5 ms·

> Matthew in accounting that will open that invoice attachment so he can pay it. This is painfully accurate. A chain is really only as strong as its weakest l

> Matthew in accounting that will open that invoice attachment so he can pay it. This is painfully accurate. A chain is really only as strong as its weakest link :/

sjg007 6y ago
The invoice should be a PDF interpreted by pdf.js inside a sandboxed browser. Even better is that the company should have its own internal ordering system.
- Scoundreller 6y ago
  > Even better is that the company should have its own internal ordering system. This always becomes a war where the seller wants you to send orders 1 way, and the buyer wants to send all orders another way.
- flo123456 6y ago
  The invoice shouldn’t have to be a PDF and shouldn’t have to be sent via e-mail. Sadly those are still the best tools we have. It would be really cool to have an invoice format that contains payment and tax information in a machine readable way and a way to send that information around with a verifiable channel.
  - corty 6y ago
    The invoice will be PDF with an embedded XML blob containing the machine-readable data part, signed with a PDF signature: https://www.pdf-tools.com/pdf20/en/zugferd/ https://www.pdf-tools.com/pdf20/en/zugferd/ pdf.js lacks capabilities to extract the XML or verify signatures, so the usual way will be to use Acrobat Reader or the usual bunch of "industry-standard" invoice-processing crap that now suddenly has to deal with malicious input. The idea to do it differently might be nice in theory, but is lacking a smooth way to change over from the old paper-invoice ways. PDF will be the thing for some decades and we will have to deal with it.
    - vbrandl 6y ago
      Having implemented rudimentary ZUGFeRD support at $dayjob a few years ago (our main product is sending, receiving and validating invoices for energy companies in Germany), I don't see ZUGFeRD becoming relevant anytime soon. At least for b2b invoices, nothing has changed since the release of ZUGFeRD. They prefer sticking to EDI formats (many with some custom edge cases for their SAP monstrosities, e.g. putting the `-` sign for negative numbers _after_ the number like `10-` for `-10`...)
      - corty 6y ago
        Quite possible, yes. But the alternatives to zugferd look quite similar, due to requirements from the relevant laws: https://de.wikipedia.org/wiki/Elektronische_Rechnung https://de.wikipedia.org/wiki/Elektronische_Rechnung translated excerpt: an electronic invoice must be [...] 3. human readable 4. origin of the invoice must be guaranteed (digital signature or internal controls) 5. integrity of the invoice must be guaranteed [...] This means that while you might be able to use something other than PDF for the human-readable part, I don't think anything other than PDF will be used. All the other stuff (XML with embedded SVG or PNG, Word, plaintext) will have acceptance problems in one form or the other. EDI is big business to big business, as evidenced by you mentioning SAP. There, you may be completely right, I don't know.
FreshFries 6y ago
We (as in the IT Sec industry including me) prefer to blame Matthew. Or my 80 year old mother for not installing the latest Adobe patches in real time. With 30 years of daily experience in this field, I am ashamed about how we fail Matthew & my mother in the sense that they can still not just enjoy the internet and open random emails without one of us blaming them for how stupid they are.
- therealx 6y ago
  Do we somehow fail the dumb accountant or 80 year gma with cars because they can't just get in and drive without learning how to drive?
  - djeiasbsbo 6y ago
    That analogy doesn't work in my opinion, because to even be allowed to drive, an extensive amount of training is required. I think we need to start very early. There should be more mandatory comouter science and information security classes at schools because we are all confronted with these topics everyday. Most people can work systems such as washing machines, vacuum cleaners and so on, the problems arise when the internet (or other forms of connectability) comes into the picture. But the reality is that most such systems will probably soon be connected in some way, so the challenge grows. So I think it is very important that we push for more information/education instead of going into the direction of more locked down, closed off and proprietary systems because these can easily "not respect" the end user.
    - therealx 6y ago
      I disagree. Anyone with minor observation can get behind a wheel and drive. Will they do it well? No (same with a computer) Is it legal? No, but thats because we all decided that as a group. The danger is different, but I think it's still an interesting analogy. I think we need to all realize that most people aren't cut out for computer science, per se, but most people are cut out to learn to responsibly use a computer.
wil421 6y ago
If Matthew in accounting received a malicious attachment then IT has already failed.

