18 ms·

EBCDIC Is Incompatible with GDPR

264 points by shakna 3y ago

thibaut_barrere 3y ago
As someone with diacritics in my family name, I can relate. Some years back I could not retrieve concert tickets bought at the FNAC (a large French music shop) even by name, and we figured out later that it was only because the è in my name had been replaced by a space due to mainframe conversion ^_^
- dathinab 3y ago
  putting aside that there is no language agnostic way to replace non us-ascii letters in Latin languages the sometimes absurd ways it can get done wrong are just rediculus like replacing letters with accents with spaces or some unknown letter mark instead of the letter without accent this also doesn't just apply to human names e.g. if you replace äöüß in German city names you can get the names of different existing cities and also it's often done wrong too (äöü are accents in Germanic languages, they are full independent letters which official us-ascii representations are ae,oe,ue)
  - account42 3y ago
    > if you replace äöüß in German city names you can get the names of different existing cities But town names are not unique to begin with.
    - dathinab 3y ago
      Neither are human names. The point is it's a different name which can lead to a name collisions where before there was none wore a collision which only happens on some systems. The result can be not so funny things from less harmful things like problems with reservations for idk. concert tickets or worse hotel rooms to very harmful things like you getting wrongly negative credit scores, being wrongfully investigated for a crime, getting your business bank account locked because of wrongful detection of likely supporting terrorists etc. And while some people might argue that given that human names are not unique non of this should happen that sadly isn't how the world works.And while I can't find links to it anymore because it was a few years ago there had been cases of the first two cases. And at least cases of the last wrt. other kinds of spelling errors so it definitely can happen.
bawolff 3y ago
Seems reasonable tbh. UTF-8 is 31 years old at this point. Unicode is even older, and various 8-bit code pages older still. At some point you have to get with the times.
- corbezzoli 3y ago
  > At some point you have to get with the times. Nobody wants to spend money and risk everything. There are so many industries where "getting with the times" is absolutely out of the question due to legal issues, as well as momentum. Aviation, healthcare, banking, …
  - davedx 3y ago
    That portrays it as if all the risk is on changing the system. Banks probably have to deal with a constant level of customer support if they don't store names properly. Credit checks probably go wrong, sometimes in ways that incur real financial losses on them. There is very real risk in refusing to make your software match reality.
  - jeroenhd 3y ago
    And, as this lawsuit shows, not getting with the times exposes the company to repercussions as well. I doubt a business would prefer their own schedule over one set by the court. ING Belgium found out the hard way, and I doubt this change to their systems was cheap. They were forced to alter a system that was due to be replaced (though that didn't happen in the expected timeline, surprise surprise) when they could've rolled out this change over a long period of time somewhere in the last two decades.
  - iSnow 3y ago
    If someone brings this up, I am actually happy if legislation forces them to do it. More often than not, it is possible and companies end up with better systems.
- rsynnott 3y ago
  Even if they are married to EBCDIC, EBCDIC _has code pages_.
dale_glass 3y ago
And good thing, IMO. You try and have a weird name in a foreign country. If you're not careful, everyone will spell it differently, and then you'll spend ages going "No, I'm sure I'm in your system. Try this other spelling". At least back in the 90s when I often had to deal with that, you were usually talking to a real life person, sitting on the other side of the desk. You could show them your documentation. Today since everything is online and computerized, the risk is that a computer somewhere in the chain will just go "The bits don't match", and it'll be challenge to even reach a real person, let alone one capable of even understanding what problem you're having. Here's a real problem this could cause: To get a visa you usually need to prove ties to your country. This normally includes a bank extract. If the name printed on your bank extract doesn't match what's printed on your documentation that means a very real risk of rejection, and not going anywhere if you can't fix it fast enough. And I can imagine other very not fun possibilities, like having some sort of KYC/AML snag where something decides you lied about your name.
- dathinab 3y ago
  > weird name to double down on it it's not even about a weird name per-se but lot of very normal EU names if a lot of early IT wouldn't have been dominated by a US "works for us must work for everyone" approach I think we never would have ended up with such limitations common in legacy systems (there still would be limitations, pre-unicode the solution was custom code pages and similar, which all supported some subset of non us-ascii but only a subset) luckily today unicode is the standard (through for some cultural and historic aspects it's sometimes not enough)
  - taway1237 3y ago
    >US "works for us must work for everyone" approach I'm all for bashing the US, but I think this is a global ghing, not unique to the US.
    - corbezzoli 3y ago
      The difference is that most countries don't expect the world to bow to them (culturally, technologically, etc). While I used Chinese products, I never had to learn how to spell my name with Chinese characters.
high_5 3y ago
So I guess the bank was just too lazy to provide the character conversion before storing to EBCDIC, made cheap excuses and is now forced by GDPR? Good!
- thesnide 3y ago
  Proper encoding of your data is key indeed. I mean, user data should be treated as binary anyway. And then hashing it to whatever makes sense for performance. But still binary comparing for accuracy.
  - corbezzoli 3y ago
    > user data should be treated as binary anyway I don't know about that, there still needs to be some validation. Is your legal name really "Bobby $@134 Tables"? In this case validation comes in the form of "is every character EBCDIC-compatible?"
  - fyrn_ 3y ago
    What does "store as binary" even mean in this instance, binary is just ones and zeros. You have to decode it somehow for it to carry meaning. Maybe you meant opaque, but even that would the prevent normal display the data to the user. The user is not going to accept a hexadecimal binary form of their name, you can't sidestep Having to deal with encodings by just not specifying one. Also good moment to point out the you can't do a binary comparison of unicode strings, you need a unicode library that handles normalization.
  - JimDabell 3y ago
    That would mean that Zoë (spelt with U+0065 Latin Small Letter E followed by U+0308 Combining Diaeresis) wouldn’t match Zoë (spelt with U+00EB Latin Small Letter E with Diaeresis) even though they are the same name that just happen to be typed in on different platforms. Names exist at a different level of abstraction to binary and it’s a mistake to treat them as binary.
jdlan 3y ago
[flagged]
- bawolff 3y ago
  I mean, this about business requirements not tech. The bank can use any encoding they want to accomplish their requirements. Nobody is dictating a specific technical standard just the results.
- sph 3y ago
  Sadly, Hacker News hasn't been for or about hacker culture for a decade. It's become a "normie" programming-oriented news site.
  - MrBuddyCasino 3y ago
    It is the fate of all public online communities to asymptotically approach the intellectual level of Reddit, unless a strong & constant disciplinary force prevents it.
- Mashimo 3y ago
  I can't say if this law is stupid or not. A company has to be over 250 employés to be GDPR compliant. And it seems there is UTF-EBCDIC. I can see what you mean, but I don't think having rules for large banks is against the ~hacker etos~
  - xxs 3y ago
    >A company has to be over 250 employés to be GDPR compliant That's some proper juicy rumor - but it's entirely false.
    - Mashimo 3y ago
      My bad.
      - cccbbbaaa 3y ago
high_5 3y ago
But this one isn't! https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC
clort 3y ago
I don't really understand the banks point, given that https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC exists.
- corbezzoli 3y ago
  The point is that "nobody ever complained except you" and that programmers cost money, so no change is ever made. Then someone sued and they thought they'd still win this "frivolous litigation" that is "due to a technical limitation that is out of our reach."
  - xxs 3y ago
    GDPR is handled by the state - no idea how/where frivolous part comes from. The people can file complaints with the state/agency but not sue companies directly on their own for violations.
- dathinab 3y ago
  the problem is outside of the bare minimum they had to do for compliance this bank likely didn't do a proper software update in idk. 20-30 years... very trustworthy
  - drivingmenuts 3y ago
    If it ain’t broke (in a way that affects the bottom line), don’t put yer hamgrabbers anywhere near it.
    - dathinab 3y ago
      but it is broken, utf8 support need wasn't new when the law suite happened there is also the issue that I would be surprised if that system _didn't_ had tons of security vulnerabilities (which just weren't found because of it's obscurity). Heck, I have heard of enough cases where old banking systems had ton's of well known security issues in their interface they just "defined away" by means like "oh you need to be a bank employee to abuse them so they are not an issue" or "pst, don't speak about it we (supposedly) can't afford an update and they would fire people if they need to do an update".
agilob 3y ago
My surname once broke authentication system behind my university. Any time I tried to login, it would crash for a few minutes logging out other users. Years later when I got my British passport it also contained my surname "latinised". I was told I should mail Home Office and get some certification that naturalisation certificates and passports don't include special accented letters and in fact the passport contains a mistake that cannot be corrected in the passport. Technically I have my Polish passport with different surname than the British one. This story isn't that unusual.
- taway1237 3y ago
  Also Polish, my pet peeve is having to write my latinised name into forms that specifically say "please enter your name EXACTLY like in your passport".
  - xxs 3y ago
    Polish still use Roman alphabet for the most part, compare that to Greeks or Bulgarians.
    - jacquesm 3y ago
      "for the most part" -> except for ą, ć, ę, ł, ń, ó, ś, ź and ż.
      - Dylan16807 3y ago
