I'm currently in the process of implementing a Paypal payment receiver (using the REST API) for digital goods, and doing so in an environment without any support for two-phase commits or anything like that, so I'm wondering how to make it as robust as possible.
I cannot find anything in the documentation about expected failure modes. Does payment execution have expected failure modes that I should be looking out for, or is it supposed to always work as long as network errors or other unusual things do not happen? If there are no expected failure modes, I would be okay with simply delivering the goods before the payment is actually executed and then manually resolving any failed executions (at least in the short run). If there are expected failure modes, on the other hand, I'd need to try and think of something more complex.
Related
We have a service hook created for one of our projects in ADO. It was going fine until last weekend. Suddenly few webhooks started queued and I am not sure how to force it to get processed. Can someone help me if there is a way to force those items to get processed.
Thanks,
Venu
I am afraid that you cannot get that you want during process.
Under the process, the queued service hooks will not be picked again and will not be processed again.
When the main thread, such as a work item, is running, you cannot forcefully intervene or exit the content that is already queued.
And there is a similar issue also discussing about this situation.
And waiting service hooks are actually coupled, which also depends on your memory, because they actually run in memory. If there are occasional memory loss and other problems during execution, this cannot ensure that all service hooks can be executed as expected.
Or you should interrupt the current process and reduce the service hooks for it. But it is not a good solution.
So it is the best way to add a function that can handle the queued service hooks in the process. But currently there is no such function. Therefore we recommend you submit the suggestion ticket to the Team to suggest them add that feature.
I would say that the following are valid use cases for Early Media when used for IVRs:
Filtering
Disconnect incoming calls based on certain criteria (such as callers from a specific area code, or to play a message before hanging up on after hour callers).
Rate limiting
For example to limit the number of simultaneous callers, where the excess calls are either disconnected, or placed in a queue. (I'm not sure if the queue example is possible though without answering the call.)
Are there more?
Some links that were helpful:
https://www.dialogic.com/webhelp/csp1010/8.4.1_ipn3/sip_software_chap_-_early_media.htm
https://wiki.asterisk.org/wiki/display/AST/Early+Media+and+the+Progress+Application
https://freeswitch.org/confluence/display/FREESWITCH/Early+Media
3) Legal: in some countries it is illegal for a call center using payed line (caller pay per minute) to accept a call without sending it straight to an agent. So you can't accept the call, give the user some waiting music for 15 minutes (and make them pay for the privilege of waiting as well).
Result: you don't accept the call. However, this creates a new problem: if the caller only hears the ring back tone for those 15 minutes, he/she will assume no one will answer and hangs up.
Using early media, you can give them the traditional "your call is very important to us, please hold on"-type of experience without accepting the call and without starting to charge money. Of course this also depends somewhat on how much the provider is willing to tolerate, as this can also affects their income (depending on their own business model).
4) Comfort: you may not be aware of this, but the sound you hear as caller when the other side is ringing (ring-back tone), is not universally the same throughout the world. A company with a global number may wish to use early media to provide a ring-back tone more familiar to you, depending on where you are calling from. It was always a bit niche of a concept but some target audiences are statistically more likely to hangup if they hear an unfamiliar sound. 15-20 year ago this might have been a concern to some, but in the era of smartphones and internet calls, I doubt anyone really worries about it anymore.
While other story states are self-explanatory, I'm not quite sure what is the intended use of 2 distinct Finished and Delivered states.
I have watched the videos on the Pivotal website, but found them unhelpful - they just state that we can mark the story using those states, but does not explain how does it relate to the workflow.
So, why do we need them? What happens after the developer marks the story as Finished and before it gets Delivered?
I assume the following workflow:
A developer starts to work on the story, marking it as Started
Once the story tasks are completed and it passes the unit tests - it is marked as Finished
After ??? it is marked as Delivered
Then, after QA it can be Accepted or Rejected and restarted, if necessary.
