27 ms·

JavaScript from 2001 on India's largest private bank site

136 points by plibither8 6y ago

RedShift1 6y ago
Doesn't look too bad to be honest, considering when it was written. There are some oddities like the functions "returnTrue" and "returnFalse". Other than that, don't fix what ain't broken?
- keanebean86 6y ago
  I wonder if stuff like this is taught in India schools? I work with multiple India devs and they do this all the time. Our code has stuff like below that drives me nuts. public static boolean TRUE = true; I've directly asked if they think TRUE will some day need to be set to false but they just ignore me.
  - durnygbur 6y ago
    > TRUE will some day need to be set to false It will happen one day, it will go into production, and the app will work surprisingly well with some subtle glitches. After revealing all contractor devs will make poker face and things will continue as before.
    - patrickthebold 6y ago
      One time we had a big launch of an important feature (for one noisy customer), we ended up with like 4 feature flags that we needed to flip once it was time to go live. Anyway the big day comes, we turn it on, everything looks good, everyone is happy. A few weeks later I noticed we forgot to turn one of the flags on. So I asked a teammate what he thought. He shrugged, we figured it would be slightly better to turn it on.
  - rocknor 6y ago
    "They do this all the time"? The ignorance of generalizing a large country with a big population is astonishing. The problem is your employer paying peanuts as developer salaries. You'd get the same bad code if you paid peanuts to hire shitty developers in the US or EU.
    - keanebean86 6y ago
      So now you generalize that these devs are terrible? They do this one thing I don't like. That doesn't say anything about the quality of their work overall.
      - rocknor 6y ago
        Yes. If you hire someone for an excessively cheap rate, it is likely that they might not perform well. For example, assume the salary of a graduate salary in bay area is $100K. You can usually hire an equally skilled graduate in India at like 1/5th price. But if you instead hire ones that are OK with 1/10 or less, you are just asking for trouble. India has a surplus of engineering graduates, even people who have no business studying engineering get an engineering degree (because let's face it, not everyone is interested in STEM) - so they perform badly as expected. But that shouldn't discount the good ones (even if 10% are good, in absolute terms that's still a big number because of the population).
- jakub_g 6y ago
  Declaring functions like 'returnTrue' was a way to prevent memory leak in old IE (~IE6/IE7) (instead of creating a new inline function each time a method is called). It was especially important when a function is a closure and has a ton of variables visible in outer scope (in particular, refs to DOM nodes) and is called many times. Otherwise you end up with circular references between the objects and nothing can be garbage collected (GC implementation in old IE was very bad).
  - petepete 6y ago
    I remember replacing some functions like this in a codebase I used to work on about twenty years ago. The senior dev at the time had to add them back a day or two later whe the site totally broke for IE users after a couple of minutes. Fun times.
    - bryanrasmussen 6y ago
      I hope he added in a comment /* don't remove or refactor this, IE6 will break */
      - uncledave 6y ago
        Oh god there’s so much of that I’ve written over the years. It’s still in there now. Fortunately minification eats my shame publicly. Think the worst one was we had some code that would add a pad in somewhere after the page was rendered that would cause IE6 to redraw the page correctly.
anonytrary 6y ago
I am impressed to see none of this prototype
- durnygbur 6y ago
  It takes a minimal understanding of JavaScript to use prototype. Here there is few methods figthing with and mangling the DOM and strings.
  - anonytrary 6y ago
    Which is why I'm impressed. Enough prototype spam! Functional JS is the way to go.
    - durnygbur 6y ago
      this
villgax 6y ago
Obfuscation would have saved face
- runawaybottle 6y ago
  This is not really embarrassing code relatively speaking. Start replacing the global variables with ‘const one = useState(1)’, and get a few of those DOM elements into a render function, and it’ll start to look like what most front end people write now days. Split the helper/utility methods out to a helpers.js file, import in the ones you need. Swap out the Date and Number handling with native methods or decent library. I’d call this person crazy if he abstracted into something wholesale unnecessary like a state machine or a pub/sub pattern, or factory pattern, etc. So far so good, plenty to work with here. The person was not given any bad ideas to even contemplate writing it in anything but a straightforward way.
TedDoesntTalk 6y ago
function cancel_request () { window.history.back(); return false; } —- What?
- bryanrasmussen 6y ago
  window.history.back tells the browser when you have a chance execute a back navigation, control still has to be given back to the browser to do it.
segfaultbuserr 6y ago
Honestly, not too bad. At least it's organized as recognizable functions. It just has a lot of useless repetitions that should've been implemented as lookup tables or format strings. datestr += '<option value="" selected>-mmm-</option>'; datestr += '<option value="01">Jan</option>'; datestr += '<option value="02">Feb</option>'; datestr += '<option value="03">Mar</option>'; datestr += '<option value="04">Apr</option>'; datestr += '<option value="05">May</option>'; and case "alphanumhyphen": if(l_str.length >0 && l_str.search("[^A-Za-z0-9\-_]") >= 0 ){ if(p_alertFlg){ alert( p_fldTitle +" should contain Alphabets or Numbers or - or _"); } return "alphanumhyphen"; } break; case "numeric": if(l_str.length >0 && l_str.search("[^0-9]") >=0 ){ if(p_alertFlg){ alert( p_fldTitle +" should contain Numbers"); } return "numeric"; } break; case "decimal": if(l_str.length >0 && l_str.search("[^0-9.]") >=0 ){ if(p_alertFlg){ alert( p_fldTitle +" should be Numeric."); } return "decimal"; } break; What is the correct term to describe this type of code? I used to call it "Spaghetti Code". But I recently learned that it's incorrect. "Spaghetti Code" only refers to programs with messy and unclear control flows (especially unstructured programs that abuse goto), it's not the correct term for code with useless repetitions.
- vincnetas 6y ago
  I suggest "micromanaging". Instead of saying "do this 100 times for these parameters", you explicitly instruct to do things one by one without noticong that there's a pattern in your instructions.
  - codeulike 6y ago