        What do you mean by "except"? Other than maybe ł, those all look like they're mostly Roman letters to me. Half of them add the same single line that isn't even attached to the rest of the letter! That's a world apart from φ and Д.
        xxs 3y ago
        "ł" is the lower case of "Ł". It's not pronounced L, though. Writing-wise, it is there. Else, the Italians, French and the like don't appear to be using Roman, either.
LinAGKar 3y ago
ASCII too for that matter
nemoniac 3y ago
2021. Has anything been done about it in the meantime?
corbezzoli 3y ago
Users don't care about technical debt. > Falsehoods Project Managers Believe About Technical Debt
- onetimeuse92304 3y ago
  Yeah. This is how you get company like Blizzard make a super expensive complete flops like Diablo IV. By having stupid beliefs about what your users want. Or ever better, by having your own wants, and projecting those wants at your understanding what the users want. You lie to yourself for long enough and you start believing it. Recently the way I approach choosing software has changed. I found I spend too much time dealing with problems and issues because whoever produced the software does not really care to ship working product or features that would make my life better. So now I prioritise choosing reliable software and companies that care for me, the user (at least more than their competitors). You can imagine things like basically every Micro$oft product got dumped immediately. I now refuse my family requests to support their MS-powered machines and tell them if they want Windows they will have to support it themselves, I don't have time to deal with this crap. I found by sweeping the stuff that gives me headaches I have improved my life and productivity even if I have to use some more expensive or sometimes functionally inferior products (and sometimes do it manually).
  - corbezzoli 3y ago
    > I now refuse my family requests to support their MS-powered machines No joke, I think I bought my first serious girlfriend a MacBook because I did not want to deal with Windows in my house anymore.
  - Deukhoofd 3y ago
    > super expensive complete flops like Diablo IV Wasn't Diablo IV the best selling game for Blizzard ever?
    - fernandotakai 3y ago
      yup. it was not a flop by any means. i think it sold over 10mi copies.
bdowling 3y ago
The least bad solution for the bank is probably to close the customer’s account, because overhauling the system will surely be too expensive. No, it’s not a good solution, but realistically what is the bank supposed to do?
- soneil 3y ago
  "realistically" .. I don't think it's much to ask a Belgian bank (or offering accounts in Belgium) to actually support Belgian customers? Unless they let go of every single customer with diacritics in their name, the complaint would still stand. Especially since the case is brought by a government body, not the end-customer. The "throw your hands in the air" move for the bank wouldn't be to ditch this single customer, it'd be to ditch the entire eurozone. Remediation is likely cheaper.
  - bdowling 3y ago
    There appears to be a supreme court of Belgium (called the Court of Cassation), so maybe the bank has another possible appeal. I’m sure it will be expensive.
    - masklinn 3y ago
      It seems doubtful they’d win in cassation as the GDPR does literally say that personal data shall be accurate (article 5 1.d) and that personal data subjects have a right of rectification (article 14). Their only possible argument would be that fixing their shit is not a “reasonable step”. I’m not sure that even falls under the purview of the cour de cassation, but IANAL so I’m not quite clear on what a “matter of law” is exactly.
- mort96 3y ago
  Closing a customer's account because they made a lawful request for something they're entitled to through the GDPR sounds incredibly illegal.
- arp242 3y ago
  They were already in the process of overhauling the systems, which will allow diacritics, and expected it will be finished in 2020 (I don't know if they met that target).
PinguTS 3y ago
Funny, just yesterday I listened to a podcast were a small part they were talking about retro-computing. They ware talking about AS400 and that they are still in use, if you think about Amadeus, one of the worldwide flight-booking systems for example. That some banks in their backend still use AS400 and EBCDIC. The thing why these systems are not being updated is more like: never change a winning team. Because you can spend millions to update those systems just to discover that there is an error in your update. So you spent millions for nothing or even worse. The is not real technical benefit for them to update as long as the systems run.
- planb 3y ago
  Fellow German Freak Show listener? :)
  - PinguTS 3y ago
    Coincidence? ;)
    - deleted 3y ago
      [deleted]
Intermernet 3y ago
I'd like to say that the banks argument is only valid if they're being lazy. AS/400 (now System i) can support Unicode through extensions. They may need to rewrite portions of their code, but it's not impossible, and in the last few decades is inexcusable. https://www.ibm.com/docs/en/i/7.4?topic=unicode-i https://www.ibm.com/docs/en/i/7.4?topic=unicode-i https://www.ibm.com/docs/en/i/7.4?topic=wu-how-unicode-relates-prior-standards-such-as-ascii-ebcdic https://www.ibm.com/docs/en/i/7.4?topic=wu-how-unicode-relat...
- giamma 3y ago
  Having worked for 20 years in fintech, I have seen many large European and Asian banks running on COBOL programs written 30 years ago, using EBCDIC. In many cases the sources for some of those programs are lost, due to the fact that proper version control systems did not exist at that time, and nobody dares to re-implement them because they are scared of regressions.
  - Intermernet 3y ago
    Yep, this is true, but I spent years working on AS/400 systems dealing with this exact issue. The thing is that the data isn't stored on a standard file-system. The record definition can be updated, in most situations, without modifying the application code very much at all. This isn't like an app that most people these days have experience with. IBM did everything they could so, if you followed the guidelines when the code was written, it was minimally painful to fix stuff like this in the future. Everyone (including me) loves to give IBM shit, but they do actually know what they're doing when it comes to this stuff. There are many lessons and examples from mid-range and mainframe servers from IBM that are either ignored or re-invented in modern tech.
    - giamma 3y ago
      If I remember correctly, in 2010 or so Bank of China was using EBCDIC + a specific codepage by IBM to store successfully Chinese names in COBOL systems. Communication with those systems would happen using IBM MQ Series, a message queue system. The codepage was very specific, it was not part of the standard Java JDK but it was included in the IBM Java JDK.
seydor 3y ago
[flagged]
- xxs 3y ago
  I have the exact opposite opinion. Anything specific part of reality GDPR violates?
  - seydor 3y ago
    - the existence of 'personal identifying data' - the personal ownership of data - the infungibility of data upon which the rights to own and delete rest - that data can be property, but also cannot be (i.e. cannot be exchanged with services)
    - xxs 3y ago
      those appear as point you'd just not like. None of them define reality, e.g. loyalty cards (or even personal id cards used as loyalty ones) effectively exchange personal data for services, i.e. monetary discounts.
    - Muromec 3y ago
      Yeah, the world is complicated. Fix your broken software or lose access to market. Signed, dated, EU
      - seydor 3y ago
        My problem is that I 'm in europe but don't sell to any europeans.
xxs 3y ago
Worse thing than that - it took roughly 9 months for a credit card of mine to be enabled. After many, many calls it turned out my name was too long... or more like it that I had submitted a middle name, the bank had not notation of such a thing, so they filled it as a first name (glued together as is tradition). Even both together are no so long - fewer than 4bits in length. In the end the bank did shorten my middle name, kept it as a sole letter.
ochrist 3y ago
Same goes for airline tickets. When you buy a ticket, the travel agency says that you should write your name exactly as in your passport, but on the ticket and boarding pass they then change it: Hyphenation is removed as well as accents.
- aleph_minus_one 3y ago
  > Hyphenation is removed as well as accents. What counts as accent vs letter depends a lot on the language. For example, in German the umlauts are considered own letters and not accented vowels, in Spanish ñ is considered an own letter and not an accented n etc.
jack1243star 3y ago
Unicode is the sane choice, sure, but it doesn't just work. Not with CJK Han Unification for the least.
- thriftwy 3y ago
  CJK countries had 25 years now to either work with Unicode WG or roll out their own approach. I'm not sure who can do that for them if they live with Unicode en masse.
  - jack1243star 3y ago
    > work with Unicode WG I don't see how can it be done with backward compatibility? The ship has sailed. I'd wager that Unicode is actively influencing Gen-Z CJK language users by introducing subtle character errors. I've seen elementary school students confused by differences between what they see in text books and on screen, and write wrong characters (because the online dictionary picked the wrong font).
    - aleph_minus_one 3y ago
      > I don't see how can it be done with backward compatibility? The ship has sailed. There exist other encodings for CJK characters than Unicode: https://en.wikipedia.org/w/index.php?title=CJK_characters&oldid=1180468573#Encoding https://en.wikipedia.org/w/index.php?title=CJK_characters&ol...
    - account42 3y ago
      Perhaps the Unicode consortium were really visionaries forseeing the actual unification of the character sets.
      - grotorea 3y ago
        I what the previous poster said counts as social engineering not clairvoyance.
    - 3y ago
jddj 3y ago
A large number of Irish and Irish descendants have a character in their surname that software developers tend to associate with various injection attacks. There's almost no chance of getting an apostrophe into a lot of these forms
- glonq 3y ago
  poor Bobby Tables... https://xkcd.com/327/ https://xkcd.com/327/
eru 3y ago
I agree on the object level that banks really ought to spell our names right. However I strongly doubt that we should force them to do so by law. And I am outright against using something called 'General Data Protection Regulation' to force internationalisation on organisations. If you want to force an organisation to support a sensible character set, please make a law or regulation that explicitly demands that. Instead of sneaking it in via the backdoor. Scope creep is just as bad for laws as it is for any other project.
- roblabla 3y ago
  The law clearly and unambiguously states that inaccuracies must be corrected by the data controller. That their tech stack doesn't support internationalization, rendering them incapable of fixing inaccuracies, is irrelevant (and their problem). This isn't a backdoor, it's the law working as intended.
