Live data from Hacker News

Citigroup fined $7m after legit transactions mistaken for test data for 15 years

theregister.co.uk

61–70 of 114 posts

Re: Citigroup fined $7m after legit transactions mistaken for test data for 15 years

#61

//Try this in your console. function should_not_exclude_10B_10C(x) { if ("089" should_not_exclude_10B_10C("10B") should_not_exclude_10B_10C("10C")

Actually, no: ascii 10B>100. The bug above is that you can't do chained inequalities like that in Javascript. Try: should_not_exclude_10B_10C("200")

B > 0 assumption is broken in their code. Read Page 4, footnote no.4: https://www.sec.gov/litigation/admin/2016/34-78291.pdf This was not caused by Ascii confusion...

Re: Citigroup fined $7m after legit transactions mistaken for test data for 15 years

#62
post #22
post #15

Earlier quoted context omitted.

> Citigroup failing to send information on 26,810 transactions in over 2,300 such requests. 26810 requests, do you think they made more than $7m on this? It's about proportional fines. Just because they're a giant company doesn't mean we should find then $1b for forgetting to put a handicapped parking space at one of their offices.

There is a school of thought that punitive fines should be a proportion of company value/earnings rather than an absolute dollar figure to exact an equal amount of discomfort. I think Finnish speeding fines are a percent of income.

same goes for Switzerland, but as common sense suggests, there is and should be some threshold based on severity. below is static fine, above it things get more interesting/intense.

some (a lot) people would like to see banks burn, in same way common folks enjoyed public decapitations of ruling classes in french revolution. not judging, hard topic on its own, probably depends on where you are positioned in your life.

Re: Citigroup fined $7m after legit transactions mistaken for test data for 15 years

#63
post #40

Earlier quoted context omitted.

There is a school of thought that punitive fines should be a proportion of company value/earnings rather than an absolute dollar figure to exact an equal amount of discomfort. In the infamous McDonald's coffee lawsuit, this was actually the motivation behind the initial large damage award. The jury attempted to award punitive damages equal to two days' worth of McDonald's coffee revenue. (obligatory note here for the…

Yeah though even then it was connected to the coffee revenue, right? I feel like this school of thought is also the one that ends up with things like "3 strikes and you're 25-to-life"

I think I see what you're getting at: punishments or penalties for offences that are arguably disproportionate to the crime.

On the other hand I think there is a gulf of difference between "3 strikes" laws and punitive damages being awarded against a company for an arguably frivolous lawsuit.

The former will disproportionally target people who are relatively disadvantaged, e.g. people living in poverty or drug addicts, and ruin their lives.

The latter (in this case) targeted a multinational corporation, with the damages being around 0.01% of its annual profit or less. McDonald's can survive that. Even if a person or two in the chain of command get fired, there's a gulf of difference between losing your job and getting locked up for 25 years.

Re: Citigroup fined $7m after legit transactions mistaken for test data for 15 years

#64
post #34

Earlier quoted context omitted.

I think it's the bad kind of impressive, one where ATMs still run COBOL.

The bad kind of impressive would be getting running ATMs on NodeJS. ducks

This is a thing.

Re: Citigroup fined $7m after legit transactions mistaken for test data for 15 years

#65
post #50
post #44

Earlier quoted context omitted.

The other thing is with a company the size of citigroup (250,000 employees), it is statically impossible not to have: - incompetent and/or careless employees and managers - dishonnest employees - computer bugs, glitches, clerical errors If you take down a large corporation every time you find any of these, there will be no corporation left within a year. Just small companies that were statistically lucky to have neit…

They had this bug for more than a decade. They should have systems in place to look for these things. People make mistakes, but these mistakes should be caught before they get into production. And the ones that still make it into production should be hunted.

this is unbelievably naive comment... do you work in IT? 15 year old bugs are nothing special, with known ones having workarounds implemented (often buggy), or just some completely new happening on broken data feed, unexpected values etc. the list is endless

Re: Citigroup fined $7m after legit transactions mistaken for test data for 15 years

#66
post #60

Earlier quoted context omitted.

This particular example seems to reinforce the argument for saying nothing at all .

Directors of companies have legal responsibilities to provide these reports to the government. So instead of the company getting a fine for making a mistake even though you tried to comply, now you are personally choosing not to fulfil your legal obligations as a director. Smart move.

The corporate veil is pretty tough, but that's one good way to give the government reason to pierce it.

Re: Citigroup fined $7m after legit transactions mistaken for test data for 15 years

#67
post #45

Earlier quoted context omitted.

Should have written TODO

I've seen the XXX suffix in the CPython source code - what does it mean compared to TODO?

I would assume searchability. A non-case-sensitive non-regex search of a codebase could yet false positives for things like "autoDot"

Re: Citigroup fined $7m after legit transactions mistaken for test data for 15 years

#68
post #63
post #40

Earlier quoted context omitted.

Yeah though even then it was connected to the coffee revenue, right? I feel like this school of thought is also the one that ends up with things like "3 strikes and you're 25-to-life"

I think I see what you're getting at: punishments or penalties for offences that are arguably disproportionate to the crime. On the other hand I think there is a gulf of difference between "3 strikes" laws and punitive damages being awarded against a company for an arguably frivolous lawsuit. The former will disproportionally target people who are relatively disadvantaged, e.g. people living in poverty or drug addict…

> punishments or penalties for offences that are arguably disproportionate to the crime

This is not incompatible, the school of thought still wants to achieve that.

"this crime is minor and deserves a minor punishment of level 2 suffering, what's a good way to inflict level 2 suffering on this individual"

Re: Citigroup fined $7m after legit transactions mistaken for test data for 15 years

#69
post #14

Earlier quoted context omitted.

I'd have to disagree on that part. The ATMs that the company I work for run Windows. We are the largest manufacturer, until the other 2 big ones finish merging. Besides, C is 44 years old and used on a ton of stuff.

Interesting. Windows CE? Are there any glaring technical issues you've run into over the years? What processors are the ATMs using?

I'm not GP, but if I had to guess it would be Windows Embedded, I know of a number of ATMs that use it.

Re: Citigroup fined $7m after legit transactions mistaken for test data for 15 years

#70
post #54
post #50

Earlier quoted context omitted.

They had this bug for more than a decade. They should have systems in place to look for these things. People make mistakes, but these mistakes should be caught before they get into production. And the ones that still make it into production should be hunted.

Should we discuss about all the 15 years old bugs that are found in Windows, Linux and MacOS which are well into production (and many of them critical bugs that affect the core of the product)? Has a software company ever been fined or held liable for bugs in its products? In fact too often, bug fixes are paid updates. Financial companies are held to extraordinary standards, and in my opinion it's a game they cannot…

This is not a minor bug, this is a bug that caused data to be misrepresented. If you want to compare it to OS bugs, then you need to look at silent data corruption: how many data corruption bugs have gone undetected in operating systems for 15 years?
Post reply on HN