Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A software change allowed FTX to use client money

reuters.com

Post reply on HN
Print view View original

351–360 of 402 posts

Re: A software change allowed FTX to use client money

#351

Post by 1-KB-OK »

I find it a bit surprising that only a few people knew about this code change. I expect other engineers found that piece of code and probably didn't ask any questions. It's normal after working on a codebase for a while to explore all the different branches. It takes a few years though, from what I gather the codebase was only 2-3 years old, so it's possible no one noticed.

I think this revelation points to the further guilt of SBF and his excuse that "he was incompetent" will fall face down under scrutiny.

Re: A software change allowed FTX to use client money

#352

Post by iamben »

IWillForgetThis wrote: post #335
fatnoah wrote: post #332

Earlier quoted context omitted.

> If you want to see what you should never do as a software engineer if you like not being in jail, this is it. Not quite the same level, but in my early days working on a payment system, a request from the product team was to create a summary screen where customer service reps could see payment histories AND THE CC INFORMATION USED FOR THE PAYMENTS. In my mind, there was no way that would end well, so I strenuously…

My first job out of college (2007) involved a lot of removal of early 2000s one-off custom payment processing code. Access DBs full of years worth of credit card numbers, code that just emailed the credit card details to the site owner without keeping a record, etc. It was definitely a different world. Most of them, I just switched to PayPal shopping cart and checkout. In retrospect, I didn't know wtf I was doing and…

Yeah, I worked for an agency around the same sort of time and saw exactly the same kind of thing.

I remember one site that saved all the CC and order details to a plain text file in the web root. This was opened using an FTP programme every evening and someone would run the numbers through the machine in their store and post out the orders...

Re: A software change allowed FTX to use client money

#353

Post by TrickardRixx »

arealaccount wrote: post #340
fatnoah wrote: post #332

Earlier quoted context omitted.

> If you want to see what you should never do as a software engineer if you like not being in jail, this is it. Not quite the same level, but in my early days working on a payment system, a request from the product team was to create a summary screen where customer service reps could see payment histories AND THE CC INFORMATION USED FOR THE PAYMENTS. In my mind, there was no way that would end well, so I strenuously…

Do you mean not a conversation in the sense that we wouldn’t think of doing it, or in the sense that we wouldn’t think of questioning it?

We wouldn't think of doing it. This is the kind of thing your auditors would see from outer space. If you're doing this and you don't have auditors, you're lying on your self-assessment questionnaire. Either way your merchant status is in jeopardy.

Re: A software change allowed FTX to use client money

#355

Post by verst »

iamben wrote: post #352
IWillForgetThis wrote: post #335

Earlier quoted context omitted.

My first job out of college (2007) involved a lot of removal of early 2000s one-off custom payment processing code. Access DBs full of years worth of credit card numbers, code that just emailed the credit card details to the site owner without keeping a record, etc. It was definitely a different world. Most of them, I just switched to PayPal shopping cart and checkout. In retrospect, I didn't know wtf I was doing and…

Yeah, I worked for an agency around the same sort of time and saw exactly the same kind of thing. I remember one site that saved all the CC and order details to a plain text file in the web root. This was opened using an FTP programme every evening and someone would run the numbers through the machine in their store and post out the orders...

This surprisingly sounds very much like the actual ACH system still in use today in the US (from my limited understanding)

Re: A software change allowed FTX to use client money

#356

Post by DangitBobby »

liketochill wrote: post #201
nradov wrote: post #109

Earlier quoted context omitted.

That's a nice little fantasy. In the real world, competent developers with that level of domain knowledge mostly don't exist at any price. In the healthcare field where I work, not many developers have ever gone to medical school.

would you program the software to allow your friend to obtain drugs from the hospital without deducting it from inventory so nobody would notice?

Different scenarios are different.

Re: A software change allowed FTX to use client money

#357

Post by archontes »

bb88 wrote: post #21
neilv wrote: post #8

Earlier quoted context omitted.

> I doubt they'll end up with liability, When you should know it's criminal, "just following orders" isn't a great defense. > but I do hope they at least recognize and think about how their actions enabled this whole mess. They should get lawyers. And be prepared to sing like canaries.

> When you should know it's criminal, "just following orders" isn't a great defense. That's even true in the military if you're given illegal orders. It's called the "duty to disobey". It's not enough that employees "should" know what's illegal and what's not in an exchange -- companies need to be held criminally negligent for employing people who don't know.

Tell that to whistleblowers.

Re: A software change allowed FTX to use client money

#358

Post by throwaway377456 »

neilv wrote: post #8
falcolas wrote: post #4

> Bankman-Fried had directed subordinates to update the software in mid-2020 to enable Alameda to maintain a negative balance on its account, the SEC complaint said. And thus do we have another piece of evidence for why morals and ethics matter, even for software developers. I doubt they'll end up with liability, but I do hope they at least recognize and think about how their actions enabled this whole mess.

> I doubt they'll end up with liability, When you should know it's criminal, "just following orders" isn't a great defense. > but I do hope they at least recognize and think about how their actions enabled this whole mess. They should get lawyers. And be prepared to sing like canaries.

Even if it was clearly criminal, what is one to do in such situation? Can you just quit the job and let it continue? Or are you actually need to be the one to call the cops to be legally safe at the expense of risking physical safety as those behind the crime may retaliate?

Re: A software change allowed FTX to use client money

#359

Post by Godel_unicode »

anonymoushn wrote: post #328
kasey_junk wrote: post #324

Earlier quoted context omitted.

You don’t need speed to front run someone you need special access, which Alameda had. That said they are being accused of something much less sophisticated. They were allowed to take money out when they made money but didn’t have to pay money in when they lost.

Even if you have special access, if you need 40ms (500ms p999) to compute a square root, you're not gonna be able to make worthwhile decisions on the basis of this access

Those times are wildly inaccurate on modern hardware with modern python, fwiw.

Re: A software change allowed FTX to use client money

#360

Post by a2tech »

michaelbuckbee wrote: post #341
IWillForgetThis wrote: post #335

Earlier quoted context omitted.

My first job out of college (2007) involved a lot of removal of early 2000s one-off custom payment processing code. Access DBs full of years worth of credit card numbers, code that just emailed the credit card details to the site owner without keeping a record, etc. It was definitely a different world. Most of them, I just switched to PayPal shopping cart and checkout. In retrospect, I didn't know wtf I was doing and…

If it's any consolation, the entire industry was in that state: poor controls, poor encryption, and security, etc.

"was"? It still seems like a confused mess with lots and log 'security' that people ignore
Post reply on HN