  - dcminter 3y ago
    Strong agree. Competition around personal banking is notoriously weak. If it were stronger the banks would have a strong incentive to offer a good customer experience, but without it they'll stick with an old system that is "good enough" because that is cheaper than replacing it with one that actually offers a better customer experience. Well, now they have a strong financial incentive (fines) to make it better. Good job GDPR.
    - eru 3y ago
      Red tape, including GDPR, makes it harder to spin up competitors. Banking is one of the most regulated industries, hence the 'notoriously weak' competition.
    - snotrockets 3y ago
      Even if there was competition, banks, as an industry, are given a monopoly on a public service. Just like we shouldn't let the water company does whatever the f*k they want, but hold them to standards of service, the same is expected of banks.
thriftwy 3y ago
I wonder whether it is assumed that personal data has to come in a superset of Latin. I wonder if EU banks have to render your CJK name correctly, or a cyrillic one if their customer happens to be Bulgarian. And use that without falling back to some sort of transliteration.
lozenge 3y ago
Flagged because the courts decision is not mentioned in the article, so it's misleading headline.
kebsup 3y ago
I'm Czech, but living in Germany and Denmark, I had to replace the š with s in my name the majority of the time when dealing with online forms.
janandonly 3y ago
This is a post from 2021. The court awarded ~$1500 in damages. Shocking that a bank would have such an old system in operation. As a student, we visited ING HQ where a big server room was shown to us that ran virtualized version of much older systems. But I dare say that Rabobank and ABN-AMRO would have similar prehistoric systems in operation.
techbrovanguard 3y ago
my name has 1 (one) letter with an accent. i have had people and machines tell me "your name is invalid" my entire life. my citizenship certificate doesn't even match my birth certificate after i migrated. i will never yield to anglocentrism, the resistance only emboldens me. do your worst; my children will have names that'll make your qa leads have a conniption. it's really funny (see: depressing) hearing countries and organizations tout how "multicultural", "diverse", and "accepting" they are but will immediately turncoat upon being asked to do the work to support their claims. either store my name correctly or don't store it at all, jesus christ.
- anotherevan 3y ago
  > either store my name correctly or don't store it at all, jesus christ. Thats twelve letters (including the space).
  - Freak_NL 3y ago
    His first name might be Jésus. That would explain the diacritic character.
    - inkyoto 3y ago
      My interpretation is that the complainant's name is exactly one letter, and it is an accented one, e.g. Õ. Or Ě. Or Ů.
      - techbrovanguard 3y ago
        sorry, i phrased it poorly. my name has more than one letter, but includes one accented letter.
      - anotherevan 3y ago
        That was my interpretation as well. I was making a joke that the OP said his name had one letter, then indicated that his name was "jesus christ". (All lower-case, too!)
anotherevan 3y ago
I have a Scottish last name starting with "Mc" like "McTavish". Just getting people/companies to capitalise the third letter is an uphill battle some days. (Oh, and forget about having it sorted next to MacTavish as is tradition.)
- moffkalast 3y ago
  Do you at least get a discount in McDonalds? They would probably understand the pain.
  - anotherevan 3y ago
    No. In the 18 hundreds the McDonalds invaded our clan castle and turned it into a cheesy restaurant. The bad blood lives on.
  - deleted 3y ago
    [deleted]
papafox 3y ago
The fact that a personal name is stored in EBCDIC is missing the point. the mainframe has supported unicode for 20 years. The bank account holders name is stored in a character column in a database. Every character column can be defined with a different codepage, so it is possible to define the name column as stored in UTF-8, EBCDIC or any of a number of other codepages. For the bank to claim that the reason that they can store names containing diacritics because the name is coded in EBCDIC is nonsense. The bank just needs to change the database column definition to UTF-8.
- redserk 3y ago
  That’s assuming they didn’t develop the database in-house. If they concocted their own system, it very well could be that this data is in fixed-length records without much room for a quick fix. Regardless, it could eventually be done.
- xxxxxxxx 3y ago
  It might not be as easy as you think if the system has somehow survived without an upgrade for decades. Who knows, maybe it's that ancient? Back in the day I worked on CODASYL style databases (IDMS) that was EBCDIC. This is before relational databases were a thing. We had no PCs: all of the companies’ data was is in the Mainframe in EBCDIC. No ASCII anywhere, let alone UTF-8.
- masto 3y ago
  You were making a really solid-sounding technical argument, but then you used the phrase "just needs to", which, for me, triggers a tendency to discard whatever the person is telling me.
- ape4 3y ago
  They could use an UTF-8 type scheme to encode Unicode into plain EBCDIC ;) Edit: wow its already been done https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC
- RedShift1 3y ago
  It's never "just do this".
layer8 3y ago
I would have expected IBM to have defined UEBCDIC-8 by now, where the single-byte encodings are identical to EBCDIC ;). Those only include punctuation and control characters though, so that might be the problem.
- luckystarr 3y ago
  Actually, there is https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC
  - layer8 3y ago
    Hah! Somehow this was in the back of my head, but I couldn’t immediately find it.
wcoenen 3y ago
Missing context in the blog post: in the original court document, the bank mentions that it is already upgrading to a new system that doesn't have this issue. It just isn't done yet. So the bank isn't really refusing to fix this. They are just saying they can't fix it right now. Also, the idea in the blog post that everybody can simply choose not to use EBCDIC, is a bit naive. For example, the Visa protocol for payment messages contains message fields encoded in EBCDIC. This is a specification implemented by thousands of Visa member banks and various types of intermediaries. You can't "just change" anything in a spec like that without a massive amount of planning and pain.
- gpderetta 3y ago
  Surely they could think of a way to encode Unicode in EBCDIC.
  - em-bee 3y ago
    https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC
- jeroenhd 3y ago
  The document states that the modifications to the system should have been made in 2020, but in 2021 they still couldn't spell the names of all their customers right, and the bank refused to provide a concrete timeline for the fix. The project that was supposed to fix their naming problem ended up being too complicated to implement and they stuck with their old systems. International VISA transfers weren't the problem here. Bank statements and online environments carried the wrong name, and those had to be corrected. No sensible court would make a bank disconnect its payment systems because the receiving end uses a shitty system, but when it comes to communication between the bank and its customer, there is no such constraint. Furthermore, EBDIC had already been extended to support the problematic characters long before the lawsuit took place. "Yes but EBDIC database" wasn't a good excuse because EBDIC itself could handle this specific edge case just fine. By the time an investigation was done, the bank had made advancements and the name of the original plaintiff was representable, so they didn't receive a fine on that count (though they ended up receiving an impartiality related fine for their privacy officer) according to https://ellentimmer.com/2022/01/12/banken-7/ https://ellentimmer.com/2022/01/12/banken-7/
McDyver 3y ago
If the person had applied for a credit card, used it, then refused to pay because the name is different from his legal one, I suppose it would be quickly fixed
jokethrowaway 3y ago
What a silly argument. My accountant keeps spelling my name wrong but I'm certainly not going to sue her. This is ridiculous and a clear demonstration of how far reaching government power is. If this doesn't make you concerned, we're in big troubles. Maybe the CRAp of CyberSecurity Resiliant Act will wake you up. Meanwhile I'll go pack my luggages
avidphantasm 3y ago
Why are companies so willing to ignore information technology maintenance? If you have a 40-year-old roof, it will need to be replaced at some point. Why is this any different? Aren’t they able to depreciate investments in information technology like any other asset? I’m not an MBA, so I don’t get it.
- amusingimpala75 3y ago
  If it ain’t broke don’t fix it. No one is going to be happy if you’re upgrading your system to allow diacritics in the name and suddenly all their money disappears. There’s a reason they use COBOL so much and that is because they haven’t needed to replace it. Replacing it just because it’s old just seems like chasing the new ideas for the sake of it.
SeanLuke 3y ago
It's been pointed out in the article's comments that the article is wrong. EBCDIC code pages 37 and 1047 each have support for all of Latin-1. The bank just doesn't want to support it. Furthermore, UTF-EBCDIC is a thing. https://en.wikipedia.org/wiki/Code_page_37 https://en.wikipedia.org/wiki/Code_page_37 https://en.wikibooks.org/wiki/Character_Encodings/Code_Tables/EBCDIC/EBCDIC_1047 https://en.wikibooks.org/wiki/Character_Encodings/Code_Table... https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC
- NelsonMinar 3y ago
  Wow, UTF-EBCDIC is a new one on me! Ugh. Wikipedia says "This encoding form is rarely used, even on the EBCDIC-based mainframes for which it was designed" so that's encouraging.
- SeanLuke 3y ago
  Huh, someone on Wikipedia must have seen my link to their Code Page 37 article and deleted the entire article 6 hours later. Seems pretty harsh. Wikipedia can have lists of all available Troll Dolls but it can't have an article on an important EBCDIC code page because it's not "encyclopedic" enough.
  - anticensor 3y ago
    They moved it to Wikibooks instead.
danbruc 3y ago
Close your account and go to another bank that can deal with your name properly if that is so important to you, but do not waste resources of the legal system with stuff like this. That is what we have free markets for.
- scrollaway 3y ago
  Given that it is a free market, who are you to tell this person where they can and cannot spend their personal legal budget?
  - danbruc 3y ago
    I am not talking about their legal budget but the taxpayer money financing the courts.
    - ihumanable 3y ago
      As a taxpayer I'm fine with this, and I don't recall electing you to police how the courts are used.
      - danbruc 3y ago