    Its cautious - each engineer that edits that file is changing the minimum necessary. You can bet a bunch of them looked at some of those functions and saw how they could be made more consise or less repetitive - but if its all working why take the risk? Its just creating more work for the people downstream who have to test and sign off every change. There's a lot to be said for boring, easy to understand code.
rlv-dan 6y ago
If you think this is old, you should see the mainframes running our bank systems...
- SavantIdiot 6y ago
  Banamex still runs Unisys on VMs in the cloud.
blntechie 6y ago
For people who don't know, this bank (HDFC) was dinged and penalized by the central governing bank (Reserve Bank of India) because of the frequent outages of their banking systems. They restricted the bank from issuing new credit cards for a year which is a big penalty all things considered. Also, they were given a deadline to get their tech stable and they actually brought in an IT provider for the bank to fix things which was bit high handed. But the bank was very big in the country and a failure can have cascading affects which was the reason said by the central governing bank. I believe it was the first of the kind in the country to penalize a bank because their tech was unstable.
- ffpip 6y ago
  https://www.google.com/search?q=HDFC+RBI+IT&oq=HDFC+RBI+IT&client=firefox-b-d https://www.google.com/search?q=HDFC+RBI+IT&oq=HDFC+RBI+IT&c...
- tushar-r 6y ago
  >They restricted the bank from issuing new credit cards for a year which is a big penalty all things considered. This is hilarious because they are actively offering credit card upgrades all around right now.
  - fatboy93 6y ago
    Not really, they are trying to sidegrades or downgrades. For eg, Regalia first -> millenia; which is a flat out downgrade!
    - tushar-r 6y ago
      Some yes, a lot of Regalia people are being given Infinia. Like me, when I barely use it (-8
      - manojlds 6y ago
        Without the fee or with?
rgj 6y ago
I love this function returnFalse () {return false} and the fact that their home cooked date_val() function does not use their home cooked isLeapYear() and daysInMonth() functions, but uses its own, pretty much unreadable, leap year determination algorithm. var l_k=parseInt(l_y%100) var l_m=parseInt(l_y/100) if (l_d == 29 && ((l_y/4)!=parseInt(l_y/4))) { l_err=1 ; l_errstring = "Date is invalid."; } if(l_k ==0){ if (l_d == 29 && ((l_m/4)!=parseInt(l_m/4))) { l_err=1 ; l_errstring = "Date is invalid."; } }
- jakub_g 6y ago
  See my comment on returnFalse: https://news.ycombinator.com/item?id=26473819 https://news.ycombinator.com/item?id=26473819
  - rgj 6y ago
    Never knew. Cool to know, thanks.
- jiofih 6y ago
  Yeah they would be much better off importing a few npm packages for that, and setting up some CI to build this with webpack and deploy to serverless /s Nothing wrong with the code per se - a little formatting and nicer variable names would make it entirely readable. Having the entire logic inline might be intentional so you can cross-check (legal) requirements and avoid transitive dependencies - the handling of dates specified might not necessarily match what’s “technically correct” at all times. Anyone writing Go will be familiar with this style.
ncann 6y ago
On the topic of banks and software, I can't understand for the life of me why almost all of the banks in Canada and US have comical level of security. Most don't offer 2FA (of all the banks on Canada, the only one with 2FA is TD if I recall). Those who do only have 2FA through SMS so good luck travelling out of country. Many still have pin-only passwords with 4-8 digits limit...
- phist_mcgee 6y ago
  Good old fashioned legacy systems. Decades and decades of consultants throwing garbage at more garbage. Endless uplift projects and corporate reshuffles slicing tech stacks in two, and sewing them back up. Banks are utterly famous for this stuff, and I think the new trend at least here in Australia is to start spin off 'neobanks' that begin with a fresh slate, but are still owned by their parent bank.
- Vespasian 6y ago
  Probably they not legally mandated to offer it and are not liable for hacked accounts. A few years back a German/EU law required banks to introduce real 2fa for customer logins and payments. The deadline had to be extended several times and still some banks and merchants missed it.
- mschuster91 6y ago
  > On the topic of banks and software, I can't understand for the life of me why almost all of the banks in Canada and US have comical level of security. Multiple reasons: 1) They're banks. Banks are run by the worst type of MBA beancounters you can imagine - all that counts is profits (and the more the better, which is why way too many banks dabble in investment banking aka legalized gambling), and IT doesn't bring in profits, so generally bank IT is only doing the utterly minimal effort that is required to stay in compliance with regulatory demands. As you can imagine, they're pretty much overwhelmed when they get requirements that require overhauls - e.g. the EU mandating overnight SEPA transfers or real-time identity confirmation (PSD2). 2) The tech stacks are comically old and complex (which is the reason for pin-only passwords). The decades-old mainframe stack with hundreds of custom built applications interfacing to it means that even something as innocent as alphanumeric passwords may be all but impossible to do. And don't get me started on Unicode, you're lucky if the base minimum that all connected applications understand is something like ISO-8859. 3) Related to this: as the software is so old, it literally embodies decades of knowledge of all possible kind of "edge cases" and hidden assumptions. Like... developers assume that a dead person stays dead, which is a sane thing to believe since zombies aren't real, but then you have someone declared dead by court reappear alive, and suddenly the workflow breaks down. Or that someone who registered as male can't change their legal gender, or that there are only two genders (which is quite fucking over many many MANY industries who implemented gender as a boolean, e.g. is_female), or that a marriage exclusively consists of husband and wife (changing that one is costing the public sector an awful lot of work, even many years after same-sex marriage got legalized in Germany). 4) Security audits in big companies (not just banks) are just checklists for insurance vendors, no matter if they actually make sense or not. All that matters for the C-level execs is "assuming someone hacks us, will insurance find a way to deny payments?" and not "is this actually secure?". 5) Regulatory agencies are so risk averse it hurts. What they don't know for years is haram - Kubernetes? Cloud hosting? Even proposing that will get you as a developer a shoot-down order from legal, since the regulatory agencies won't certify it. Source: done a couple jobs involving either interfacing or directly working with medical and banking services.
