Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Klarna users are being signed in to random accounts

twitter.com

Post reply on HN
Print view View original

421–430 of 517 posts

Re: Klarna users are being signed in to random accounts

#421

Post by cowmoo728 »

toredash wrote: post #344
irjustin wrote: post #269

Earlier quoted context omitted.

I can 100% see this being the cause if this comes out as the root. But... API's really shouldn't be cached? At least not at the CDN level. The risk of serving up stale dashboard data alone makes users go ????... and we definitely don't want - not even mentioning the problem here, that's crazy.

Of course you can cache it, but your assuming it should never. Nothing wrong with caching API calls on the CDN forever as long as your purge the cache once you need it. Event based purging.

"There are only two hard things in Computer Science: cache invalidation and naming things."

Cache invalidation is always a very tricky affair. It can work for a while but as complexity grows it gets very hard to maintain and debug. It's very much a "here be dragons" situation and you have to go into it with your guard up.

I was at a small startup that had a quick and dirty contractor built API. It worked, but for our largest customers, 99th percentile latency started going over the API gateway timeout. The quick and dirty hack on top of it was aggressive caching with too-clever invalidation logic. It worked until new features were added and then it started failing dramatically and unpredictably. The bugs were an absolute nightmare. We ended up spending almost a year cleaning up the data model, sharding things by customer, and fixing a bunch of N+1 queries, all so that we could get rid of our API cache layer and kill the bugs for good.

Re: Klarna users are being signed in to random accounts

#422

Post by gpvos »

the_monocle wrote: post #157
Raed667 wrote: post #110

Totally anecdotal, and probably unrelated, I interviewed for Klarna a few years ago. Mid process, they sent me some sort of timed bizarre IQ test that the recruiter claims EVERYONE who works there has to take. That's when I knew that kind of working culture wasn't for me.

A recruiter contacted me aswell and I asked about their salary. They pay 50k euro for juniors in berlin with afaik no stock vesting. How they even manage to get qualified personnel is beyond me, I would expect much more for a fintech with over 3B evaluation

Sounds very good for a junior dev in (northwest) Europe.

Re: Klarna users are being signed in to random accounts

#424

Post by jordanbeiber »

AtNightWeCode wrote: post #328
mavster wrote: post #181

I'm just guessing, but... "developer gets a great idea - let's push an update to the API as a GET request so we can cache this on the CDN... forgetting that the JWT token is potentially returned in the call. Now, whoever makes the call first gets their JWT token stored for everyone else to load instead when the API call is made." Ta-da, Klarna.

I doubt that Klarna, a bank, have OSI layer 7 proxies in the cloud, with TLS termination in their CDN solution, on AWS. I would assume this traffic is outside of that. But then again, I know they wasted 25M+ Euros on a garbage NodeJS platform. They also created an own cloud once. Yes, it is in the trash bin.

They didn’t “create” their own cloud - they wanted to host their own hardware using an api layer to provision resources. That stuff was not built in-house.

Manhandled in-house though...

Re: Klarna users are being signed in to random accounts

#425

Post by jordanbeiber »

darthrupert wrote: post #365
AtNightWeCode wrote: post #328

Earlier quoted context omitted.

I doubt that Klarna, a bank, have OSI layer 7 proxies in the cloud, with TLS termination in their CDN solution, on AWS. I would assume this traffic is outside of that. But then again, I know they wasted 25M+ Euros on a garbage NodeJS platform. They also created an own cloud once. Yes, it is in the trash bin.

Surprisingly many IT companies tried to create their own clouds, or at least their own kubernetes.

Surprisingly many have saved boatloads of time automating processes pertaining to the tasks at hand. So, yeah, sound reasonable. :)

Re: Klarna users are being signed in to random accounts

#426

Post by anticristi »

neuronic wrote: post #369
2rsf wrote: post #203

Earlier quoted context omitted.

> "Why would anyone do that?" That's such a typical Swedish answer... but they do allow (but not as default!) to block orders and request digital confirmation

Of course, Sweden's largest export are lessons about morality. Interesting for a country that slowly eradicates their indigenous people btw. https://en.wikipedia.org/wiki/S%C3%A1mi_people#Discriminatio... https://en.wikipedia.org/wiki/Swedification#Swedification_of...

> Of course, Sweden's largest export are lessons about morality

Not sure why you were downvoted. I think your comment is rather fair. :) Although, let's give them some credit, they do have a pretty successful mixture of socialism and capitalism.

> Interesting for a country that slowly eradicates their indigenous people btw.

I think that sad story is over. They significantly ramped up protection for indigenous people.

Re: Klarna users are being signed in to random accounts

#429

Post by anticristi »

henvic wrote: post #253

As a software engineer, I hate when I add a check for something "that will never happen" but that if happens is awful, and people complain. A classic example: you need to get a user from a session, check against a database, and continue if they're signed in. Then I add a simple if databaseUser.Username != form.Username and people will say "if that happens we've something worse wrong". Geez, something might be wrong a…

Most people I met who do double checks would simply return "not loggen in" and issue a WARN deep within the other 200 WARNs-per-second. That is IMHO a very bad usage of double checks. It gives a false sense of security and masks the deeper problem until it's too late.

However, if you make the assertion fail loud, then it provides an additional security layer and should be used as often as makes sense.

Re: Klarna users are being signed in to random accounts

#430

Post by OldGoodNewBad »

anticristi wrote: post #426
neuronic wrote: post #369

Earlier quoted context omitted.

Of course, Sweden's largest export are lessons about morality. Interesting for a country that slowly eradicates their indigenous people btw. https://en.wikipedia.org/wiki/S%C3%A1mi_people#Discriminatio... https://en.wikipedia.org/wiki/Swedification#Swedification_of...

> Of course, Sweden's largest export are lessons about morality Not sure why you were downvoted. I think your comment is rather fair. :) Although, let's give them some credit, they do have a pretty successful mixture of socialism and capitalism. > Interesting for a country that slowly eradicates their indigenous people btw. I think that sad story is over. They significantly ramped up protection for indigenous people.

> they do have a pretty successful mixture of socialism and capitalism

Used to, they’re broke now.

Post reply on HN