        I am not policing anyone, I am expressing my opinion that this is not a worthwhile use of the justice system.
alkonaut 3y ago
The information wasn't inaccurate, it was encoded as accurately as possible in a specific encoding. I can't see how anything would be "inaccurate" in any way the lawmakers intended.
benj111 3y ago
Why didn't they just argue that rather than a name per se it's a unique identifier. It's a bit weird, but presumably you could address someone as Dear 01769357 A photo on a driver's license is inherently lossy, it would be unreasonable to expect a perfect image of your face.
nuc1e0n 3y ago
Codepage 1047, which is EBCDIC based, supports all the same characters that ISO8859-1 (latin 1) does. This includes diacritic characters. Beyond that, IBM mainframes also work with UTF-16 natively. Can't the Dutch bank upgrade their mainframe?
- petree 3y ago
  Latin 1 doesn't cover all languages that use a Latin script, and has an incomplete character set for others.
  - nuc1e0n 3y ago
    I agree, but I saw it claimed EBCDIC doesn't cover diacritic characters. That's not true. If ISO8859-1 covers the exact same set that CP1047 does and that doesn't meet GDPR's requirements, that implies ISO8859-1 doesn't either and a unicode based character encoding is a necessity for GDPR compliance. Then again, unicode doesn't cover the late artist formerly known as Prince's written name either. All things considered, IBM should work with that Dutch bank to move their system over to UTF-16. It's the natural progression of such things.
2d8a875f-39a2-4 3y ago
It's annoying when organisations bork your name, but how does this relate to GDPR?
billpg 3y ago
"Call Bob. He is the only person who knows how to maintain this system." "Bob died. Ten years ago."
- haolez 3y ago
  This actually happened at my previous company. The sole maintainer of a legacy system was a contractor in his sixties and he died due to COVID. The system was still unmaintained and falling apart when I left.
- _Microft 3y ago
  Does that mean that we need to call the necromancer again? He scares me...
randyrand 3y ago
now imagine if your name had characters that are not in UTF-8! you’ll be in for a long road
- Asooka 3y ago
  This is why my bank only stores people's names as bitmap images. Simply draw your name in the provided blank on the website. Just make sure the pixels are identical each time. For a password, whistle a melody in your microphone. Your password must contain at least 3 microtones, a rising pitch, a falling pitch and a glottal click; also it cannot be similar to any known pop songs.
ahhfgsado6698 3y ago
Partly it's a lie that the stack forces them to use EBCDIC. There's plenty good ASCII and even UTF-8 support on mainframes even in the traditional OS's. They just refuse to rewrite the customer facing portion of their application for whatever reason.
ahhfgsado6698 3y ago
There's plenty good ASCII and UTF8 support on mainframes. They just don't want to rewrite any of their ancient application, which could easily have a more modern UI slapped on it that could in various ways support more modern encodings, even if they left parts of the backend in EBCDIC.
jjice 3y ago
I interned at a large-ish retail company in the US and we had an IBM mainframe that hosted the core DB2 server. I remember when I first learned of EBCDIC because of that IBM machine and I was blown away. Never had I worked with a character encoding that wasn't at least ASCII compatible. ASCII's table layout had some real benefits to it, like being able to flip the fifth (?) bit to change case of characters. Did the EBCDIC layout have any serious benefits? I have to assume there are but my quick web search didn't come up with anything.
yieldcrv 3y ago
Oh awesome, I’m about to sue every airline that can’t handle the hyphen in my name, EBCDIC can handle hyphens but it would be funny if some other system is just as limited behind the scenes for an amusing quagmire I’m an American though, in the US, how can I leverage GDPR for this I’ve booked flights throughout Europe before on European airlines. But I’ve also accessed American airline sites from Europe. I can VPN through Europe and do the same thing right now. Which version lets me lob a complaint? And to which country?
Fischgericht 3y ago
Obviously that is a troll. Who cares that your name on a bank statement does not contain your diacritics? Yes, of course it would be nice if all inter-banking systems would support UTF8 or at least ASCII. But they don't. There are various inter-banking systems that simply are so old that they only support EBCDIC. Newer do, but even quite modern SWIFT still requires the EBCDIC set to make sure data goes through to each and every bank on this planet. And in practice, if you have diacritics in your name, and do any kind of international business or travel, you are used to having found a transcription to use. My wife has a diacritic in her last name. Even if forms at airlines now support entering them, she NEVER does. Because you can be sure that sooner or later in your travel, with this name getting copied to some immigration system, Covid health certificate database etc, it will get corrupted. She never had any problems whatsoever with having her name transcribed on all travel documents, but with her passport containing her name with diacritics. Because, surprise, while I don't know what exact encoding the digital part of the passport contains, and least the machine readable line also uses only the ASCII or EBCDIC character set. So the best way to handle this technological debt is not to sue someone, but just use whatever that machine readable line in your passport days. Names suck, anyway. The idea of having NON-UNIQUE identifiers to uniquely identify human instances is stupid anyway. Everyone on this planet should simply get a UNIQUE name in an universally agreed character set. I'd be even OK with Base64 of UTF8 ;)
- yieldcrv 3y ago
  > So the best way to handle this technological debt is not to sue someone, but just use whatever that machine readable line in your passport days. Interfacing with the state is in the form of lawsuits, this is the proscribed remedy the state told everyone to do. The cultural meaning and gravity of “sue” is irrelevant, and only puts those with that belief system at a disadvantage.
- petree 3y ago
  Sometimes the lack of diacritic can change the meaning of the name for the worse and either way, names are deeply personal things that people are attached to, so they might want to have it written correctly, regardless. I wouldn't want someone to mispell my name.
somat 3y ago
I think that I am on the banks side. The name they have in their database represents you, the person, this is the same concept as the account number that represents you. If the character set they use is unable to handle the characters you normally use, they will substitute characters to get as close as they can. As an extreme example, say I go to japan where the restaurant owner dutifully writes my name down as "ソマット" should I get angry because it is not in latin characters?
- gdprrrr 3y ago
  French is an official language of Belgium
TacticalCoder 3y ago
Where do you draw the line? Is a bank in the EU supposed to enter names of japanese clients using kanjis and/or kanas? And how are bank clerks supposed to enter characters that aren't on their keyboards?
ozb 3y ago
I never really understood the insistence on diacritics. My name is properly written in Hebrew characters, and contains sounds not present in the English language. Many more people use CJK, Cyrillic, Arabic, or other characters. The writing system in use by many people and companies for the English language does not support any of these characters, and nor does it support diacritics. Some variants (in particular, see airlines) use only capital letters, with no spaces or dashes; this also seems reasonable to me (even when my name is somewhat mangled as a result). So just like a CJK/Cyrillic/Semitic name has to be roughly transliterated into Latin characters, and inevitably pronounced differently than in its origin language, why shouldn't the same be true for names with diacritics? Saying that the One True International Alphabet is latin-1 or whatever is rather arbitrary. And no, the solution isn't to give up on cross-cultural communication, nor to require that every human learn all the characters in Unicode.
- PeterisP 3y ago
  A Belgian bank requiring a Belgian person to transliterate their Belgian name to English characters is somewhat similar to an Israel bank requiring to transliterate your name from Hebrew to Korean (which has as much relevance to Israel as English has for Belgium), and refusing to use Hebrew in their communication. There are official national languages and alphabets, the involved characters are key parts of those national alphabets - who cares about what the English alphabet is? Neither the bank nor the customer are in England or in an English-speaking country, and there is a legal duty for the bank to support the national language(s).
  - ozb 3y ago
    You're right, I was thinking of this in the context of an English-speaking country/institution (mostly since I do often see this demand in those contexts as well; to be clear, I think it's a reasonable request, but not a reasonable demand or legal requirement). In the context of a Belgian customer of a Belgian bank it's definitely more surprising; but I also wouldn't categorize it as "inaccurate personal information", but awkward transliteration to a foreign alphabet; as you said, that may be strange and possibly even run afoul of national language laws, but I wouldn't use GDPR against it > [Korean] has as much relevance in Israel as English has in Belgium Legally maybe, but certainly not demographically/culturally; I mean, certainly there is a difference in the expected probability of being understood, especially given the highly-overlapping character sets
PeterStuer 3y ago
"It baffles me that it was still being used in 1995 - let alone today" This person obviously has never seen the inards of a bank's IT department. That core mainframe isn't going to be replaced anytime, it runs code older than he is, and workarounds that would satisfy the complaint would be very large projects with small chance of success. Pragmatic solutions such as having the correctly spelled name at the top of a report indicating that in the rest of the docs this person will be referred to as the EBCDIC coded name should be aceptable.
peapicker 3y ago
I have worked on systems that had to do this in the long-ago past, and the headline is simply wrong. There are many 8-bit EBCDIC code pages that support many languages (multi-hundred page book of them last I looked at it), at least as many as ISO-8859 alphabet soup encodings... and there are also shift-in/shift-out double byte EBCDIC encodings for Japanese, Korean, and Simplified and Traditional Chinese. They've been around since the 1980s at least. Since nesrly the beginning of utf8 acceptance, there is also UTF8-EBCDIC (shudder) The bank developers just didn't write their code in a way that can support the multi-codepage way of storing EBCDIC.