bmurray7jhu 6y ago
Flexcube is the same software package that caused Citi to accidentally send $900 million. https://arstechnica.com/tech-policy/2021/02/citibank-just-got-a-500-million-lesson-in-the-importance-of-ui-design/ https://arstechnica.com/tech-policy/2021/02/citibank-just-go...
- hiyer 6y ago
  i-Flex, the maker of Flexcube, was my first company out of college. I stuck around only for a month or so, but in that time we had a brief training on the software. The interface was a smorgasbord of buttons and inputs, and I couldn't make head or tail of anything on it. Good to see that things haven't changed in over a decade since then.
_kblcuk_ 6y ago
They're pretty optimistic about how long this script will be in use: ``` if (l_y < 1900 || l_y > 9999) { l_err = 1 ; l_errstring = "Year is invalid."; } ```
- onion2k 6y ago
  My frontend date code just passes a millisecond timestamp to the JS Date object constructor to do validation, so technically any code I've written could be actively deployed until the maximum valid JS Date, which is in the year 275,760. (https://262.ecma-international.org/5.1/#sec-15.9.1.1 https://262.ecma-international.org/5.1/#sec-15.9.1.1) Something has gone seriously wrong with human society if that ever actually happens.
rockyj 6y ago
"The Ken" had an good article on the state of Indian bank's IT systems - https://the-ken.com/story/sorry-for-the-inconvenience-why-your-banks-systems-keep-failing/ https://the-ken.com/story/sorry-for-the-inconvenience-why-yo... (behind paywall but a good read). These are the "star" private banks, let's not get into the state of public banks.
- HJain13 6y ago
  Honestly SBI architecture feels so much better than HDFC though.. Even though SBI is state run and HDFC is public
olliej 6y ago
And unlike python, it stills works fine.
davchana 6y ago
Hdfc & SBI being my major banks since last one-two decades, SBI's online banking is way better than HDFC's although former is a government bank.
beyondcompute 6y ago
The code quality is one thing but its longevity doesn’t seem to me like a problem in itself.
forgotmypw17 6y ago
I am obsessive about backwards compatibility, and I test back to Netscape 2.0 (the first JS platform). The magic of JS feature check abilities is that you can totally cover every browser. There's a little bit of testing you have to do, because early browser wars resulted in intentionally added incompatibility gotchas, but it's not that bad. The Web is an amazing and unique platform unlike almost any other available to us. We're so lucky to have it.
- buro9 6y ago
  But why? I recently ran Netscape 4 for the giggles and +90% of the web no longer functions as I could not load the pages due to the protocols no longer being supported. You may be testing against JS features but in reality those browsers cannot function on the open internet as their protocol and security stacks aren't supported. A simple check of caniuse.com is sufficient, but if you're worried here's which browsers are in use https://caniuse.com/usage-table https://caniuse.com/usage-table . Netscape no longer even registers.
  - forgotmypw17 6y ago
    Because I can. Because I like them. Because I believe in Any Browser. Because of retro-computing. Because with every known scenario I cover, several more unanticipated ones are also covered. Also, yes, I can imagine being limited to a particular older version of a browser, NN 2.0 included. Because it's fun as heck. Because I'm fucking tired of browser monoculture and I want the Web to be compatible again. If I, one determined developer, can make it work in Mosaic, IE3, Netscape, Opera 3 and 12, Lynx, Links, Dillo, Netsurf, w3m, PaleMoon, Waterfox, Google Translate, and yeah, with some grinding, Chrome, with and without JS, hopefully some devs out there feel embarrassed for their code and try a little harder...
    - ssijak 6y ago
      Why would anyone ever be embarrassed that their code from 2021 is not working on IE3 or Netscape?
throwaway4good 6y ago
Given how old it is, it is pretty good. Maybe better than 80% of what else is out there. Luckily today we have build tools to prevent us showing our dirty laundry in public.
graderjs 6y ago
Wow i love the retro view functions, string concat templating and use of document write!
clever_king 6y ago
Do you read the report from Microsoft? India is most vulnerable to cyberattack.
- sumedh 6y ago
  Why is that relevant here?
tushar-r 6y ago
Interesting timing, given that I'm currently running through hoops with a simple address change with their bank. Their web & mobile apps suck bigtime, and it looks like they aren't even making an effort to make online transactions easier.
- majjgepolja 6y ago
  It's true for many bank systems I guess. I have been under serious troubles in past because a Bank randomly blocked my ATM card & UPI.
dfgdghdf 6y ago
Keeping file version history inside the file makes me feel queasy.
- aitchnyu 6y ago
  Indian here. My boss told me he had to apply for exclusive permission to modify a certain file from a boss. Code reviews were in pen and paper.
abhas9 6y ago
Interesting to note that one of the consultants [1] who worked on this codebase 20 years back is now an architect in the same company. ``` 25//2001 Gopi Yedla Changed code for new FD opening ``` Service company that wrote the code has changed it's name from i-flex to Oracle Financials.[2] Imagine finding the code you wrote today in a random internet discussion in 2040. [1] https://www.linkedin.com/in/gopiyedla/ https://www.linkedin.com/in/gopiyedla/ [2] https://www.firstpost.com/business/biztech/i-flex-solutions-is-now-oracle-financial-services-1865643.html https://www.firstpost.com/business/biztech/i-flex-solutions-...
- hiyer 6y ago
  i-Flex (now Oracle Financials as you have pointed out) is not a service company - Flexcube is their own product.
  - Aperocky 6y ago
    Is this the same flexcube that caused citibank to hotwire 500 million dollars of premature debt? I remember a story here not long ago.
    - hiyer 6y ago
      Yup, it's the same.
p_l 6y ago
2001 ? That's positively recent and modern compared to Lockheed-Martin and their "our target platform is IE7 on XP, let's use a random JS script for DHTML menus we swiped off Geocities page in 1998 for Netscape 4 and IE4". ... to be honest I think that while it was one of the worst dependencies, it was still ages beyond the code they wrote themselves ¯\_(ツ)_/¯
- 29athrowaway 6y ago
  Until 2 years ago, the US armed forces were using 8-inch floppy disks in nuclear silos. Not 3 1/2", not 5 1/4"... 8 inches. https://www.cnet.com/news/us-military-retires-floppy-disks-used-by-nuclear-weapons-system/ https://www.cnet.com/news/us-military-retires-floppy-disks-u...
  - p_l 6y ago
