8 ms·

It's really annoying how people like him blow these things out of proportion to shame and extort companies.. Seems like he didn't even make a serious attempt to

by eska 6y ago

It's really annoying how people like him blow these things out of proportion to shame and extort companies.. Seems like he didn't even make a serious attempt to message them.

immunda 6y ago
Twitter author here. I didn't make any assertions about the impact of this issue. A respondent to the Tweet said they found this earlier and had already disclosed it to Barclays. I also tried to contact them for another issue and spent over 6 hours on hold before giving up. It's really annoying how people love to moan on HN without context.
- nix23 6y ago
  Just saying, that's NOT the way to do it: >How about @BarclaysUK pay @internetarchive for bandwidth usage and make a donation to @BlackGirlsCode for good measure.
  - flumpcakes 6y ago
    It screams virtue signalling to me. I'm not even sure where @BlackGirlsCode even comes into it apart from to announce to the world that the author cares about social justice issues.
    - ben509 6y ago
      And cares so much that Somebody Else needs to donate to them.
    - ohyeshedid 6y ago
      You're doing some signaling of your own, intentional or not, when your only contribution to this thread has nothing to do with the overall topic and instead chose to make accusations without any information. I know you're capable of doing better than that.
- wun0ne 6y ago
  > It's really annoying how people love to moan on HN without context. It's really annoying how people love to moan on Twitter without context.
- donmcronald 6y ago
  Did you check the login page too? I'm guessing it's different (and probably more stringent on security I hope) since it's on a different subdomain.
- ghusbands 6y ago
  You did say "Not to mention the scumbaggery of leeching bandwidth from a not-for-profit", which is attributing poor motive and character. Even without that, your general tone is scathing and accusing, over something that is likely a simple mistake by a fairly fresh or unskilled developer.
  - FpUser 6y ago
    >"that is likely a simple mistake by a fairly fresh or unskilled developer." I'd assume that for banks all code that goes into production gets audited. More so it is easy to have the code run through some analyzers before submitting it to production where presence of external origin should be detected automatically and raise a flag. If not it is gross negligence on the bank's side and deserves all the scathing and accusations it can get.
    - TheChaplain 6y ago
      No. Being courteous and professional will still get the point across.
    - nix23 6y ago
      >If not it is gross negligence on the bank's side Yes and you know who's then get fired? The junior developer....
    - user5994461 6y ago
      >>> I'd assume that for banks all code that goes into production gets audited. Code would be reviewed by a developer, not audited. The reviewer may or may notice the dependency to archive.org and may or may not care. Speaking from experience, the bank may have a policy to prohibit using external javascript, while the bank may not have a CDN itself to be able to host said dependencies.
    - robflaherty 6y ago
      "I'd assume that for banks all code that goes into production gets audited" The point of tag managers is to let non-developers update production without going through a code deployment so the usual code review and oversight doesn't apply. Also worth keeping in mind that this is the bank's marketing site. It's almost surely managed by a different team than the actual online banking site and probably has looser restrictions.
donmcronald 6y ago
Have you ever tried to contact a big company for something small like that when you don't have a direct line for support? It's a complete waste of time. Shaming them publicly is the only way to do it without wasting your own time. If those companies don't want to get shamed publicly they can make an effort to provide a way for technical people to report minor issues IMO. Why should he spend his time (=money) to chase down a multi-billion dollar company to get them to fix a stupid error when he'd be lucky to get a thank you email for the effort?
- dredmorbius 6y ago
  <Raises hand.> I have. Sometimes successfully, sometimes not. Two successes: - I'd determined that a large email provider was transiting a sizeable fraction of all 419 spam I was seeing (and knew that this was likely broadly representative). Looked up the product title with "project manager" and similar terms, called the corporate switchboard, and asked for them by name. Phone picked up on first ring, I explained the situation briefly, fifteen minutes later I received a call from the manager in charge of that area, who leptnin touch over the next three months as the issue was resolved. - Another time worksite had issues with another email service provider with glacially slow processing of our notification emails. Performed an executive email carpet bomb[1] after months of ineffective helpdesk attemps, with evidence of the issue. Was assigned a minder who helped resolve the issue. Both were large companies (at the time), one I'm distinctly not inclined to consider favourably. Both responded exceeding expectations. Then there is Google.... ________________________________ Notes: 1. See https://www.nytimes.com/2017/05/05/your-money/the-best-consumer-self-advocacy-tool-youve-never-used.html https://www.nytimes.com/2017/05/05/your-money/the-best-consu...
- danmg 6y ago
  An internet named 'weev' tried to do that when the iPad first came out. He found they had an open json endpoint for completing email addresses from the device IMEI. He ended up in prison for trying to publicly shame AT&T,
IshKebab 6y ago
How exactly would you make a serious attempt to message them?