264 points by shakna 3y ago

As someone with diacritics in my family name, I can relate. Some years back I could not retrieve concert tickets bought at the FNAC (a large French music shop) even by name, and we figured out later that it was only because the è in my name had been replaced by a space due to mainframe conversion ^_^

dathinab 3y ago
putting aside that there is no language agnostic way to replace non us-ascii letters in Latin languages the sometimes absurd ways it can get done wrong are just rediculus like replacing letters with accents with spaces or some unknown letter mark instead of the letter without accent this also doesn't just apply to human names e.g. if you replace äöüß in German city names you can get the names of different existing cities and also it's often done wrong too (äöü are accents in Germanic languages, they are full independent letters which official us-ascii representations are ae,oe,ue)
- account42 3y ago
  > if you replace äöüß in German city names you can get the names of different existing cities But town names are not unique to begin with.
  - dathinab 3y ago
    Neither are human names. The point is it's a different name which can lead to a name collisions where before there was none wore a collision which only happens on some systems. The result can be not so funny things from less harmful things like problems with reservations for idk. concert tickets or worse hotel rooms to very harmful things like you getting wrongly negative credit scores, being wrongfully investigated for a crime, getting your business bank account locked because of wrongful detection of likely supporting terrorists etc. And while some people might argue that given that human names are not unique non of this should happen that sadly isn't how the world works.And while I can't find links to it anymore because it was a few years ago there had been cases of the first two cases. And at least cases of the last wrt. other kinds of spelling errors so it definitely can happen.

bawolff 3y ago

Seems reasonable tbh. UTF-8 is 31 years old at this point. Unicode is even older, and various 8-bit code pages older still. At some point you have to get with the times.

corbezzoli 3y ago
> At some point you have to get with the times. Nobody wants to spend money and risk everything. There are so many industries where "getting with the times" is absolutely out of the question due to legal issues, as well as momentum. Aviation, healthcare, banking, …
- davedx 3y ago
  That portrays it as if all the risk is on changing the system. Banks probably have to deal with a constant level of customer support if they don't store names properly. Credit checks probably go wrong, sometimes in ways that incur real financial losses on them. There is very real risk in refusing to make your software match reality.
- jeroenhd 3y ago
  And, as this lawsuit shows, not getting with the times exposes the company to repercussions as well. I doubt a business would prefer their own schedule over one set by the court. ING Belgium found out the hard way, and I doubt this change to their systems was cheap. They were forced to alter a system that was due to be replaced (though that didn't happen in the expected timeline, surprise surprise) when they could've rolled out this change over a long period of time somewhere in the last two decades.
- iSnow 3y ago
  If someone brings this up, I am actually happy if legislation forces them to do it. More often than not, it is possible and companies end up with better systems.
rsynnott 3y ago
Even if they are married to EBCDIC, EBCDIC _has code pages_.

dale_glass 3y ago

And good thing, IMO. You try and have a weird name in a foreign country. If you're not careful, everyone will spell it differently, and then you'll spend ages going "No, I'm sure I'm in your system. Try this other spelling". At least back in the 90s when I often had to deal with that, you were usually talking to a real life person, sitting on the other side of the desk. You could show them your documentation. Today since everything is online and computerized, the risk is that a computer somewhere in the chain will just go "The bits don't match", and it'll be challenge to even reach a real person, let alone one capable of even understanding what problem you're having. Here's a real problem this could cause: To get a visa you usually need to prove ties to your country. This normally includes a bank extract. If the name printed on your bank extract doesn't match what's printed on your documentation that means a very real risk of rejection, and not going anywhere if you can't fix it fast enough. And I can imagine other very not fun possibilities, like having some sort of KYC/AML snag where something decides you lied about your name.

dathinab 3y ago
> weird name to double down on it it's not even about a weird name per-se but lot of very normal EU names if a lot of early IT wouldn't have been dominated by a US "works for us must work for everyone" approach I think we never would have ended up with such limitations common in legacy systems (there still would be limitations, pre-unicode the solution was custom code pages and similar, which all supported some subset of non us-ascii but only a subset) luckily today unicode is the standard (through for some cultural and historic aspects it's sometimes not enough)
- taway1237 3y ago
  >US "works for us must work for everyone" approach I'm all for bashing the US, but I think this is a global ghing, not unique to the US.
  - corbezzoli 3y ago
    The difference is that most countries don't expect the world to bow to them (culturally, technologically, etc). While I used Chinese products, I never had to learn how to spell my name with Chinese characters.

high_5 3y ago

So I guess the bank was just too lazy to provide the character conversion before storing to EBCDIC, made cheap excuses and is now forced by GDPR? Good!

thesnide 3y ago
Proper encoding of your data is key indeed. I mean, user data should be treated as binary anyway. And then hashing it to whatever makes sense for performance. But still binary comparing for accuracy.
- corbezzoli 3y ago
  > user data should be treated as binary anyway I don't know about that, there still needs to be some validation. Is your legal name really "Bobby $@134 Tables"? In this case validation comes in the form of "is every character EBCDIC-compatible?"
- fyrn_ 3y ago
  What does "store as binary" even mean in this instance, binary is just ones and zeros. You have to decode it somehow for it to carry meaning. Maybe you meant opaque, but even that would the prevent normal display the data to the user. The user is not going to accept a hexadecimal binary form of their name, you can't sidestep Having to deal with encodings by just not specifying one. Also good moment to point out the you can't do a binary comparison of unicode strings, you need a unicode library that handles normalization.
- JimDabell 3y ago
  That would mean that Zoë (spelt with U+0065 Latin Small Letter E followed by U+0308 Combining Diaeresis) wouldn’t match Zoë (spelt with U+00EB Latin Small Letter E with Diaeresis) even though they are the same name that just happen to be typed in on different platforms. Names exist at a different level of abstraction to binary and it’s a mistake to treat them as binary.

jdlan 3y ago

[flagged]

bawolff 3y ago
I mean, this about business requirements not tech. The bank can use any encoding they want to accomplish their requirements. Nobody is dictating a specific technical standard just the results.
sph 3y ago
Sadly, Hacker News hasn't been for or about hacker culture for a decade. It's become a "normie" programming-oriented news site.
- MrBuddyCasino 3y ago
  It is the fate of all public online communities to asymptotically approach the intellectual level of Reddit, unless a strong & constant disciplinary force prevents it.
Mashimo 3y ago
I can't say if this law is stupid or not. A company has to be over 250 employés to be GDPR compliant. And it seems there is UTF-EBCDIC. I can see what you mean, but I don't think having rules for large banks is against the ~hacker etos~
- xxs 3y ago
  >A company has to be over 250 employés to be GDPR compliant That's some proper juicy rumor - but it's entirely false.
  - Mashimo 3y ago
    My bad.
    - cccbbbaaa 3y ago

high_5 3y ago

But this one isn't! https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC

clort 3y ago

I don't really understand the banks point, given that https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC exists.

corbezzoli 3y ago
The point is that "nobody ever complained except you" and that programmers cost money, so no change is ever made. Then someone sued and they thought they'd still win this "frivolous litigation" that is "due to a technical limitation that is out of our reach."
- xxs 3y ago
  GDPR is handled by the state - no idea how/where frivolous part comes from. The people can file complaints with the state/agency but not sue companies directly on their own for violations.
dathinab 3y ago
the problem is outside of the bare minimum they had to do for compliance this bank likely didn't do a proper software update in idk. 20-30 years... very trustworthy
- drivingmenuts 3y ago
  If it ain’t broke (in a way that affects the bottom line), don’t put yer hamgrabbers anywhere near it.
  - dathinab 3y ago
    but it is broken, utf8 support need wasn't new when the law suite happened there is also the issue that I would be surprised if that system _didn't_ had tons of security vulnerabilities (which just weren't found because of it's obscurity). Heck, I have heard of enough cases where old banking systems had ton's of well known security issues in their interface they just "defined away" by means like "oh you need to be a bank employee to abuse them so they are not an issue" or "pst, don't speak about it we (supposedly) can't afford an update and they would fire people if they need to do an update".

agilob 3y ago

My surname once broke authentication system behind my university. Any time I tried to login, it would crash for a few minutes logging out other users. Years later when I got my British passport it also contained my surname "latinised". I was told I should mail Home Office and get some certification that naturalisation certificates and passports don't include special accented letters and in fact the passport contains a mistake that cannot be corrected in the passport. Technically I have my Polish passport with different surname than the British one. This story isn't that unusual.

taway1237 3y ago
Also Polish, my pet peeve is having to write my latinised name into forms that specifically say "please enter your name EXACTLY like in your passport".
- xxs 3y ago
  Polish still use Roman alphabet for the most part, compare that to Greeks or Bulgarians.
  - jacquesm 3y ago
    "for the most part" -> except for ą, ć, ę, ł, ń, ó, ś, ź and ż.
    - Dylan16807 3y ago
      What do you mean by "except"? Other than maybe ł, those all look like they're mostly Roman letters to me. Half of them add the same single line that isn't even attached to the rest of the letter! That's a world apart from φ and Д.
      - xxs 3y ago
        "ł" is the lower case of "Ł". It's not pronounced L, though. Writing-wise, it is there. Else, the Italians, French and the like don't appear to be using Roman, either.