    The difference was that those 8" floppies were part of a well-tested system that was delivered when they were pretty current mature tech. Lockheed-Martin happily sold what I described as fresh development in 2012. EDIT: And unlike the system with 8" floppies, it never worked and resulted in 5 years of extra sunk costs til the whole critical system got yeeted and things were started from scratch.
    - 29athrowaway 6y ago
      The problem is that those 8" floppies are not manufactured anymore. And floppies are not meant to be durable and reliable in the long term.
      - p_l 6y ago
        That's why they finally migrated away from them. But you can be certain that they had stocks of floppies and possibly floppy emulators for dealing with that issue while it was in operation, plus setting up a small scale production for 8" floppies is less problematic than many would assume. In comparison, the new and wonderful system from Lockheed that I mentioned? It pretty sure never ran in "production environment" properly, and I shudder to think how much it and its knock-on effects cost.
baybal2 6y ago
I can't open it. Did we DDOS them?
bni 6y ago
Throw the first stone. 20 years ago I wrote code like this, probably some is still in use.
- durnygbur 6y ago
  Not guilty. I pay attention to work only on projects and in companies which will be discontinued or non-existent within 3-5 years.
yawaworht1978 6y ago
Hm last comment from 2016. But considering no date libraries were used and all browsers are covered, this is nice code. To me the new array() is a bit odd, was var array = [] not available yet?
kellengreen 6y ago
Honestly kudos to the team, I was expecting much worse. I can't imagine having some JS I wrote in the early 2000's on the front page of hacker news for the world to see.
praveen9920 6y ago
I have been using this bank for a while now and never bothered to check their client side code. I am surprised to see their js based encryption code. https://netbanking.hdfcbank.com/jsdir/des.js https://netbanking.hdfcbank.com/jsdir/des.js https://netbanking.hdfcbank.com/jsdir/HmacSHA256.js https://netbanking.hdfcbank.com/jsdir/HmacSHA256.js https://netbanking.hdfcbank.com/jsdir/rsa.js https://netbanking.hdfcbank.com/jsdir/rsa.js
randompwd 6y ago
In the section 'modification history' at the top of the file, it has entry. > 18/07/2017 4.2 MEHUL SHAH FLEXENH-194- R_ZINE ONE So, not exactly 2001.
gnu8 6y ago
No part of this work may be reproduced, stored in a retrieval system, adopted or transmitted in any form or by any means, electronic, mechanical, photographic, graphic, optic recording or otherwise, translated in any language or computer language, without the prior written permission of i-flex Solutions Limited. This language would seem to make it legally awkward to even visit the web site, much less have this discussion.
andi999 6y ago
So what's the problem? Next breaking news is that banks run a backend in COBOL?
- weare138 6y ago
  It's not even from 2001. There's a changelog and release dates right there in the beginning of the script. Last update was in 2017 and is version 4.2.
hesarenu 6y ago
This reminds me of the issue i had faced on setting up account on HDFC. I entered a very long password. When i tried to login it kept failing. I was sure of the password. So clicked on reset password. Bank sent me plain password in email. And the password was cut off to 8 chars!. This happened decade ago though.
distantsounds 6y ago
Wait until you guys find out your operating systems were written in a 50 year old language.
- deleted 6y ago
  [deleted]
- nicbou 6y ago
  By people who communicate in a thousand year old language, no less
WD-42 6y ago
The red flag is in the first 20 lines of code, after the comments. The original variable definitions were all formatted nice so that the values line up. Then later coders came along and added more stuff but didn’t bother following the original formatting, messing it up. It’s a sign of the attitude of the programmers and probably reflects the quality of the actual business logic code as well.
- asddubs 6y ago
  actually, I think this file just suffers from the eternal tabs/spaces war. looks like it was edited by people who have 4-character long tabs, using spaces in their editors. you can see it in the credits too. and of course, "var" + tab would show up the same as "var" + space if your tabs are 4-wide
jfrunyon 6y ago
Okay, so, as you can see in the first page, it is in fact not from 2001, but instead at least 2017. This is like saying that Windows 10 is from 1985. Just because the first version came out then doesn't mean the latest version did. Also, just because something is old does not make it bad. How old is `mv`?
sequoia 6y ago
I love how nicely documented it is, with revisions & author names there at the top of the file. Very nice touch!
smilebot 6y ago
I'd take it as a compliment if my code was still in use 20 years down the line.
peanut_worm 6y ago
Didn’t know there were ternary operators in 2001 JS
WesleyJohnson 6y ago
When I see somewhat obtuse code like this, I often want to see how well I could refactor it using modern techniques. No frameworks or anything crazy, in this case just vanilla JS, but using current best practices and enhancements in the both the language and JS at the browser level. It's arguably a waste of time, but it does it always seems like a fun challenge. I'm sure I'm not alone in this. Is there a more constructive use of that time, while getting the same dopamine hit? I suppose the obvious answer is freelance markets, but I doubt many people are paying out for "just" refactoring.
stunt 6y ago
Traditional companies just don't know about building software. They often start an IT transformation initiative because a consultancy firm told them they have to do. But at best, still all the middle managers don't buy the idea and don't commit to it. Even when they do, they lack knowledge and expertise to be successful and company doesn't know how to train them. So they end up doing some stuff that may sound fancy on paper (Oh we are doing Serverless), but they are still building crappy integrations and they suffer from bad communication structure. Banks are innovating in traditional banking. They make fancier branches and better ATM machines, but they fail to innovate in software space while their customers are increasingly using more digital interfaces. And that's how they can't compete with modern FinTech players when it comes to development pace. They are just suck at software and they are lots of middle managers that unintentionally make it even harder.
ramji123456 6y ago
What is security Impact ????its a simple JS file.
ramji123456 6y ago
People are just spreading the rummer about the Banks with out knowing the Security Impact. Mr.Mihir Chaturvedi have you know the impact ???? OR just spreading this news for the publicity or fame ????

