipment is on and the software on those is no better.

exikyut3• 4 years ago

*Runs away rapidly in slow motion, screaming*

fragmede• 4 years ago

Shodan's even better for that: https://www.shodan.io/search?query=tomcat

https://www.shodan.io/search?query=product%3A%22Apache+Tomca... if you have an account.

exikyut3• 4 years ago

slimsag• 4 years ago

Incredibly funny. I actually think Home Depot, surprisingly, has increasingly good tech though.

I saw they paid for a booth at the Gophercon conference in San Diego a few years back, and their website + mobile app + online shipping setup is actually pretty great and reasonably priced. I didn't expect it to be. I use them for a lot of small+large tool/supply orders for gardening, woodworking, etc. now.

Dunno how that relates to stock value, but I've certainly thought twice that maybe I should buy some Home Depot stock because of this..

stephenhuey• 4 years ago

I heard that they’ve recently been transitioning from every store having its own local SQL Server database for inventory management to having a single database at HQ that all the stores use. Apparently it was quite arduous trying to sync all those store databases with a central one.

bfung• 4 years ago

At least they're on a relatively updated version :)

https://tomcat.apache.org/whichversion.html

jwhiz22• 4 years ago

Looks like they use AEM for their website. I had the displeasure of working with it in the past.

throwaway4good• 4 years ago

Notice how well it handles the traffic - unlike some of the other submissions that makes the hn front page.

jdoss• 4 years ago

We should cheer on teams in big enterprise that are pushing to upgrade their tech stacks. I worked at a security company that pulled in security scanner data from enterprise companies and as you can guess the results are not great. Any upgrade is a positive step forward. Don't hate on them for being behind the curve. Things are different at that level of business.

sgc• 4 years ago

Now I'm playing snake on home depot's dime!

KennyBlanken• 4 years ago

I wonder if Home Depot still rejects plus symbols in email addresses. Someone coded their email fields to only accept A-Z, 0-9, and a limited set of punctuation (. _ - @)

silisili• 4 years ago

Funny or not, Home Depot should be lauded for their website, ecommerce, and inventory tracking. Lowe's is a complete joke in comparison.

And it's not just public facing stuff. Home Depot tells you exactly where something is. Lowes just tells you an amount that may or may not be right. Three times this year I've went in to buy something with '15 in stock', and apparently that's all employees see also. They all briefly look around, then say I don't know check the endcaps.

1MachineElf3• 4 years ago

FWIW I've had similar frustrating experiences in both companies' stores. Could just be a matter of specific locations simply being run better than others.

CamJN• 4 years ago

They may be able to track their inventory, but they've also leaked 3 of my credit cards over the years, so it's not like they have reached the level of competency, they just know how many widgets they have.

Ancapistani2• 4 years ago

Do you happen to know for sure that Home Depot was the actor that allowed the leak to occur, or a third party vendor (like their payments processor)?

I'm not insinuating that they aren't responsible either way. On the contrary - their internal stuff seems really good, so if it's a vendor issue, maybe the world needs a "Home Depot Payments".

azinman2• 4 years ago

It’s been a long time since I’ve heard of Tomcat. Seems to have drastically fallen out of favor, much like Java itself for web hosting, but I’m guessing various bigcos still use it.

WatchDog• 4 years ago

Tomcat is still very much alive, although it tends to be used as an embedded web server, rather than as a platform for deploying war files.

badrabbit• 4 years ago

You have to use it sometimes for a lot of apache-ish apps like Gucamole.

mikepurvis• 4 years ago

Isn’t it still the weapon of choice for all those enterprisey Java apps, like Jenkins, Artifactory, and the Atlassian suite?

indigodaddy2• 4 years ago

Very much correct. Java/tomcat is absolutely entrenched in the Enterprise and Telcos/ISPs..

wfriesen• 4 years ago

Tomcat is a common embedded server for Spring Boot applications, and included in the default web stack from Spring Initialiser.

hestefisk• 4 years ago

I know of a rather large bank who still use NT 4.0 in their contact centres.

1MachineElf3• 4 years ago

I'd take NT 4.0 over Windows 11 any day.

1MachineElf3• 4 years ago

The Chat, Multiplayer Snake, and Multiplayer Drawing board examples for Tomcat WebSocket API are working. Is there someone out there who wants to play?

See: https://pr-mstr-scm-vendor.homedepot.com/examples/websocket/...

ykevinator2• 4 years ago

Lol that's a great find

Lammy• 4 years ago

Seems that they use Google Cloud Platform.

    pr-mstr-scm-vendor.homedepot.com. 3644 IN A 35.244.200.97

https://www.gstatic.com/ipranges/goog.json "35.240.0.0/13"

I wonder if "SCM" might stand for "supply chain management" here? A quick DDG search returned some relevant press:

- https://cloud.google.com/customers/the-home-depot/

- https://globalcloudplatforms.com/2021/12/18/the-sap-migratio...

- https://services.google.com/fh/files/misc/the_home_depot_sap...

exikyut3• 4 years ago

Ooooh, so that's what's going on there.

I wanted to see evidence of the actual upgrade, so asked IA.

There are only two archives: https://web.archive.org/web/*/https://pr-mstr-scm-vendor.hom...

The second one is from today, presumably thanks to an automated HN crawler :)

The first one is from Sep 2019, and is a Google 404: https://web.archive.org/web/20190920171313/http://pr-mstr-sc...

Now I wonder where the URL came from if the page was a 404 at the time. (IA says it got crawled as part of the Alexa Crawls project.)

Ancapistani2• 4 years ago

Now I wonder where the URL came

I've had stuff like this crawled in the past because it was linked from internal (but not private) documentation, which in turn was indexed because of a link that found its way into a public page.

ChrisArchitect• 4 years ago

Other Home Depot discussion this week

Home Depot finds DIY success with Vector Search

https://news.ycombinator.com/item?id=30698065

Home Depot successfully installs Tomcat 9 in production

Related Stories