LinAGKar 3y ago

ASCII too for that matter

nemoniac 3y ago

2021. Has anything been done about it in the meantime?

corbezzoli 3y ago

Users don't care about technical debt. > Falsehoods Project Managers Believe About Technical Debt

onetimeuse92304 3y ago
Yeah. This is how you get company like Blizzard make a super expensive complete flops like Diablo IV. By having stupid beliefs about what your users want. Or ever better, by having your own wants, and projecting those wants at your understanding what the users want. You lie to yourself for long enough and you start believing it. Recently the way I approach choosing software has changed. I found I spend too much time dealing with problems and issues because whoever produced the software does not really care to ship working product or features that would make my life better. So now I prioritise choosing reliable software and companies that care for me, the user (at least more than their competitors). You can imagine things like basically every Micro$oft product got dumped immediately. I now refuse my family requests to support their MS-powered machines and tell them if they want Windows they will have to support it themselves, I don't have time to deal with this crap. I found by sweeping the stuff that gives me headaches I have improved my life and productivity even if I have to use some more expensive or sometimes functionally inferior products (and sometimes do it manually).
- corbezzoli 3y ago
  > I now refuse my family requests to support their MS-powered machines No joke, I think I bought my first serious girlfriend a MacBook because I did not want to deal with Windows in my house anymore.
- Deukhoofd 3y ago
  > super expensive complete flops like Diablo IV Wasn't Diablo IV the best selling game for Blizzard ever?
  - fernandotakai 3y ago
    yup. it was not a flop by any means. i think it sold over 10mi copies.

bdowling 3y ago

The least bad solution for the bank is probably to close the customer’s account, because overhauling the system will surely be too expensive. No, it’s not a good solution, but realistically what is the bank supposed to do?

soneil 3y ago
"realistically" .. I don't think it's much to ask a Belgian bank (or offering accounts in Belgium) to actually support Belgian customers? Unless they let go of every single customer with diacritics in their name, the complaint would still stand. Especially since the case is brought by a government body, not the end-customer. The "throw your hands in the air" move for the bank wouldn't be to ditch this single customer, it'd be to ditch the entire eurozone. Remediation is likely cheaper.
- bdowling 3y ago
  There appears to be a supreme court of Belgium (called the Court of Cassation), so maybe the bank has another possible appeal. I’m sure it will be expensive.
  - masklinn 3y ago
    It seems doubtful they’d win in cassation as the GDPR does literally say that personal data shall be accurate (article 5 1.d) and that personal data subjects have a right of rectification (article 14). Their only possible argument would be that fixing their shit is not a “reasonable step”. I’m not sure that even falls under the purview of the cour de cassation, but IANAL so I’m not quite clear on what a “matter of law” is exactly.
mort96 3y ago
Closing a customer's account because they made a lawful request for something they're entitled to through the GDPR sounds incredibly illegal.
arp242 3y ago
They were already in the process of overhauling the systems, which will allow diacritics, and expected it will be finished in 2020 (I don't know if they met that target).

PinguTS 3y ago

Funny, just yesterday I listened to a podcast were a small part they were talking about retro-computing. They ware talking about AS400 and that they are still in use, if you think about Amadeus, one of the worldwide flight-booking systems for example. That some banks in their backend still use AS400 and EBCDIC. The thing why these systems are not being updated is more like: never change a winning team. Because you can spend millions to update those systems just to discover that there is an error in your update. So you spent millions for nothing or even worse. The is not real technical benefit for them to update as long as the systems run.

planb 3y ago
Fellow German Freak Show listener? :)
- PinguTS 3y ago
  Coincidence? ;)
  - deleted 3y ago
    [deleted]

Intermernet 3y ago

I'd like to say that the banks argument is only valid if they're being lazy. AS/400 (now System i) can support Unicode through extensions. They may need to rewrite portions of their code, but it's not impossible, and in the last few decades is inexcusable. https://www.ibm.com/docs/en/i/7.4?topic=unicode-i https://www.ibm.com/docs/en/i/7.4?topic=unicode-i https://www.ibm.com/docs/en/i/7.4?topic=wu-how-unicode-relates-prior-standards-such-as-ascii-ebcdic https://www.ibm.com/docs/en/i/7.4?topic=wu-how-unicode-relat...

giamma 3y ago
Having worked for 20 years in fintech, I have seen many large European and Asian banks running on COBOL programs written 30 years ago, using EBCDIC. In many cases the sources for some of those programs are lost, due to the fact that proper version control systems did not exist at that time, and nobody dares to re-implement them because they are scared of regressions.
- Intermernet 3y ago
  Yep, this is true, but I spent years working on AS/400 systems dealing with this exact issue. The thing is that the data isn't stored on a standard file-system. The record definition can be updated, in most situations, without modifying the application code very much at all. This isn't like an app that most people these days have experience with. IBM did everything they could so, if you followed the guidelines when the code was written, it was minimally painful to fix stuff like this in the future. Everyone (including me) loves to give IBM shit, but they do actually know what they're doing when it comes to this stuff. There are many lessons and examples from mid-range and mainframe servers from IBM that are either ignored or re-invented in modern tech.
  - giamma 3y ago
    If I remember correctly, in 2010 or so Bank of China was using EBCDIC + a specific codepage by IBM to store successfully Chinese names in COBOL systems. Communication with those systems would happen using IBM MQ Series, a message queue system. The codepage was very specific, it was not part of the standard Java JDK but it was included in the IBM Java JDK.

seydor 3y ago

[flagged]

xxs 3y ago
I have the exact opposite opinion. Anything specific part of reality GDPR violates?
- seydor 3y ago
  - the existence of 'personal identifying data' - the personal ownership of data - the infungibility of data upon which the rights to own and delete rest - that data can be property, but also cannot be (i.e. cannot be exchanged with services)
  - xxs 3y ago
    those appear as point you'd just not like. None of them define reality, e.g. loyalty cards (or even personal id cards used as loyalty ones) effectively exchange personal data for services, i.e. monetary discounts.
  - Muromec 3y ago
    Yeah, the world is complicated. Fix your broken software or lose access to market. Signed, dated, EU
    - seydor 3y ago
      My problem is that I 'm in europe but don't sell to any europeans.

xxs 3y ago

Worse thing than that - it took roughly 9 months for a credit card of mine to be enabled. After many, many calls it turned out my name was too long... or more like it that I had submitted a middle name, the bank had not notation of such a thing, so they filled it as a first name (glued together as is tradition). Even both together are no so long - fewer than 4bits in length. In the end the bank did shorten my middle name, kept it as a sole letter.

ochrist 3y ago

Same goes for airline tickets. When you buy a ticket, the travel agency says that you should write your name exactly as in your passport, but on the ticket and boarding pass they then change it: Hyphenation is removed as well as accents.

aleph_minus_one 3y ago
> Hyphenation is removed as well as accents. What counts as accent vs letter depends a lot on the language. For example, in German the umlauts are considered own letters and not accented vowels, in Spanish ñ is considered an own letter and not an accented n etc.

jack1243star 3y ago

Unicode is the sane choice, sure, but it doesn't just work. Not with CJK Han Unification for the least.

thriftwy 3y ago
CJK countries had 25 years now to either work with Unicode WG or roll out their own approach. I'm not sure who can do that for them if they live with Unicode en masse.
- jack1243star 3y ago
  > work with Unicode WG I don't see how can it be done with backward compatibility? The ship has sailed. I'd wager that Unicode is actively influencing Gen-Z CJK language users by introducing subtle character errors. I've seen elementary school students confused by differences between what they see in text books and on screen, and write wrong characters (because the online dictionary picked the wrong font).
  - aleph_minus_one 3y ago
    > I don't see how can it be done with backward compatibility? The ship has sailed. There exist other encodings for CJK characters than Unicode: https://en.wikipedia.org/w/index.php?title=CJK_characters&oldid=1180468573#Encoding https://en.wikipedia.org/w/index.php?title=CJK_characters&ol...
  - account42 3y ago
    Perhaps the Unicode consortium were really visionaries forseeing the actual unification of the character sets.
    - grotorea 3y ago
      I what the previous poster said counts as social engineering not clairvoyance.
  - 3y ago

jddj 3y ago

A large number of Irish and Irish descendants have a character in their surname that software developers tend to associate with various injection attacks. There's almost no chance of getting an apostrophe into a lot of these forms

glonq 3y ago
poor Bobby Tables... https://xkcd.com/327/ https://xkcd.com/327/

eru 3y ago

I agree on the object level that banks really ought to spell our names right. However I strongly doubt that we should force them to do so by law. And I am outright against using something called 'General Data Protection Regulation' to force internationalisation on organisations. If you want to force an organisation to support a sensible character set, please make a law or regulation that explicitly demands that. Instead of sneaking it in via the backdoor. Scope creep is just as bad for laws as it is for any other project.