136 points by plibither8 6y ago

Doesn't look too bad to be honest, considering when it was written. There are some oddities like the functions "returnTrue" and "returnFalse". Other than that, don't fix what ain't broken?

keanebean86 6y ago
I wonder if stuff like this is taught in India schools? I work with multiple India devs and they do this all the time. Our code has stuff like below that drives me nuts. public static boolean TRUE = true; I've directly asked if they think TRUE will some day need to be set to false but they just ignore me.
- durnygbur 6y ago
  > TRUE will some day need to be set to false It will happen one day, it will go into production, and the app will work surprisingly well with some subtle glitches. After revealing all contractor devs will make poker face and things will continue as before.
  - patrickthebold 6y ago
    One time we had a big launch of an important feature (for one noisy customer), we ended up with like 4 feature flags that we needed to flip once it was time to go live. Anyway the big day comes, we turn it on, everything looks good, everyone is happy. A few weeks later I noticed we forgot to turn one of the flags on. So I asked a teammate what he thought. He shrugged, we figured it would be slightly better to turn it on.
- rocknor 6y ago
  "They do this all the time"? The ignorance of generalizing a large country with a big population is astonishing. The problem is your employer paying peanuts as developer salaries. You'd get the same bad code if you paid peanuts to hire shitty developers in the US or EU.
  - keanebean86 6y ago
    So now you generalize that these devs are terrible? They do this one thing I don't like. That doesn't say anything about the quality of their work overall.
    - rocknor 6y ago
      Yes. If you hire someone for an excessively cheap rate, it is likely that they might not perform well. For example, assume the salary of a graduate salary in bay area is $100K. You can usually hire an equally skilled graduate in India at like 1/5th price. But if you instead hire ones that are OK with 1/10 or less, you are just asking for trouble. India has a surplus of engineering graduates, even people who have no business studying engineering get an engineering degree (because let's face it, not everyone is interested in STEM) - so they perform badly as expected. But that shouldn't discount the good ones (even if 10% are good, in absolute terms that's still a big number because of the population).
jakub_g 6y ago
Declaring functions like 'returnTrue' was a way to prevent memory leak in old IE (~IE6/IE7) (instead of creating a new inline function each time a method is called). It was especially important when a function is a closure and has a ton of variables visible in outer scope (in particular, refs to DOM nodes) and is called many times. Otherwise you end up with circular references between the objects and nothing can be garbage collected (GC implementation in old IE was very bad).
- petepete 6y ago
  I remember replacing some functions like this in a codebase I used to work on about twenty years ago. The senior dev at the time had to add them back a day or two later whe the site totally broke for IE users after a couple of minutes. Fun times.
  - bryanrasmussen 6y ago
    I hope he added in a comment /* don't remove or refactor this, IE6 will break */
    - uncledave 6y ago
      Oh god there’s so much of that I’ve written over the years. It’s still in there now. Fortunately minification eats my shame publicly. Think the worst one was we had some code that would add a pad in somewhere after the page was rendered that would cause IE6 to redraw the page correctly.

anonytrary 6y ago

I am impressed to see none of this prototype

durnygbur 6y ago
It takes a minimal understanding of JavaScript to use prototype. Here there is few methods figthing with and mangling the DOM and strings.
- anonytrary 6y ago
  Which is why I'm impressed. Enough prototype spam! Functional JS is the way to go.
  - durnygbur 6y ago
    this

villgax 6y ago

Obfuscation would have saved face

runawaybottle 6y ago
This is not really embarrassing code relatively speaking. Start replacing the global variables with ‘const one = useState(1)’, and get a few of those DOM elements into a render function, and it’ll start to look like what most front end people write now days. Split the helper/utility methods out to a helpers.js file, import in the ones you need. Swap out the Date and Number handling with native methods or decent library. I’d call this person crazy if he abstracted into something wholesale unnecessary like a state machine or a pub/sub pattern, or factory pattern, etc. So far so good, plenty to work with here. The person was not given any bad ideas to even contemplate writing it in anything but a straightforward way.

TedDoesntTalk 6y ago

function cancel_request () { window.history.back(); return false; } —- What?

bryanrasmussen 6y ago
window.history.back tells the browser when you have a chance execute a back navigation, control still has to be given back to the browser to do it.

segfaultbuserr 6y ago

Honestly, not too bad. At least it's organized as recognizable functions. It just has a lot of useless repetitions that should've been implemented as lookup tables or format strings. datestr += '<option value="" selected>-mmm-</option>'; datestr += '<option value="01">Jan</option>'; datestr += '<option value="02">Feb</option>'; datestr += '<option value="03">Mar</option>'; datestr += '<option value="04">Apr</option>'; datestr += '<option value="05">May</option>'; and case "alphanumhyphen": if(l_str.length >0 && l_str.search("[^A-Za-z0-9\-_]") >= 0 ){ if(p_alertFlg){ alert( p_fldTitle +" should contain Alphabets or Numbers or - or _"); } return "alphanumhyphen"; } break; case "numeric": if(l_str.length >0 && l_str.search("[^0-9]") >=0 ){ if(p_alertFlg){ alert( p_fldTitle +" should contain Numbers"); } return "numeric"; } break; case "decimal": if(l_str.length >0 && l_str.search("[^0-9.]") >=0 ){ if(p_alertFlg){ alert( p_fldTitle +" should be Numeric."); } return "decimal"; } break; What is the correct term to describe this type of code? I used to call it "Spaghetti Code". But I recently learned that it's incorrect. "Spaghetti Code" only refers to programs with messy and unclear control flows (especially unstructured programs that abuse goto), it's not the correct term for code with useless repetitions.

vincnetas 6y ago
I suggest "micromanaging". Instead of saying "do this 100 times for these parameters", you explicitly instruct to do things one by one without noticong that there's a pattern in your instructions.
- codeulike 6y ago
  Its cautious - each engineer that edits that file is changing the minimum necessary. You can bet a bunch of them looked at some of those functions and saw how they could be made more consise or less repetitive - but if its all working why take the risk? Its just creating more work for the people downstream who have to test and sign off every change. There's a lot to be said for boring, easy to understand code.

rlv-dan 6y ago

If you think this is old, you should see the mainframes running our bank systems...

