As a software engineer, I hate when I add a check for something "that will never happen" but that if happens is awful, and people complain. A classic example: you need to get a user from a session, check against a database, and continue if they're signed in. Then I add a simple if databaseUser.Username != form.Username and people will say "if that happens we've something worse wrong". Geez, something might be wrong a…
Klarna users are being signed in to random accounts
261–270 of 517 posts
Re: Klarna users are being signed in to random accounts
#262Earlier quoted context omitted.
> So what? It's 0% interest. Debt is slavery and so on. Let's not get too hung up on the fact that I dislike it. > Most e-commerce sites I've used in the past year offer Klarna or some similar service and all of them have been implemented as just another option in a set of radio buttons. Radio buttons is fine. It's the defaults and "are you sure you don't want to pay with credit?" questions I'm bugged out about. I do…
>Debt is slavery and so on. No it's not, and statements like that trivializes the mistreatment that actual slaves went through.
Re: Klarna users are being signed in to random accounts
#263I find the default Twitter response by the Klarna social media account really annoying. The issue is not a system disturbance. The issue is clearly in the whole implementation of the system itself, code which was written by developers and where something really stupid has been implemented and where security was not taken into account at all because an issue like this could have been prevented at so many layers and ye…
I've seen something like this happen because of a race issue during login. Basically the developer(s) had refactored something and were not aware that a global variable was being captured by a closure used for auth. This meant that whenever two users signed in at the exact same time, there was a non-negligible chance that they swapped accounts during the flow. It was actually not that easy to spot in the code. Someti…
Re: Klarna users are being signed in to random accounts
#264Earlier quoted context omitted.
Singletons are fine and useful in many situations. You just have to understand what singletons entail, and design them correctly. If his singleton had a "SendEmail" function that accepted an Email object with To, From, Subject, Body, etc. fields, it wouldn't have been an issue.
I strongly disagree. Singletons are most of the time a code smell. They hide dependencies, make testing hard, and enforce tight coupling. Singletons are easy to understand, as long as they contain of one simple class. But after a few iterations of development, they tend to "capture" a lot of dependencies, which practically become singletons too. A lot of mistakes happen. And most of the time, there was no good reason…
1. They MUST NOT allow more than one instance. "I don't think anyone will ever need more than one" isn't enough. Just create only one instance then. Only enforce single instance if there is a requirement for it. For example, a logger is a bad singleton because you could conceivably want more than one instance. Something that requires exclusive access to some hardware may be a good candidate though.
2. The instance must be globally accessible. Many things don't need to be globally accessible though.
So unless you need a global enforced-single-instance of something, which in my ~20 years of programming is rarely needed, a singleton is a bad choice. In my experience, many times someone wanted only one instance, some time later it turns out that actually multiple instances would be useful after all (separate loggers for separate types of logs for example).
In most cases where singletons are used, a simple global would have sufficed. If you only want one instance, then create only one instance. If you need lifecycle management, then do something for that.
Those SO posts cover it nicely.
Re: Klarna users are being signed in to random accounts
#265As a software engineer, I hate when I add a check for something "that will never happen" but that if happens is awful, and people complain. A classic example: you need to get a user from a session, check against a database, and continue if they're signed in. Then I add a simple if databaseUser.Username != form.Username and people will say "if that happens we've something worse wrong". Geez, something might be wrong a…
it's fine to make the check but I hope you don't sweep it under the rug with an early out without at least logging the occurrence
Re: Klarna users are being signed in to random accounts
#266Re: Klarna users are being signed in to random accounts
#267Lessons learned the hard way ;)
Re: Klarna users are being signed in to random accounts
#268Earlier quoted context omitted.
>agile, and start-up hipster culture What does that even mean?
Looks like people are really offended by this. Agile lately has been looked at this silver bullet for software engineering. I have worked both in Cisco and some good startups and in my humble opinion having fast paced development and high feature churn rate really is unsuitable for a bank and other infrastructure companies. Also by hipster, I mean that the banks don't have luxury to experiment with latest trends and…
Debates about Agile have gone on for ages, that's not a 'lately' thing.
I have no idea what 'hipster' has to do with banks and tools... or what you mean by 'old proven methods'.
Re: Klarna users are being signed in to random accounts
#269I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.
But... API's really shouldn't be cached? At least not at the CDN level. The risk of serving up stale dashboard data alone makes users go ????... and we definitely don't want - not even mentioning the problem here, that's crazy.
Re: Klarna users are being signed in to random accounts
#270Time to GDPR my account on klarna then.
You can't—at least in Sweden—remove much from Klarna. Your marketing profile is tied in with their accounting system. The law requires them to store accounting data for at least 7 years, with no obligation to actually remove it once that time is up. Since the accounting laws supersede the GDPR: they can hoard data pretty effectively. The Swedish 'Data Protection Authority' tried to launch (yet another) investigation…
If you have other information about other reasons they might have become a bank, I would be genuinely interested in hearing them.