3 ms·

What is your suggestion for a self hosted client fraud platform?

by nerdbaggy 8y ago

dmitrygr 8y ago
Hire a few competent engineers and make one
- not_kurt_godel 8y ago
  You could do that, and they'd quickly tell you that fraud detection requires vast datasets that your company almost certainly cannot generate or maintain in-house. Then what?
  - dmitrygr 8y ago
    Find a way to live without it I guess. Certainly that would be better than having your entire production stop working because somebody else decided to take a multimillion-dollar check and run with no concern for you or contracts you had signed
    - krainboltgreene 8y ago
      It's not better.
    - not_kurt_godel 8y ago
      If you can afford to cut multi-million dollar checks for a fraud/abuse prevention service, then you can also afford to retain a legal team who will recoup your losses and then some when those contracts are broken. A temporary production outage due to a rare situation is far preferable to being at the perpetual mercy of hackers constantly pwning whatever half-baked homegrown security system you forced your engineers to implement with inadequate support & resources. Real businesses don't operate on "I guess" solutions and they don't just fork over huge chunks of cash willy-nilly without doing at least some cost-benefit analysis and making sure they're protected in case of contract breach.
  - deleted 8y ago
    [deleted]
- ry_ry 8y ago
  My employers do just that - Fraud prevention is a fundamental part of our business operations. It largely involves multiple teams of full time employees working on different aspects of fraud prevention (some of them are even Competent Developers!) a few dedicated offices, some teams embedded in regional development offices, a bunch of bespoke software and it's ongoing development and maintenance. Thats in addition to the core dev teams being aware of and mitigating any possible vectors within the platform itself. At any kind of scale it's rarely as easy as 'hiring a few competent developers'.
stevekemp 8y ago
I do something similar (real-time detection of spam-comments) at https://blogspam.net/ https://blogspam.net/ and I'd be reluctant to even attempt to handle fraud. If my site messes up then dodgy comments might get posted (unless they're blocked by other systems). If you misclassify an "is-fraud" check you either have a customer lose money, or a potential customer be denied service. Neither of those are great. I suspect actually doing anti-fraud testing could be done simply with a few heuristics, knowing the kind of attacks I see on other sites I run, but the only way to be sure is to get a lot of data-volume and real-life results to compare against.

What is your suggestion for a self hosted client fraud platform?

dmitrygr 8y ago

Hire a few competent engineers and make one

not_kurt_godel 8y ago
You could do that, and they'd quickly tell you that fraud detection requires vast datasets that your company almost certainly cannot generate or maintain in-house. Then what?
- dmitrygr 8y ago
  Find a way to live without it I guess. Certainly that would be better than having your entire production stop working because somebody else decided to take a multimillion-dollar check and run with no concern for you or contracts you had signed
  - krainboltgreene 8y ago
    It's not better.
  - not_kurt_godel 8y ago
    If you can afford to cut multi-million dollar checks for a fraud/abuse prevention service, then you can also afford to retain a legal team who will recoup your losses and then some when those contracts are broken. A temporary production outage due to a rare situation is far preferable to being at the perpetual mercy of hackers constantly pwning whatever half-baked homegrown security system you forced your engineers to implement with inadequate support & resources. Real businesses don't operate on "I guess" solutions and they don't just fork over huge chunks of cash willy-nilly without doing at least some cost-benefit analysis and making sure they're protected in case of contract breach.
- deleted 8y ago
  [deleted]
ry_ry 8y ago
My employers do just that - Fraud prevention is a fundamental part of our business operations. It largely involves multiple teams of full time employees working on different aspects of fraud prevention (some of them are even Competent Developers!) a few dedicated offices, some teams embedded in regional development offices, a bunch of bespoke software and it's ongoing development and maintenance. Thats in addition to the core dev teams being aware of and mitigating any possible vectors within the platform itself. At any kind of scale it's rarely as easy as 'hiring a few competent developers'.

stevekemp 8y ago

I do something similar (real-time detection of spam-comments) at https://blogspam.net/ https://blogspam.net/ and I'd be reluctant to even attempt to handle fraud. If my site messes up then dodgy comments might get posted (unless they're blocked by other systems). If you misclassify an "is-fraud" check you either have a customer lose money, or a potential customer be denied service. Neither of those are great. I suspect actually doing anti-fraud testing could be done simply with a few heuristics, knowing the kind of attacks I see on other sites I run, but the only way to be sure is to get a lot of data-volume and real-life results to compare against.