SavantIdiot 6y ago
Banamex still runs Unisys on VMs in the cloud.

blntechie 6y ago

For people who don't know, this bank (HDFC) was dinged and penalized by the central governing bank (Reserve Bank of India) because of the frequent outages of their banking systems. They restricted the bank from issuing new credit cards for a year which is a big penalty all things considered. Also, they were given a deadline to get their tech stable and they actually brought in an IT provider for the bank to fix things which was bit high handed. But the bank was very big in the country and a failure can have cascading affects which was the reason said by the central governing bank. I believe it was the first of the kind in the country to penalize a bank because their tech was unstable.

ffpip 6y ago
https://www.google.com/search?q=HDFC+RBI+IT&oq=HDFC+RBI+IT&client=firefox-b-d https://www.google.com/search?q=HDFC+RBI+IT&oq=HDFC+RBI+IT&c...
tushar-r 6y ago
>They restricted the bank from issuing new credit cards for a year which is a big penalty all things considered. This is hilarious because they are actively offering credit card upgrades all around right now.
- fatboy93 6y ago
  Not really, they are trying to sidegrades or downgrades. For eg, Regalia first -> millenia; which is a flat out downgrade!
  - tushar-r 6y ago
    Some yes, a lot of Regalia people are being given Infinia. Like me, when I barely use it (-8
    - manojlds 6y ago
      Without the fee or with?

rgj 6y ago

I love this function returnFalse () {return false} and the fact that their home cooked date_val() function does not use their home cooked isLeapYear() and daysInMonth() functions, but uses its own, pretty much unreadable, leap year determination algorithm. var l_k=parseInt(l_y%100) var l_m=parseInt(l_y/100) if (l_d == 29 && ((l_y/4)!=parseInt(l_y/4))) { l_err=1 ; l_errstring = "Date is invalid."; } if(l_k ==0){ if (l_d == 29 && ((l_m/4)!=parseInt(l_m/4))) { l_err=1 ; l_errstring = "Date is invalid."; } }

jakub_g 6y ago
See my comment on returnFalse: https://news.ycombinator.com/item?id=26473819 https://news.ycombinator.com/item?id=26473819
- rgj 6y ago
  Never knew. Cool to know, thanks.
jiofih 6y ago
Yeah they would be much better off importing a few npm packages for that, and setting up some CI to build this with webpack and deploy to serverless /s Nothing wrong with the code per se - a little formatting and nicer variable names would make it entirely readable. Having the entire logic inline might be intentional so you can cross-check (legal) requirements and avoid transitive dependencies - the handling of dates specified might not necessarily match what’s “technically correct” at all times. Anyone writing Go will be familiar with this style.

ncann 6y ago

On the topic of banks and software, I can't understand for the life of me why almost all of the banks in Canada and US have comical level of security. Most don't offer 2FA (of all the banks on Canada, the only one with 2FA is TD if I recall). Those who do only have 2FA through SMS so good luck travelling out of country. Many still have pin-only passwords with 4-8 digits limit...

phist_mcgee 6y ago
Good old fashioned legacy systems. Decades and decades of consultants throwing garbage at more garbage. Endless uplift projects and corporate reshuffles slicing tech stacks in two, and sewing them back up. Banks are utterly famous for this stuff, and I think the new trend at least here in Australia is to start spin off 'neobanks' that begin with a fresh slate, but are still owned by their parent bank.
Vespasian 6y ago
Probably they not legally mandated to offer it and are not liable for hacked accounts. A few years back a German/EU law required banks to introduce real 2fa for customer logins and payments. The deadline had to be extended several times and still some banks and merchants missed it.
mschuster91 6y ago
> On the topic of banks and software, I can't understand for the life of me why almost all of the banks in Canada and US have comical level of security. Multiple reasons: 1) They're banks. Banks are run by the worst type of MBA beancounters you can imagine - all that counts is profits (and the more the better, which is why way too many banks dabble in investment banking aka legalized gambling), and IT doesn't bring in profits, so generally bank IT is only doing the utterly minimal effort that is required to stay in compliance with regulatory demands. As you can imagine, they're pretty much overwhelmed when they get requirements that require overhauls - e.g. the EU mandating overnight SEPA transfers or real-time identity confirmation (PSD2). 2) The tech stacks are comically old and complex (which is the reason for pin-only passwords). The decades-old mainframe stack with hundreds of custom built applications interfacing to it means that even something as innocent as alphanumeric passwords may be all but impossible to do. And don't get me started on Unicode, you're lucky if the base minimum that all connected applications understand is something like ISO-8859. 3) Related to this: as the software is so old, it literally embodies decades of knowledge of all possible kind of "edge cases" and hidden assumptions. Like... developers assume that a dead person stays dead, which is a sane thing to believe since zombies aren't real, but then you have someone declared dead by court reappear alive, and suddenly the workflow breaks down. Or that someone who registered as male can't change their legal gender, or that there are only two genders (which is quite fucking over many many MANY industries who implemented gender as a boolean, e.g. is_female), or that a marriage exclusively consists of husband and wife (changing that one is costing the public sector an awful lot of work, even many years after same-sex marriage got legalized in Germany). 4) Security audits in big companies (not just banks) are just checklists for insurance vendors, no matter if they actually make sense or not. All that matters for the C-level execs is "assuming someone hacks us, will insurance find a way to deny payments?" and not "is this actually secure?". 5) Regulatory agencies are so risk averse it hurts. What they don't know for years is haram - Kubernetes? Cloud hosting? Even proposing that will get you as a developer a shoot-down order from legal, since the regulatory agencies won't certify it. Source: done a couple jobs involving either interfacing or directly working with medical and banking services.

bmurray7jhu 6y ago

Flexcube is the same software package that caused Citi to accidentally send $900 million. https://arstechnica.com/tech-policy/2021/02/citibank-just-got-a-500-million-lesson-in-the-importance-of-ui-design/ https://arstechnica.com/tech-policy/2021/02/citibank-just-go...

hiyer 6y ago
i-Flex, the maker of Flexcube, was my first company out of college. I stuck around only for a month or so, but in that time we had a brief training on the software. The interface was a smorgasbord of buttons and inputs, and I couldn't make head or tail of anything on it. Good to see that things haven't changed in over a decade since then.

