And there you are.
And so there's some good defenses against that.
So as a merchant you can subscribe to people who would scan
your website and then send you a notification saying your
version of Magento is now out of sync,
with the current version of Magento you've got a vulnerability,
so some, should I show one of those?
Yeah, let's take a look.
So, and yes, you have to pay money for them sometimes,
but then you've got some sort of service level guarantee on it.
Well, security isn't always free.
It is free SRI in CSP, other than the man hours to get it right.
Absolutely.
But there's, one of the companies who are based in the UK do a scanning service,
and they scan,
I hate the fact they put these statistics right on the front page that tell you
how much out-of-date software they've seen at the moment,
which is quite a lot,
and this is actually a free scan and it will check for all
the major vulnerabilities in Magento.
And then it will send you an email saying you've got a vulnerability,
and they update the scan.
But paradoxically this looks like it works based on the
fact that the web server leaks enough internal information
remotely about the framework, which is kind of not good to begin with,
and then it uses that to figure out that it's not out of date.
That's what Magento does, though.
Magento leaks a lot, which is why bad guys have a fun time breaking into it.
It's like the more we drill into this,
it's just like the more messed up everything is.