by eska 6y ago

It's really annoying how people like him blow these things out of proportion to shame and extort companies.. Seems like he didn't even make a serious attempt to message them.

immunda 6y ago

Twitter author here. I didn't make any assertions about the impact of this issue. A respondent to the Tweet said they found this earlier and had already disclosed it to Barclays. I also tried to contact them for another issue and spent over 6 hours on hold before giving up. It's really annoying how people love to moan on HN without context.

nix23 6y ago
Just saying, that's NOT the way to do it: >How about @BarclaysUK pay @internetarchive for bandwidth usage and make a donation to @BlackGirlsCode for good measure.
- flumpcakes 6y ago
  It screams virtue signalling to me. I'm not even sure where @BlackGirlsCode even comes into it apart from to announce to the world that the author cares about social justice issues.
  - ben509 6y ago
    And cares so much that Somebody Else needs to donate to them.
  - ohyeshedid 6y ago
    You're doing some signaling of your own, intentional or not, when your only contribution to this thread has nothing to do with the overall topic and instead chose to make accusations without any information. I know you're capable of doing better than that.
wun0ne 6y ago
> It's really annoying how people love to moan on HN without context. It's really annoying how people love to moan on Twitter without context.
donmcronald 6y ago
Did you check the login page too? I'm guessing it's different (and probably more stringent on security I hope) since it's on a different subdomain.
ghusbands 6y ago
You did say "Not to mention the scumbaggery of leeching bandwidth from a not-for-profit", which is attributing poor motive and character. Even without that, your general tone is scathing and accusing, over something that is likely a simple mistake by a fairly fresh or unskilled developer.
- FpUser 6y ago
  >"that is likely a simple mistake by a fairly fresh or unskilled developer." I'd assume that for banks all code that goes into production gets audited. More so it is easy to have the code run through some analyzers before submitting it to production where presence of external origin should be detected automatically and raise a flag. If not it is gross negligence on the bank's side and deserves all the scathing and accusations it can get.
  - TheChaplain 6y ago
    No. Being courteous and professional will still get the point across.
  - nix23 6y ago
    >If not it is gross negligence on the bank's side Yes and you know who's then get fired? The junior developer....
  - user5994461 6y ago
    >>> I'd assume that for banks all code that goes into production gets audited. Code would be reviewed by a developer, not audited. The reviewer may or may notice the dependency to archive.org and may or may not care. Speaking from experience, the bank may have a policy to prohibit using external javascript, while the bank may not have a CDN itself to be able to host said dependencies.
  - robflaherty 6y ago
    "I'd assume that for banks all code that goes into production gets audited" The point of tag managers is to let non-developers update production without going through a code deployment so the usual code review and oversight doesn't apply. Also worth keeping in mind that this is the bank's marketing site. It's almost surely managed by a different team than the actual online banking site and probably has looser restrictions.

donmcronald 6y ago

Have you ever tried to contact a big company for something small like that when you don't have a direct line for support? It's a complete waste of time. Shaming them publicly is the only way to do it without wasting your own time. If those companies don't want to get shamed publicly they can make an effort to provide a way for technical people to report minor issues IMO. Why should he spend his time (=money) to chase down a multi-billion dollar company to get them to fix a stupid error when he'd be lucky to get a thank you email for the effort?

dredmorbius 6y ago
<Raises hand.> I have. Sometimes successfully, sometimes not. Two successes: - I'd determined that a large email provider was transiting a sizeable fraction of all 419 spam I was seeing (and knew that this was likely broadly representative). Looked up the product title with "project manager" and similar terms, called the corporate switchboard, and asked for them by name. Phone picked up on first ring, I explained the situation briefly, fifteen minutes later I received a call from the manager in charge of that area, who leptnin touch over the next three months as the issue was resolved. - Another time worksite had issues with another email service provider with glacially slow processing of our notification emails. Performed an executive email carpet bomb[1] after months of ineffective helpdesk attemps, with evidence of the issue. Was assigned a minder who helped resolve the issue. Both were large companies (at the time), one I'm distinctly not inclined to consider favourably. Both responded exceeding expectations. Then there is Google.... ________________________________ Notes: 1. See https://www.nytimes.com/2017/05/05/your-money/the-best-consumer-self-advocacy-tool-youve-never-used.html https://www.nytimes.com/2017/05/05/your-money/the-best-consu...
danmg 6y ago
An internet named 'weev' tried to do that when the iPad first came out. He found they had an open json endpoint for completing email addresses from the device IMEI. He ended up in prison for trying to publicly shame AT&T,

IshKebab 6y ago

How exactly would you make a serious attempt to message them?