_kblcuk_ 6y ago

They're pretty optimistic about how long this script will be in use: ``` if (l_y < 1900 || l_y > 9999) { l_err = 1 ; l_errstring = "Year is invalid."; } ```

onion2k 6y ago
My frontend date code just passes a millisecond timestamp to the JS Date object constructor to do validation, so technically any code I've written could be actively deployed until the maximum valid JS Date, which is in the year 275,760. (https://262.ecma-international.org/5.1/#sec-15.9.1.1 https://262.ecma-international.org/5.1/#sec-15.9.1.1) Something has gone seriously wrong with human society if that ever actually happens.

rockyj 6y ago

"The Ken" had an good article on the state of Indian bank's IT systems - https://the-ken.com/story/sorry-for-the-inconvenience-why-your-banks-systems-keep-failing/ https://the-ken.com/story/sorry-for-the-inconvenience-why-yo... (behind paywall but a good read). These are the "star" private banks, let's not get into the state of public banks.

HJain13 6y ago
Honestly SBI architecture feels so much better than HDFC though.. Even though SBI is state run and HDFC is public

olliej 6y ago

And unlike python, it stills works fine.

davchana 6y ago

Hdfc & SBI being my major banks since last one-two decades, SBI's online banking is way better than HDFC's although former is a government bank.

beyondcompute 6y ago

The code quality is one thing but its longevity doesn’t seem to me like a problem in itself.

forgotmypw17 6y ago

I am obsessive about backwards compatibility, and I test back to Netscape 2.0 (the first JS platform). The magic of JS feature check abilities is that you can totally cover every browser. There's a little bit of testing you have to do, because early browser wars resulted in intentionally added incompatibility gotchas, but it's not that bad. The Web is an amazing and unique platform unlike almost any other available to us. We're so lucky to have it.

buro9 6y ago
But why? I recently ran Netscape 4 for the giggles and +90% of the web no longer functions as I could not load the pages due to the protocols no longer being supported. You may be testing against JS features but in reality those browsers cannot function on the open internet as their protocol and security stacks aren't supported. A simple check of caniuse.com is sufficient, but if you're worried here's which browsers are in use https://caniuse.com/usage-table https://caniuse.com/usage-table . Netscape no longer even registers.
- forgotmypw17 6y ago
  Because I can. Because I like them. Because I believe in Any Browser. Because of retro-computing. Because with every known scenario I cover, several more unanticipated ones are also covered. Also, yes, I can imagine being limited to a particular older version of a browser, NN 2.0 included. Because it's fun as heck. Because I'm fucking tired of browser monoculture and I want the Web to be compatible again. If I, one determined developer, can make it work in Mosaic, IE3, Netscape, Opera 3 and 12, Lynx, Links, Dillo, Netsurf, w3m, PaleMoon, Waterfox, Google Translate, and yeah, with some grinding, Chrome, with and without JS, hopefully some devs out there feel embarrassed for their code and try a little harder...
  - ssijak 6y ago
    Why would anyone ever be embarrassed that their code from 2021 is not working on IE3 or Netscape?

throwaway4good 6y ago

Given how old it is, it is pretty good. Maybe better than 80% of what else is out there. Luckily today we have build tools to prevent us showing our dirty laundry in public.

graderjs 6y ago

Wow i love the retro view functions, string concat templating and use of document write!

clever_king 6y ago

Do you read the report from Microsoft? India is most vulnerable to cyberattack.

sumedh 6y ago
Why is that relevant here?

tushar-r 6y ago

Interesting timing, given that I'm currently running through hoops with a simple address change with their bank. Their web & mobile apps suck bigtime, and it looks like they aren't even making an effort to make online transactions easier.

majjgepolja 6y ago
It's true for many bank systems I guess. I have been under serious troubles in past because a Bank randomly blocked my ATM card & UPI.

dfgdghdf 6y ago

Keeping file version history inside the file makes me feel queasy.

aitchnyu 6y ago
Indian here. My boss told me he had to apply for exclusive permission to modify a certain file from a boss. Code reviews were in pen and paper.

abhas9 6y ago

Interesting to note that one of the consultants [1] who worked on this codebase 20 years back is now an architect in the same company. ``` 25//2001 Gopi Yedla Changed code for new FD opening ``` Service company that wrote the code has changed it's name from i-flex to Oracle Financials.[2] Imagine finding the code you wrote today in a random internet discussion in 2040. [1] https://www.linkedin.com/in/gopiyedla/ https://www.linkedin.com/in/gopiyedla/ [2] https://www.firstpost.com/business/biztech/i-flex-solutions-is-now-oracle-financial-services-1865643.html https://www.firstpost.com/business/biztech/i-flex-solutions-...

hiyer 6y ago
i-Flex (now Oracle Financials as you have pointed out) is not a service company - Flexcube is their own product.
- Aperocky 6y ago
  Is this the same flexcube that caused citibank to hotwire 500 million dollars of premature debt? I remember a story here not long ago.
  - hiyer 6y ago
    Yup, it's the same.

p_l 6y ago

2001 ? That's positively recent and modern compared to Lockheed-Martin and their "our target platform is IE7 on XP, let's use a random JS script for DHTML menus we swiped off Geocities page in 1998 for Netscape 4 and IE4". ... to be honest I think that while it was one of the worst dependencies, it was still ages beyond the code they wrote themselves ¯\_(ツ)_/¯

