11 ms·
> If you want to see what you should never do as a software engineer if you like not being in jail, this is it. Not quite the same level, but in my early days
by fatnoah 4y ago
> If you want to see what you should never do as a software engineer if you like not being in jail, this is it.
Not quite the same level, but in my early days working on a payment system, a request from the product team was to create a summary screen where customer service reps could see payment histories AND THE CC INFORMATION USED FOR THE PAYMENTS. In my mind, there was no way that would end well, so I strenuously objected and had to endure some very heated conversations over the course of a month or two. Eventually product team agreed to last 4 digits + expiration.
Nowadays it wouldn't even be a conversation, but in the early 2000's, it was a different world.
- IWillForgetThis 4y agoMy first job out of college (2007) involved a lot of removal of early 2000s one-off custom payment processing code. Access DBs full of years worth of credit card numbers, code that just emailed the credit card details to the site owner without keeping a record, etc. It was definitely a different world. Most of them, I just switched to PayPal shopping cart and checkout. In retrospect, I didn't know wtf I was doing and probably shouldn't have been working on it.
- michaelbuckbee 4y agoIf it's any consolation, the entire industry was in that state: poor controls, poor encryption, and security, etc.
- a2tech 4y ago"was"? It still seems like a confused mess with lots and log 'security' that people ignore
- michaelbuckbee 4y agoSure, there's always room for improvement, but at the very least SSL/TLS is ubiquitous now, there actual TLS versions are much better, developers generally view holding onto CC data directly as toxic (the growth of things like Stripe checkout, etc.)
- iamben 4y agoYeah, I worked for an agency around the same sort of time and saw exactly the same kind of thing. I remember one site that saved all the CC and order details to a plain text file in the web root. This was opened using an FTP programme every evening and someone would run the numbers through the machine in their store and post out the orders...
- verst 4y agoThis surprisingly sounds very much like the actual ACH system still in use today in the US (from my limited understanding)
- arealaccount 4y agoDo you mean not a conversation in the sense that we wouldn’t think of doing it, or in the sense that we wouldn’t think of questioning it?
- Tostino 4y agoI took it as "wouldn't think of doing it".
- TrickardRixx 4y agoWe wouldn't think of doing it. This is the kind of thing your auditors would see from outer space. If you're doing this and you don't have auditors, you're lying on your self-assessment questionnaire. Either way your merchant status is in jeopardy.
- fatnoah 4y agoYeah, I definitely meant the former. We (hopefully?) wouldn't even think of doing it.