roblabla 3y ago
The law clearly and unambiguously states that inaccuracies must be corrected by the data controller. That their tech stack doesn't support internationalization, rendering them incapable of fixing inaccuracies, is irrelevant (and their problem). This isn't a backdoor, it's the law working as intended.
- dcminter 3y ago
  Strong agree. Competition around personal banking is notoriously weak. If it were stronger the banks would have a strong incentive to offer a good customer experience, but without it they'll stick with an old system that is "good enough" because that is cheaper than replacing it with one that actually offers a better customer experience. Well, now they have a strong financial incentive (fines) to make it better. Good job GDPR.
  - eru 3y ago
    Red tape, including GDPR, makes it harder to spin up competitors. Banking is one of the most regulated industries, hence the 'notoriously weak' competition.
  - snotrockets 3y ago
    Even if there was competition, banks, as an industry, are given a monopoly on a public service. Just like we shouldn't let the water company does whatever the f*k they want, but hold them to standards of service, the same is expected of banks.

thriftwy 3y ago

I wonder whether it is assumed that personal data has to come in a superset of Latin. I wonder if EU banks have to render your CJK name correctly, or a cyrillic one if their customer happens to be Bulgarian. And use that without falling back to some sort of transliteration.

lozenge 3y ago

Flagged because the courts decision is not mentioned in the article, so it's misleading headline.

kebsup 3y ago

I'm Czech, but living in Germany and Denmark, I had to replace the š with s in my name the majority of the time when dealing with online forms.

janandonly 3y ago

This is a post from 2021. The court awarded ~$1500 in damages. Shocking that a bank would have such an old system in operation. As a student, we visited ING HQ where a big server room was shown to us that ran virtualized version of much older systems. But I dare say that Rabobank and ABN-AMRO would have similar prehistoric systems in operation.

techbrovanguard 3y ago

my name has 1 (one) letter with an accent. i have had people and machines tell me "your name is invalid" my entire life. my citizenship certificate doesn't even match my birth certificate after i migrated. i will never yield to anglocentrism, the resistance only emboldens me. do your worst; my children will have names that'll make your qa leads have a conniption. it's really funny (see: depressing) hearing countries and organizations tout how "multicultural", "diverse", and "accepting" they are but will immediately turncoat upon being asked to do the work to support their claims. either store my name correctly or don't store it at all, jesus christ.

anotherevan 3y ago
> either store my name correctly or don't store it at all, jesus christ. Thats twelve letters (including the space).
- Freak_NL 3y ago
  His first name might be Jésus. That would explain the diacritic character.
  - inkyoto 3y ago
    My interpretation is that the complainant's name is exactly one letter, and it is an accented one, e.g. Õ. Or Ě. Or Ů.
    - techbrovanguard 3y ago
      sorry, i phrased it poorly. my name has more than one letter, but includes one accented letter.
    - anotherevan 3y ago
      That was my interpretation as well. I was making a joke that the OP said his name had one letter, then indicated that his name was "jesus christ". (All lower-case, too!)

anotherevan 3y ago

I have a Scottish last name starting with "Mc" like "McTavish". Just getting people/companies to capitalise the third letter is an uphill battle some days. (Oh, and forget about having it sorted next to MacTavish as is tradition.)

moffkalast 3y ago
Do you at least get a discount in McDonalds? They would probably understand the pain.
- anotherevan 3y ago
  No. In the 18 hundreds the McDonalds invaded our clan castle and turned it into a cheesy restaurant. The bad blood lives on.
- deleted 3y ago
  [deleted]

papafox 3y ago

The fact that a personal name is stored in EBCDIC is missing the point. the mainframe has supported unicode for 20 years. The bank account holders name is stored in a character column in a database. Every character column can be defined with a different codepage, so it is possible to define the name column as stored in UTF-8, EBCDIC or any of a number of other codepages. For the bank to claim that the reason that they can store names containing diacritics because the name is coded in EBCDIC is nonsense. The bank just needs to change the database column definition to UTF-8.

redserk 3y ago
That’s assuming they didn’t develop the database in-house. If they concocted their own system, it very well could be that this data is in fixed-length records without much room for a quick fix. Regardless, it could eventually be done.
xxxxxxxx 3y ago
It might not be as easy as you think if the system has somehow survived without an upgrade for decades. Who knows, maybe it's that ancient? Back in the day I worked on CODASYL style databases (IDMS) that was EBCDIC. This is before relational databases were a thing. We had no PCs: all of the companies’ data was is in the Mainframe in EBCDIC. No ASCII anywhere, let alone UTF-8.
masto 3y ago
You were making a really solid-sounding technical argument, but then you used the phrase "just needs to", which, for me, triggers a tendency to discard whatever the person is telling me.
ape4 3y ago
They could use an UTF-8 type scheme to encode Unicode into plain EBCDIC ;) Edit: wow its already been done https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC
RedShift1 3y ago
It's never "just do this".

layer8 3y ago

I would have expected IBM to have defined UEBCDIC-8 by now, where the single-byte encodings are identical to EBCDIC ;). Those only include punctuation and control characters though, so that might be the problem.

luckystarr 3y ago
Actually, there is https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC
- layer8 3y ago
  Hah! Somehow this was in the back of my head, but I couldn’t immediately find it.

wcoenen 3y ago

Missing context in the blog post: in the original court document, the bank mentions that it is already upgrading to a new system that doesn't have this issue. It just isn't done yet. So the bank isn't really refusing to fix this. They are just saying they can't fix it right now. Also, the idea in the blog post that everybody can simply choose not to use EBCDIC, is a bit naive. For example, the Visa protocol for payment messages contains message fields encoded in EBCDIC. This is a specification implemented by thousands of Visa member banks and various types of intermediaries. You can't "just change" anything in a spec like that without a massive amount of planning and pain.

gpderetta 3y ago
Surely they could think of a way to encode Unicode in EBCDIC.
- em-bee 3y ago
  https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC
jeroenhd 3y ago
The document states that the modifications to the system should have been made in 2020, but in 2021 they still couldn't spell the names of all their customers right, and the bank refused to provide a concrete timeline for the fix. The project that was supposed to fix their naming problem ended up being too complicated to implement and they stuck with their old systems. International VISA transfers weren't the problem here. Bank statements and online environments carried the wrong name, and those had to be corrected. No sensible court would make a bank disconnect its payment systems because the receiving end uses a shitty system, but when it comes to communication between the bank and its customer, there is no such constraint. Furthermore, EBDIC had already been extended to support the problematic characters long before the lawsuit took place. "Yes but EBDIC database" wasn't a good excuse because EBDIC itself could handle this specific edge case just fine. By the time an investigation was done, the bank had made advancements and the name of the original plaintiff was representable, so they didn't receive a fine on that count (though they ended up receiving an impartiality related fine for their privacy officer) according to https://ellentimmer.com/2022/01/12/banken-7/ https://ellentimmer.com/2022/01/12/banken-7/

McDyver 3y ago

If the person had applied for a credit card, used it, then refused to pay because the name is different from his legal one, I suppose it would be quickly fixed

jokethrowaway 3y ago

What a silly argument. My accountant keeps spelling my name wrong but I'm certainly not going to sue her. This is ridiculous and a clear demonstration of how far reaching government power is. If this doesn't make you concerned, we're in big troubles. Maybe the CRAp of CyberSecurity Resiliant Act will wake you up. Meanwhile I'll go pack my luggages

avidphantasm 3y ago

Why are companies so willing to ignore information technology maintenance? If you have a 40-year-old roof, it will need to be replaced at some point. Why is this any different? Aren’t they able to depreciate investments in information technology like any other asset? I’m not an MBA, so I don’t get it.

amusingimpala75 3y ago
If it ain’t broke don’t fix it. No one is going to be happy if you’re upgrading your system to allow diacritics in the name and suddenly all their money disappears. There’s a reason they use COBOL so much and that is because they haven’t needed to replace it. Replacing it just because it’s old just seems like chasing the new ideas for the sake of it.

SeanLuke 3y ago

It's been pointed out in the article's comments that the article is wrong. EBCDIC code pages 37 and 1047 each have support for all of Latin-1. The bank just doesn't want to support it. Furthermore, UTF-EBCDIC is a thing. https://en.wikipedia.org/wiki/Code_page_37 https://en.wikipedia.org/wiki/Code_page_37 https://en.wikibooks.org/wiki/Character_Encodings/Code_Tables/EBCDIC/EBCDIC_1047 https://en.wikibooks.org/wiki/Character_Encodings/Code_Table... https://en.wikipedia.org/wiki/UTF-EBCDIC https://en.wikipedia.org/wiki/UTF-EBCDIC

NelsonMinar 3y ago
Wow, UTF-EBCDIC is a new one on me! Ugh. Wikipedia says "This encoding form is rarely used, even on the EBCDIC-based mainframes for which it was designed" so that's encouraging.
SeanLuke 3y ago
Huh, someone on Wikipedia must have seen my link to their Code Page 37 article and deleted the entire article 6 hours later. Seems pretty harsh. Wikipedia can have lists of all available Troll Dolls but it can't have an article on an important EBCDIC code page because it's not "encyclopedic" enough.
- anticensor 3y ago
  They moved it to Wikibooks instead.

danbruc 3y ago

Close your account and go to another bank that can deal with your name properly if that is so important to you, but do not waste resources of the legal system with stuff like this. That is what we have free markets for.

scrollaway 3y ago
Given that it is a free market, who are you to tell this person where they can and cannot spend their personal legal budget?
- danbruc 3y ago
  I am not talking about their legal budget but the taxpayer money financing the courts.
  - ihumanable 3y ago
    As a taxpayer I'm fine with this, and I don't recall electing you to police how the courts are used.
    - danbruc 3y ago
      I am not policing anyone, I am expressing my opinion that this is not a worthwhile use of the justice system.

