Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How ACH works: A developer perspective (2014)

engineering.gusto.com

Post reply on HN
Print view View original

131–140 of 226 posts

Re: How ACH works: A developer perspective (2014)

#131

Post by corndoge »

joshribakoff wrote: post #122
Karrot_Kream wrote: post #113

Earlier quoted context omitted.

Seconding what kalleboo said, setting directory permissions has been a staple of file-sharing for decades. Setting up a node server to block read-access seems incredibly byzantine.

Good point but we also have to load balance this / have failover and provision users on the fly. I could have used messaging queues to provision PAM users on the whole cluster and this guy would have still complained because I used a non standard port. Not sure why that was a problem either but again we can't press back or question him. he would cancel the whole integration. Bottom line is our end user wanted real ti…

what's wrong with nonstandard ports?

Re: How ACH works: A developer perspective (2014)

#132

Post by pryelluw »

joshribakoff wrote: post #84
pryelluw wrote: post #12

Earlier quoted context omitted.

Ugh, reminds me of the time I had to integrate with a bunch of school software. They used csv over ftp (no auth). You just had to connect to the server and get the personal information of a district's students. Worse is you could google the URLs... I built a system that solved the problem but left shortly after it began to be integrated nationwide.

Email me at josh.ribakoff at Gmail I'd be interested in chatting. I think we worked at the same company. Or direct competitors

Sure, I'll do.

Re: How ACH works: A developer perspective (2014)

#133

Post by Rjevski »

jussij wrote: post #125
kevin_thibedeau wrote: post #92

Earlier quoted context omitted.

SFTP isn't that old and shares nothing with FTP other than three letters.

SFTP is the FTP protocol running through a SSL socket where as FTP is the FTP protocol running through a plain old socket. So they do have a lot in common.

FTPS is a protocol (FTP) running through an SSL socket. SFTP is totally different and based on SSH.

Re: How ACH works: A developer perspective (2014)

#134

Post by patmcc »

joshribakoff wrote: post #87
corndoge wrote: post #28

Earlier quoted context omitted.

why use a huge codebase like node for such a simple security critical task

How else do you suggest you standup a sftp that cannot leak data even if the password is compromised? I'm all ears. Node is a runtime by the way and huge in what regard? The Linux codebase is also large.

You use chmod on the directory...writing any code for this kind of task would be crazy overkill.

Re: How ACH works: A developer perspective (2014)

#135

Post by TomK32 »

mdip wrote: post #45

I noticed a few comments specifically referencing FTP (and who can blame them since the HN title as of this moment specifically references it). In the first post of the series, the author refers to the server as a "Secure FTP" server, which can be confusing to read[0]. In later parts (and a little googling of my own), it's clear that the server is actually an SFTP server, not a plain-old FTP server. It's still plenty…

I've written an SFTP server (nodejs) that passes the files to the proper API this summer. No magic there and the user who doesn't have the resources to implement an API client is happy.

Re: How ACH works: A developer perspective (2014)

#136

Post by joshribakoff »

gaius wrote: post #111
dcow wrote: post #36

Earlier quoted context omitted.

I don't know why everyone thinks they need an API to reimplement (poorly) basic unix functionality that's been around be for years.

But but rewrite all the things in node.js!! Don't worry about understanding the file format, which is well established, or what the users of the file are actually doing with it, also well established, the important thing is node.js!!! Frankly once they hear it's node.js the users should be bowing down to worship!!!!

Actually I wanted him to make an https API for us to query real time data. I would have used PHP to consume his API because it's easier to find developers on our end and synchronous code is easier to maintain when performance is not a concern

Re: How ACH works: A developer perspective (2014)

#137

Post by [deleted] »

jussij wrote: post #125
kevin_thibedeau wrote: post #92

Earlier quoted context omitted.

SFTP isn't that old and shares nothing with FTP other than three letters.

SFTP is the FTP protocol running through a SSL socket where as FTP is the FTP protocol running through a plain old socket. So they do have a lot in common.

[deleted]

Re: How ACH works: A developer perspective (2014)

#138

Post by akx »

jussij wrote: post #125
kevin_thibedeau wrote: post #92

Earlier quoted context omitted.

SFTP isn't that old and shares nothing with FTP other than three letters.

SFTP is the FTP protocol running through a SSL socket where as FTP is the FTP protocol running through a plain old socket. So they do have a lot in common.

You are confusing SFTP and FTPS there.

Re: How ACH works: A developer perspective (2014)

#139

Post by DaiPlusPlus »

dmlittle wrote: post #102
marktangotango wrote: post #19

Earlier quoted context omitted.

Funnily, you're complaining about csv formatting, guess you never worked with ACH formatting. It's cobol fixed length files. I implemented parsing/creation for this file format at two different companies. Hired on at one company, first day, my manager said, "hey, you have experience with ACH right? we have this project...". That's when you learn to start leaving stuff off your resume.

Every time someone complains about file formats I bring up a similar story. It's hard to believe fixed width files are still being used today. Parsing these kind of files with 45 million records, each 600+ bytes is a huge pain. I chuckle when I think about the first time I dealt with these files and thought I could open them in an editor...

> It's hard to believe fixed width files are still being used today. Parsing these kind of files with 45 million records, each 600+ bytes is a huge pain. I chuckle when I think about the first time I dealt with these files and thought I could open them in an editor...

Depending on the business-application, fixed-width formats are fantastic because they allow for genuine O(1) random-access to records without needing to precompute an index first. Writing parsers for fixed-width formats is also much simpler, for example, because it eliminates ambiguity around null-terminators vs length-prefix in text/string/array data - for resource-constrained environments it's great because you can guarantee you won't need to dynamically-allocate buffers. I feel the only real arguments against fixed-width records are concerned with wasted space - which are mitigated if your system lets you compress them somehow - because they'll typically compress very, very well.

Re: How ACH works: A developer perspective (2014)

#140

Post by mjevans »

yellowapple wrote: post #120
kyrra wrote: post #75

Earlier quoted context omitted.

Most payment vendors are on SFTP at this point. Very few still use only FTPS. But then they do silly things with SFTP, like requiring both a password and the ssh key.

"like requiring both a password and the ssh key." That doesn't sound that unreasonable. Both satisfy the "something you know" and "something you have" portions of multi-factor authentication (respectively). Considering that this is money on the line, the idea of banks actually taking security seriously is actually refreshing. Too bad they don't seem to apply those standards to their customers.

If you can duplicate it, then it's something you know, not something you have. Everything you know in sum-total is one meta-passphrase, even if it's a combination of key-files and other data.

The 'something you have' would have to be a specific hardware token (E.G. that VPN tunnel device someone else mentioned that is a black box you aren't allowed to open). Tamper resistance and physical security locks to ensure that connections /must/ route through a given location would be enough.

Post reply on HN