41–50 of 127 posts
If you read the original article cited by the NYT (it's in German), it is using 'bug' not in the sense that all software has bugs, but in the sense of 'basic functionality was not working'. And that should be alarming, for critical software. https://translate.google.com/translate?hl=&sl=de&tl=en&u=htt...
Bug or feature? Also, wonder how they're verifying "The bank maintained that no suspicious transactions had slipped through as a result."
1. fix bug, run through the data again or 2. get a bunch of low level analysts or interns to review all past transactions
This is news?! All software has bugs. NYTimes is taking advantage of the general public’s ignorance of this fact to imply something sinister. Without additional information - such as it specifically targeted certain transactions - that is misleading. Remember this when you read articles about subjects you are not knowledgeable about. https://en.m.wikipedia.org/wiki/Gell-Mann_amnesia_effect
I'm pretty sure this bug was known for some time as well
Bug or feature? Also, wonder how they're verifying "The bank maintained that no suspicious transactions had slipped through as a result."
I have no inside information, but I will observe there's a well-traveled road where organizations end up loudly announcing they couldn't find any exploitation of a given bug, or that it was limited to scope X, only to later announce that, oh, whoops, they found some, or that the scope was larger than they thought.
Sometimes I find it easy to believe it's honest, like an ongoing security incident for a relatively transparent organization where the news is only hours old. Sometimes... I find it quite easy to believe it's not honest. I don't have enough info to decide in this particular case but it wouldn't shock my priors for it to be the latter here.
*backdoor
If you read the original article cited by the NYT (it's in German), it is using 'bug' not in the sense that all software has bugs, but in the sense of 'basic functionality was not working'. And that should be alarming, for critical software. https://translate.google.com/translate?hl=&sl=de&tl=en&u=htt...
How can it possibly be both "basic functionality was not working" (high severity) and "no suspicious transactions had slipped through" (low severity)?
As someone who works at a financial institution, it's news generally because money laundering activity tends to be highly profitable for banks, since they get to collect fees on those transactions. There are almost no incentives for us to flag transactions on our own (unless we're being super humanitarian) without legislation/regulation, because as long as they get their money there's no downside except for victims o…
"there's no downside except for victims of the crimes that the money originally originated from."
Why don't you detail what happens to people who get flagged by this software. Ie either send or receive suspected laundered money and what the odds are of such a flag actually resulting in a conviction.
If you get "flagged", ALL your funds are immediately blocked, your access restricted however long they wish (meaning think 6 months). The odds of a flag leading to a conviction are not even 2%. Even among those 2%, the vast majority of "money launderers" are victims of deception (for example the old "I'll send you money if you pay me 5/10/20% less of that money on a different account").
So no victims ? The truth is that a few thousand people per month (never saw absolute numbers but that seems a lower bound to me, and this is for a small EU country) are denied access to their own money for months (sometimes years), without so much as an explanation (it is illegal (and legally highly stupid) for the bank to state for what reason your accounts are blocked). Not one of their accounts, all of them. Needless to say, finding stories where this has resulted in making a person or even entire family homeless is not hard.
"No downside". Well, not for banks. Not for governments. For everyone else, extreme downsides.
Yeah right. Just like VW's emissions bug.