Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security issues with electronic invoices

invoice.secvuln.info

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Security issues with electronic invoices

#21

Post by a3w »

VoidWhisperer wrote: post #16

Aside from the security issue, it seems like an awful idea for a government (or governments, in this case) to say 'hey, you need to follow this standard for invoicing. But also, you have to pay to see the entire standard'.. almost feels like extortion a bit

DIN is not a government; CEN is an NGO, too.

But yes, for commercial offers, presumption of conformity mean you have to pay for norms to adhere to law. Big fail.

Especially since non-commercial but persistent and public, not "for profit", is still surmised in e.g. warranty laws. (E.g. geschäftsmäßige Nutzung / usage with said two terms, even for F/LOSS)

Re: Security issues with electronic invoices

#22

Post by autoexec »

clickety_clack wrote: post #8

A standard for invoices seems like something that an accounting body should create that is optional for businesses, not something mandatory created by the government. People will generally follow an optional standard to make their own lives easier, but a mandatory one introduces a compliance middleman into the invoicing process.

> People will generally follow an optional standard to make their own lives easier

People invent their own standard to make their own lives easier at the cost of making everyone else's lives miserable which is exactly what the European Committee for Standardization was intended to prevent.

Re: Security issues with electronic invoices

#23

Post by clickety_clack »

croes wrote: post #18
clickety_clack wrote: post #8

A standard for invoices seems like something that an accounting body should create that is optional for businesses, not something mandatory created by the government. People will generally follow an optional standard to make their own lives easier, but a mandatory one introduces a compliance middleman into the invoicing process.

If you want something to work in multiple countries, you have little choice. Otherwise you get x standards

I think there’s a difference between _wanting_ something to work and _needing_ something to work. Enforced standardized invoicing might be a very tidy and neat solution, but tidiness and neatness are not a good enough argument to mandate it in my opinion. There’s no end to the areas of our lives that could be regulated if that’s the standard we’re aiming for, and I don’t particularly want to live in such a uniform, straightjacketed environment.

Re: Security issues with electronic invoices

#24

Post by TheJoeMan »

VoidWhisperer wrote: post #16

Aside from the security issue, it seems like an awful idea for a government (or governments, in this case) to say 'hey, you need to follow this standard for invoicing. But also, you have to pay to see the entire standard'.. almost feels like extortion a bit

The right to access standards that have been incorporated-by-reference into law is still being established by various countries' court systems.

For example, in the USA https://www.rcfp.org/briefs-comments/astm-v-upcodes-inc/

This is an especially hot topic in the EU in medical device regulations: https://www.bsigroup.com/en-GB/insights-and-media/insights/b...

Re: Security issues with electronic invoices

#25

Post by looperhacks »

VoidWhisperer wrote: post #16

Aside from the security issue, it seems like an awful idea for a government (or governments, in this case) to say 'hey, you need to follow this standard for invoicing. But also, you have to pay to see the entire standard'.. almost feels like extortion a bit

To be clear: The ones who need to follow the standard (companies that create invoices) do not need access to the standard, only some supplier does. And there are a lot of things that the government requires that costs money - you could see it as another tax.

That said, I actually agree with you - it's crazy that we need to pay for a stupid standard document.

Re: Security issues with electronic invoices

#26

Post by perlgeek »

clickety_clack wrote: post #8

A standard for invoices seems like something that an accounting body should create that is optional for businesses, not something mandatory created by the government. People will generally follow an optional standard to make their own lives easier, but a mandatory one introduces a compliance middleman into the invoicing process.

In the EU there is the "reverse charge" mechanism for VAT when commerce crosses country borders, and it is often used for defrauding EU countries / governments.

The invoicing standard is an attempt to mitigate reverse charge fraud by gathering more machine-readable data. Some countries even demand that b2b invoices are sent to the country, which then dispatches a copy to the recipient.

Knowing this background, it's pretty clear why the EU is making it mandatory.

Personally, in the abstract I like the idea to mandate the use of an open standard, I think we have way too many inefficiencies from treating many things as text documents that could be data structures. I don't like this particular standard though, it's bloated and the result of a typical top-down process.

I much prefer it when there are competing standards for a while, and one or a couple of winner emerge on technical merits. THEN I have no objections to a regulatory body picking a standard and mandating it.

Re: Security issues with electronic invoices

#27

Post by autoexec »

clickety_clack wrote: post #23
croes wrote: post #18

Earlier quoted context omitted.

If you want something to work in multiple countries, you have little choice. Otherwise you get x standards

I think there’s a difference between _wanting_ something to work and _needing_ something to work. Enforced standardized invoicing might be a very tidy and neat solution, but tidiness and neatness are not a good enough argument to mandate it in my opinion. There’s no end to the areas of our lives that could be regulated if that’s the standard we’re aiming for, and I don’t particularly want to live in such a uniform, s…

Would you rather governments insist on everyone using the same format when invoices are passed around or would you rather have massive amounts of taxpayer money wasted on managing countless conflicting standards, any number of which may also include their own security issues. At a certain scale it just makes sense to say "Okay everyone, we have to pick one way to do this".

If tidiness and neatness are not a good enough argument to mandate this taxpayer savings, time efficiency, and better software should be.

Companies who insist on being precious about their favored invoice format can invest their own time and money on conversion tools that let them convert invoices they get into whatever format they like for their own internal records and convert them to meet the standard again when sending invoices out. That leaves them free to use what they want without making everyone else deal with their mess.

Re: Security issues with electronic invoices

#28

Post by looperhacks »

clickety_clack wrote: post #8

A standard for invoices seems like something that an accounting body should create that is optional for businesses, not something mandatory created by the government. People will generally follow an optional standard to make their own lives easier, but a mandatory one introduces a compliance middleman into the invoicing process.

> People will generally follow an optional standard to make their own lives easier

You must be new to the internet /s

A company does not gain anything by sending "better" invoices that follow a standard. Only if they receive standardized invoices, but usually not enough to pay extra for it. The fact that standardized invoices haven't happened yet without legislation should be proof of that

Re: Security issues with electronic invoices

#29

Post by looperhacks »

perlgeek wrote: post #26
clickety_clack wrote: post #8

A standard for invoices seems like something that an accounting body should create that is optional for businesses, not something mandatory created by the government. People will generally follow an optional standard to make their own lives easier, but a mandatory one introduces a compliance middleman into the invoicing process.

In the EU there is the "reverse charge" mechanism for VAT when commerce crosses country borders, and it is often used for defrauding EU countries / governments. The invoicing standard is an attempt to mitigate reverse charge fraud by gathering more machine-readable data. Some countries even demand that b2b invoices are sent to the country, which then dispatches a copy to the recipient. Knowing this background, it's p…

As I understood it, this _is_ the standard that won. It's not like the EU invented it.

Re: Security issues with electronic invoices

#30

Post by cogman10 »

clickety_clack wrote: post #8

A standard for invoices seems like something that an accounting body should create that is optional for businesses, not something mandatory created by the government. People will generally follow an optional standard to make their own lives easier, but a mandatory one introduces a compliance middleman into the invoicing process.

Having worked with accounting body standards (NAIC), I can tell you that it really does nothing to improve quality. Especially when parts of the standard encode things like COBOL PIC number symbols. [1]

[1] https://www.ibm.com/docs/en/cobol-zos/6.4.0?topic=arithmetic...

Post reply on HN