4 ms·

Twitter author here. I didn't make any assertions about the impact of this issue. A respondent to the Tweet said they found this earlier and had already disclos

Twitter author here. I didn't make any assertions about the impact of this issue. A respondent to the Tweet said they found this earlier and had already disclosed it to Barclays. I also tried to contact them for another issue and spent over 6 hours on hold before giving up. It's really annoying how people love to moan on HN without context.

nix23 6y ago
Just saying, that's NOT the way to do it: >How about @BarclaysUK pay @internetarchive for bandwidth usage and make a donation to @BlackGirlsCode for good measure.
- flumpcakes 6y ago
  It screams virtue signalling to me. I'm not even sure where @BlackGirlsCode even comes into it apart from to announce to the world that the author cares about social justice issues.
  - ben509 6y ago
    And cares so much that Somebody Else needs to donate to them.
  - ohyeshedid 6y ago
    You're doing some signaling of your own, intentional or not, when your only contribution to this thread has nothing to do with the overall topic and instead chose to make accusations without any information. I know you're capable of doing better than that.
wun0ne 6y ago
> It's really annoying how people love to moan on HN without context. It's really annoying how people love to moan on Twitter without context.
donmcronald 6y ago
Did you check the login page too? I'm guessing it's different (and probably more stringent on security I hope) since it's on a different subdomain.
ghusbands 6y ago
You did say "Not to mention the scumbaggery of leeching bandwidth from a not-for-profit", which is attributing poor motive and character. Even without that, your general tone is scathing and accusing, over something that is likely a simple mistake by a fairly fresh or unskilled developer.
- FpUser 6y ago
  >"that is likely a simple mistake by a fairly fresh or unskilled developer." I'd assume that for banks all code that goes into production gets audited. More so it is easy to have the code run through some analyzers before submitting it to production where presence of external origin should be detected automatically and raise a flag. If not it is gross negligence on the bank's side and deserves all the scathing and accusations it can get.
  - TheChaplain 6y ago
    No. Being courteous and professional will still get the point across.
  - nix23 6y ago
    >If not it is gross negligence on the bank's side Yes and you know who's then get fired? The junior developer....
  - user5994461 6y ago
    >>> I'd assume that for banks all code that goes into production gets audited. Code would be reviewed by a developer, not audited. The reviewer may or may notice the dependency to archive.org and may or may not care. Speaking from experience, the bank may have a policy to prohibit using external javascript, while the bank may not have a CDN itself to be able to host said dependencies.
  - robflaherty 6y ago
    "I'd assume that for banks all code that goes into production gets audited" The point of tag managers is to let non-developers update production without going through a code deployment so the usual code review and oversight doesn't apply. Also worth keeping in mind that this is the bank's marketing site. It's almost surely managed by a different team than the actual online banking site and probably has looser restrictions.

nix23 6y ago

Just saying, that's NOT the way to do it: >How about @BarclaysUK pay @internetarchive for bandwidth usage and make a donation to @BlackGirlsCode for good measure.

flumpcakes 6y ago
It screams virtue signalling to me. I'm not even sure where @BlackGirlsCode even comes into it apart from to announce to the world that the author cares about social justice issues.
- ben509 6y ago
  And cares so much that Somebody Else needs to donate to them.
- ohyeshedid 6y ago
  You're doing some signaling of your own, intentional or not, when your only contribution to this thread has nothing to do with the overall topic and instead chose to make accusations without any information. I know you're capable of doing better than that.

wun0ne 6y ago

> It's really annoying how people love to moan on HN without context. It's really annoying how people love to moan on Twitter without context.

donmcronald 6y ago

Did you check the login page too? I'm guessing it's different (and probably more stringent on security I hope) since it's on a different subdomain.

ghusbands 6y ago

You did say "Not to mention the scumbaggery of leeching bandwidth from a not-for-profit", which is attributing poor motive and character. Even without that, your general tone is scathing and accusing, over something that is likely a simple mistake by a fairly fresh or unskilled developer.

FpUser 6y ago
>"that is likely a simple mistake by a fairly fresh or unskilled developer." I'd assume that for banks all code that goes into production gets audited. More so it is easy to have the code run through some analyzers before submitting it to production where presence of external origin should be detected automatically and raise a flag. If not it is gross negligence on the bank's side and deserves all the scathing and accusations it can get.
- TheChaplain 6y ago
  No. Being courteous and professional will still get the point across.
- nix23 6y ago
  >If not it is gross negligence on the bank's side Yes and you know who's then get fired? The junior developer....
- user5994461 6y ago
  >>> I'd assume that for banks all code that goes into production gets audited. Code would be reviewed by a developer, not audited. The reviewer may or may notice the dependency to archive.org and may or may not care. Speaking from experience, the bank may have a policy to prohibit using external javascript, while the bank may not have a CDN itself to be able to host said dependencies.
- robflaherty 6y ago
  "I'd assume that for banks all code that goes into production gets audited" The point of tag managers is to let non-developers update production without going through a code deployment so the usual code review and oversight doesn't apply. Also worth keeping in mind that this is the bank's marketing site. It's almost surely managed by a different team than the actual online banking site and probably has looser restrictions.