Should we mark the story as Finished before some other kind of testing and then Delivered once it passes? Or maybe it should involve code review? Perhaps this is a common knowledge in agile/scrum world, that I am yet unaware of?
I do understand that this mostly depends on the conventions, established in the project, but I am looking for some best practices, since we are just starting to incorporate Pivotal Tracker into our workflow.
I just had this same question and watched those same videos you did, but also found a more detailed article on Tracker's workflow.
Based on their explanation, I have modified your steps as below. Obviously everyone is going to have slightly different takes on this, but I've tried to see things through the way your company might work based on your initial steps.
A developer starts to work on the story, marking it as Started
Once the story tasks are completed and it passes the unit tests - it is marked as Finished
Once the code is successfully deployed to the stage or test environment, it is marked as Delivered
Then, after QA it can be Accepted or Rejected and restarted, if necessary.
Hopefully this is helpful.
That's an old subject, but here's what we are doing in my company :
When a developer ends a ticket, he finishes the story.
Any finished story has to be reviewed by another dev
If the code review is okay, the code is merged to the testing branch
Then the requester delivers it
I was looking through Apple's Verification Controller patch for In App Purchases here: https://developer.apple.com/library/ios/#releasenotes/StoreKit/IAP_ReceiptValidation/_index.html
I was planning on implementing server validation, but to not necessitate a response immediately.
Is the asynchronous part of their new code absolutely necessary. Does it offer any advantage over a naive server side validation?
If I could just use the immediate parsing and checking and gain a benefit, that would be great.
Thanks!
EDIT: This question feels a little empty without some code:
I'm talking specifically about changing the main verifyPurchase function to contain only:
- (BOOL)verifyPurchase:(SKPaymentTransaction *)transaction;
{
return [self isTransactionAndItsReceiptValid:transaction];
}
...and get rid of the client -> server post. Will I still be vulnerable to the recent hacks?
Your question makes much more sense after looking at the code.
The attack in question is that someone presents someone else's otherwise-valid receipt. There does not appear to be anything in the receipt data that ties it to the device/purchaser. You can mitigate this to some extent by checking the purchase dates (but only if the device has accurate time, which is under the user's control).
(This attack would not work if the client generated a 256-bit random nonce which had to match the receipt. An attacker can obviously hack the binary/PRNG, but in either case you've already lost.)
Incidentally, the code has a bunch of problems:
The only check of the server cert is that it's an EV cert. This should be easy to forge, since the attacker has complete control of the CA.
A transaction ID is permanently added to the list of "already seen" transactions in -isTransactionAndItsReceiptValid: before the network check finishes, but the content is only unlocked after the network returns. The receipt can never be re-verified if the connection fails, so the user's money will have effectively gone into a black hole.
It expects the transaction to have occurred on the same device that is verifying it.
It expects ITC_CONTENT_PROVIDER_SHARED_SECRET to be embedded in the executable (trivial to decrypt with a jailbroken device).
It assumes that -connection:didReceiveData: returns the complete receipt data (this might not be the case due to fragmentation, but it can probably be guaranteed since Apple controls the server implementation).
How do I simulate "Withdrawn by reporter" in JIRA workflow? Should it be a resolution?
Depends on your workflow and your needs. The arguments to whether use status or transition are the same as in here.
I would have done is using a global transition that leads to 'Withdrawn' status. This way you could access the list of withdrawn issues easily as well as allowing moving to this status from every other status.
EDIT
The big benefit of this method is that all issues that are Withdrawn by reporter will all be in the same status, meaning that all of them will have the same path of workflow leading them back to open status, making it easier to add specific screens for Withdrawn by reporter issues. For example you could add a reason for re-opening field.
As i see it , changing the resolution alone is not suffice since i don't see the reason of leaving Withdrawn by reporter issues in the same status as other regular issues, i belive it will be wiser to set them apart. This way it will be easier to get reports and queries of Withdrawn by reporter issues.
Buy the way, to get the list of all issues that were in the Withdrawn by reporter status use the following JQL:
status was "Withdrawn by reporter"