29athrowaway 6y ago
Until 2 years ago, the US armed forces were using 8-inch floppy disks in nuclear silos. Not 3 1/2", not 5 1/4"... 8 inches. https://www.cnet.com/news/us-military-retires-floppy-disks-used-by-nuclear-weapons-system/ https://www.cnet.com/news/us-military-retires-floppy-disks-u...
- p_l 6y ago
  The difference was that those 8" floppies were part of a well-tested system that was delivered when they were pretty current mature tech. Lockheed-Martin happily sold what I described as fresh development in 2012. EDIT: And unlike the system with 8" floppies, it never worked and resulted in 5 years of extra sunk costs til the whole critical system got yeeted and things were started from scratch.
  - 29athrowaway 6y ago
    The problem is that those 8" floppies are not manufactured anymore. And floppies are not meant to be durable and reliable in the long term.
    - p_l 6y ago
      That's why they finally migrated away from them. But you can be certain that they had stocks of floppies and possibly floppy emulators for dealing with that issue while it was in operation, plus setting up a small scale production for 8" floppies is less problematic than many would assume. In comparison, the new and wonderful system from Lockheed that I mentioned? It pretty sure never ran in "production environment" properly, and I shudder to think how much it and its knock-on effects cost.

baybal2 6y ago

I can't open it. Did we DDOS them?

bni 6y ago

Throw the first stone. 20 years ago I wrote code like this, probably some is still in use.

durnygbur 6y ago
Not guilty. I pay attention to work only on projects and in companies which will be discontinued or non-existent within 3-5 years.

yawaworht1978 6y ago

Hm last comment from 2016. But considering no date libraries were used and all browsers are covered, this is nice code. To me the new array() is a bit odd, was var array = [] not available yet?

kellengreen 6y ago

Honestly kudos to the team, I was expecting much worse. I can't imagine having some JS I wrote in the early 2000's on the front page of hacker news for the world to see.

praveen9920 6y ago

I have been using this bank for a while now and never bothered to check their client side code. I am surprised to see their js based encryption code. https://netbanking.hdfcbank.com/jsdir/des.js https://netbanking.hdfcbank.com/jsdir/des.js https://netbanking.hdfcbank.com/jsdir/HmacSHA256.js https://netbanking.hdfcbank.com/jsdir/HmacSHA256.js https://netbanking.hdfcbank.com/jsdir/rsa.js https://netbanking.hdfcbank.com/jsdir/rsa.js

randompwd 6y ago

In the section 'modification history' at the top of the file, it has entry. > 18/07/2017 4.2 MEHUL SHAH FLEXENH-194- R_ZINE ONE So, not exactly 2001.

gnu8 6y ago

No part of this work may be reproduced, stored in a retrieval system, adopted or transmitted in any form or by any means, electronic, mechanical, photographic, graphic, optic recording or otherwise, translated in any language or computer language, without the prior written permission of i-flex Solutions Limited. This language would seem to make it legally awkward to even visit the web site, much less have this discussion.

andi999 6y ago

So what's the problem? Next breaking news is that banks run a backend in COBOL?

weare138 6y ago
It's not even from 2001. There's a changelog and release dates right there in the beginning of the script. Last update was in 2017 and is version 4.2.

hesarenu 6y ago

This reminds me of the issue i had faced on setting up account on HDFC. I entered a very long password. When i tried to login it kept failing. I was sure of the password. So clicked on reset password. Bank sent me plain password in email. And the password was cut off to 8 chars!. This happened decade ago though.

distantsounds 6y ago

Wait until you guys find out your operating systems were written in a 50 year old language.

deleted 6y ago
[deleted]
nicbou 6y ago
By people who communicate in a thousand year old language, no less

WD-42 6y ago

The red flag is in the first 20 lines of code, after the comments. The original variable definitions were all formatted nice so that the values line up. Then later coders came along and added more stuff but didn’t bother following the original formatting, messing it up. It’s a sign of the attitude of the programmers and probably reflects the quality of the actual business logic code as well.

asddubs 6y ago
actually, I think this file just suffers from the eternal tabs/spaces war. looks like it was edited by people who have 4-character long tabs, using spaces in their editors. you can see it in the credits too. and of course, "var" + tab would show up the same as "var" + space if your tabs are 4-wide

jfrunyon 6y ago

Okay, so, as you can see in the first page, it is in fact not from 2001, but instead at least 2017. This is like saying that Windows 10 is from 1985. Just because the first version came out then doesn't mean the latest version did. Also, just because something is old does not make it bad. How old is `mv`?

sequoia 6y ago

I love how nicely documented it is, with revisions & author names there at the top of the file. Very nice touch!

smilebot 6y ago

I'd take it as a compliment if my code was still in use 20 years down the line.

peanut_worm 6y ago

Didn’t know there were ternary operators in 2001 JS

WesleyJohnson 6y ago

When I see somewhat obtuse code like this, I often want to see how well I could refactor it using modern techniques. No frameworks or anything crazy, in this case just vanilla JS, but using current best practices and enhancements in the both the language and JS at the browser level. It's arguably a waste of time, but it does it always seems like a fun challenge. I'm sure I'm not alone in this. Is there a more constructive use of that time, while getting the same dopamine hit? I suppose the obvious answer is freelance markets, but I doubt many people are paying out for "just" refactoring.

stunt 6y ago

Traditional companies just don't know about building software. They often start an IT transformation initiative because a consultancy firm told them they have to do. But at best, still all the middle managers don't buy the idea and don't commit to it. Even when they do, they lack knowledge and expertise to be successful and company doesn't know how to train them. So they end up doing some stuff that may sound fancy on paper (Oh we are doing Serverless), but they are still building crappy integrations and they suffer from bad communication structure. Banks are innovating in traditional banking. They make fancier branches and better ATM machines, but they fail to innovate in software space while their customers are increasingly using more digital interfaces. And that's how they can't compete with modern FinTech players when it comes to development pace. They are just suck at software and they are lots of middle managers that unintentionally make it even harder.

ramji123456 6y ago

What is security Impact ????its a simple JS file.

ramji123456 6y ago

People are just spreading the rummer about the Banks with out knowing the Security Impact. Mr.Mihir Chaturvedi have you know the impact ???? OR just spreading this news for the publicity or fame ????