alkonaut 3y ago

The information wasn't inaccurate, it was encoded as accurately as possible in a specific encoding. I can't see how anything would be "inaccurate" in any way the lawmakers intended.

benj111 3y ago

Why didn't they just argue that rather than a name per se it's a unique identifier. It's a bit weird, but presumably you could address someone as Dear 01769357 A photo on a driver's license is inherently lossy, it would be unreasonable to expect a perfect image of your face.

nuc1e0n 3y ago

Codepage 1047, which is EBCDIC based, supports all the same characters that ISO8859-1 (latin 1) does. This includes diacritic characters. Beyond that, IBM mainframes also work with UTF-16 natively. Can't the Dutch bank upgrade their mainframe?

petree 3y ago
Latin 1 doesn't cover all languages that use a Latin script, and has an incomplete character set for others.
- nuc1e0n 3y ago
  I agree, but I saw it claimed EBCDIC doesn't cover diacritic characters. That's not true. If ISO8859-1 covers the exact same set that CP1047 does and that doesn't meet GDPR's requirements, that implies ISO8859-1 doesn't either and a unicode based character encoding is a necessity for GDPR compliance. Then again, unicode doesn't cover the late artist formerly known as Prince's written name either. All things considered, IBM should work with that Dutch bank to move their system over to UTF-16. It's the natural progression of such things.

2d8a875f-39a2-4 3y ago

It's annoying when organisations bork your name, but how does this relate to GDPR?

billpg 3y ago

"Call Bob. He is the only person who knows how to maintain this system." "Bob died. Ten years ago."

haolez 3y ago
This actually happened at my previous company. The sole maintainer of a legacy system was a contractor in his sixties and he died due to COVID. The system was still unmaintained and falling apart when I left.
_Microft 3y ago
Does that mean that we need to call the necromancer again? He scares me...

randyrand 3y ago

now imagine if your name had characters that are not in UTF-8! you’ll be in for a long road

Asooka 3y ago
This is why my bank only stores people's names as bitmap images. Simply draw your name in the provided blank on the website. Just make sure the pixels are identical each time. For a password, whistle a melody in your microphone. Your password must contain at least 3 microtones, a rising pitch, a falling pitch and a glottal click; also it cannot be similar to any known pop songs.

ahhfgsado6698 3y ago

Partly it's a lie that the stack forces them to use EBCDIC. There's plenty good ASCII and even UTF-8 support on mainframes even in the traditional OS's. They just refuse to rewrite the customer facing portion of their application for whatever reason.

ahhfgsado6698 3y ago

There's plenty good ASCII and UTF8 support on mainframes. They just don't want to rewrite any of their ancient application, which could easily have a more modern UI slapped on it that could in various ways support more modern encodings, even if they left parts of the backend in EBCDIC.

jjice 3y ago

I interned at a large-ish retail company in the US and we had an IBM mainframe that hosted the core DB2 server. I remember when I first learned of EBCDIC because of that IBM machine and I was blown away. Never had I worked with a character encoding that wasn't at least ASCII compatible. ASCII's table layout had some real benefits to it, like being able to flip the fifth (?) bit to change case of characters. Did the EBCDIC layout have any serious benefits? I have to assume there are but my quick web search didn't come up with anything.

yieldcrv 3y ago

Oh awesome, I’m about to sue every airline that can’t handle the hyphen in my name, EBCDIC can handle hyphens but it would be funny if some other system is just as limited behind the scenes for an amusing quagmire I’m an American though, in the US, how can I leverage GDPR for this I’ve booked flights throughout Europe before on European airlines. But I’ve also accessed American airline sites from Europe. I can VPN through Europe and do the same thing right now. Which version lets me lob a complaint? And to which country?

Fischgericht 3y ago

Obviously that is a troll. Who cares that your name on a bank statement does not contain your diacritics? Yes, of course it would be nice if all inter-banking systems would support UTF8 or at least ASCII. But they don't. There are various inter-banking systems that simply are so old that they only support EBCDIC. Newer do, but even quite modern SWIFT still requires the EBCDIC set to make sure data goes through to each and every bank on this planet. And in practice, if you have diacritics in your name, and do any kind of international business or travel, you are used to having found a transcription to use. My wife has a diacritic in her last name. Even if forms at airlines now support entering them, she NEVER does. Because you can be sure that sooner or later in your travel, with this name getting copied to some immigration system, Covid health certificate database etc, it will get corrupted. She never had any problems whatsoever with having her name transcribed on all travel documents, but with her passport containing her name with diacritics. Because, surprise, while I don't know what exact encoding the digital part of the passport contains, and least the machine readable line also uses only the ASCII or EBCDIC character set. So the best way to handle this technological debt is not to sue someone, but just use whatever that machine readable line in your passport days. Names suck, anyway. The idea of having NON-UNIQUE identifiers to uniquely identify human instances is stupid anyway. Everyone on this planet should simply get a UNIQUE name in an universally agreed character set. I'd be even OK with Base64 of UTF8 ;)

yieldcrv 3y ago
> So the best way to handle this technological debt is not to sue someone, but just use whatever that machine readable line in your passport days. Interfacing with the state is in the form of lawsuits, this is the proscribed remedy the state told everyone to do. The cultural meaning and gravity of “sue” is irrelevant, and only puts those with that belief system at a disadvantage.
petree 3y ago
Sometimes the lack of diacritic can change the meaning of the name for the worse and either way, names are deeply personal things that people are attached to, so they might want to have it written correctly, regardless. I wouldn't want someone to mispell my name.

somat 3y ago

I think that I am on the banks side. The name they have in their database represents you, the person, this is the same concept as the account number that represents you. If the character set they use is unable to handle the characters you normally use, they will substitute characters to get as close as they can. As an extreme example, say I go to japan where the restaurant owner dutifully writes my name down as "ソマット" should I get angry because it is not in latin characters?

gdprrrr 3y ago
French is an official language of Belgium

TacticalCoder 3y ago

Where do you draw the line? Is a bank in the EU supposed to enter names of japanese clients using kanjis and/or kanas? And how are bank clerks supposed to enter characters that aren't on their keyboards?

ozb 3y ago

I never really understood the insistence on diacritics. My name is properly written in Hebrew characters, and contains sounds not present in the English language. Many more people use CJK, Cyrillic, Arabic, or other characters. The writing system in use by many people and companies for the English language does not support any of these characters, and nor does it support diacritics. Some variants (in particular, see airlines) use only capital letters, with no spaces or dashes; this also seems reasonable to me (even when my name is somewhat mangled as a result). So just like a CJK/Cyrillic/Semitic name has to be roughly transliterated into Latin characters, and inevitably pronounced differently than in its origin language, why shouldn't the same be true for names with diacritics? Saying that the One True International Alphabet is latin-1 or whatever is rather arbitrary. And no, the solution isn't to give up on cross-cultural communication, nor to require that every human learn all the characters in Unicode.

PeterisP 3y ago
A Belgian bank requiring a Belgian person to transliterate their Belgian name to English characters is somewhat similar to an Israel bank requiring to transliterate your name from Hebrew to Korean (which has as much relevance to Israel as English has for Belgium), and refusing to use Hebrew in their communication. There are official national languages and alphabets, the involved characters are key parts of those national alphabets - who cares about what the English alphabet is? Neither the bank nor the customer are in England or in an English-speaking country, and there is a legal duty for the bank to support the national language(s).
- ozb 3y ago
  You're right, I was thinking of this in the context of an English-speaking country/institution (mostly since I do often see this demand in those contexts as well; to be clear, I think it's a reasonable request, but not a reasonable demand or legal requirement). In the context of a Belgian customer of a Belgian bank it's definitely more surprising; but I also wouldn't categorize it as "inaccurate personal information", but awkward transliteration to a foreign alphabet; as you said, that may be strange and possibly even run afoul of national language laws, but I wouldn't use GDPR against it > [Korean] has as much relevance in Israel as English has in Belgium Legally maybe, but certainly not demographically/culturally; I mean, certainly there is a difference in the expected probability of being understood, especially given the highly-overlapping character sets

PeterStuer 3y ago

"It baffles me that it was still being used in 1995 - let alone today" This person obviously has never seen the inards of a bank's IT department. That core mainframe isn't going to be replaced anytime, it runs code older than he is, and workarounds that would satisfy the complaint would be very large projects with small chance of success. Pragmatic solutions such as having the correctly spelled name at the top of a report indicating that in the rest of the docs this person will be referred to as the EBCDIC coded name should be aceptable.

peapicker 3y ago

I have worked on systems that had to do this in the long-ago past, and the headline is simply wrong. There are many 8-bit EBCDIC code pages that support many languages (multi-hundred page book of them last I looked at it), at least as many as ISO-8859 alphabet soup encodings... and there are also shift-in/shift-out double byte EBCDIC encodings for Japanese, Korean, and Simplified and Traditional Chinese. They've been around since the 1980s at least. Since nesrly the beginning of utf8 acceptance, there is also UTF8-EBCDIC (shudder) The bank developers just didn't write their code in a way that can support the multi-codepage way of storing EBCDIC.