> Matthew in accounting that will open that invoice attachment so he can pay it. This is painfully accurate. A chain is really only as strong as its weakest link :/

sjg007 6y ago

The invoice should be a PDF interpreted by pdf.js inside a sandboxed browser. Even better is that the company should have its own internal ordering system.

Scoundreller 6y ago
> Even better is that the company should have its own internal ordering system. This always becomes a war where the seller wants you to send orders 1 way, and the buyer wants to send all orders another way.
flo123456 6y ago
The invoice shouldn’t have to be a PDF and shouldn’t have to be sent via e-mail. Sadly those are still the best tools we have. It would be really cool to have an invoice format that contains payment and tax information in a machine readable way and a way to send that information around with a verifiable channel.
- corty 6y ago
  The invoice will be PDF with an embedded XML blob containing the machine-readable data part, signed with a PDF signature: https://www.pdf-tools.com/pdf20/en/zugferd/ https://www.pdf-tools.com/pdf20/en/zugferd/ pdf.js lacks capabilities to extract the XML or verify signatures, so the usual way will be to use Acrobat Reader or the usual bunch of "industry-standard" invoice-processing crap that now suddenly has to deal with malicious input. The idea to do it differently might be nice in theory, but is lacking a smooth way to change over from the old paper-invoice ways. PDF will be the thing for some decades and we will have to deal with it.
  - vbrandl 6y ago
    Having implemented rudimentary ZUGFeRD support at $dayjob a few years ago (our main product is sending, receiving and validating invoices for energy companies in Germany), I don't see ZUGFeRD becoming relevant anytime soon. At least for b2b invoices, nothing has changed since the release of ZUGFeRD. They prefer sticking to EDI formats (many with some custom edge cases for their SAP monstrosities, e.g. putting the `-` sign for negative numbers _after_ the number like `10-` for `-10`...)
    - corty 6y ago
      Quite possible, yes. But the alternatives to zugferd look quite similar, due to requirements from the relevant laws: https://de.wikipedia.org/wiki/Elektronische_Rechnung https://de.wikipedia.org/wiki/Elektronische_Rechnung translated excerpt: an electronic invoice must be [...] 3. human readable 4. origin of the invoice must be guaranteed (digital signature or internal controls) 5. integrity of the invoice must be guaranteed [...] This means that while you might be able to use something other than PDF for the human-readable part, I don't think anything other than PDF will be used. All the other stuff (XML with embedded SVG or PNG, Word, plaintext) will have acceptance problems in one form or the other. EDI is big business to big business, as evidenced by you mentioning SAP. There, you may be completely right, I don't know.

FreshFries 6y ago

We (as in the IT Sec industry including me) prefer to blame Matthew. Or my 80 year old mother for not installing the latest Adobe patches in real time. With 30 years of daily experience in this field, I am ashamed about how we fail Matthew & my mother in the sense that they can still not just enjoy the internet and open random emails without one of us blaming them for how stupid they are.

therealx 6y ago
Do we somehow fail the dumb accountant or 80 year gma with cars because they can't just get in and drive without learning how to drive?
- djeiasbsbo 6y ago
  That analogy doesn't work in my opinion, because to even be allowed to drive, an extensive amount of training is required. I think we need to start very early. There should be more mandatory comouter science and information security classes at schools because we are all confronted with these topics everyday. Most people can work systems such as washing machines, vacuum cleaners and so on, the problems arise when the internet (or other forms of connectability) comes into the picture. But the reality is that most such systems will probably soon be connected in some way, so the challenge grows. So I think it is very important that we push for more information/education instead of going into the direction of more locked down, closed off and proprietary systems because these can easily "not respect" the end user.
  - therealx 6y ago
    I disagree. Anyone with minor observation can get behind a wheel and drive. Will they do it well? No (same with a computer) Is it legal? No, but thats because we all decided that as a group. The danger is different, but I think it's still an interesting analogy. I think we need to all realize that most people aren't cut out for computer science, per se, but most people are cut out to learn to responsibly use a computer.

wil421 6y ago

If Matthew in accounting received a malicious attachment then IT has already failed.