News for hackers. Stuff that matters.

A comment on A software change allowed FTX to use client money. Parent comment

Re:A software change allowed FTX to use client money by stickfigure on Tuesday December 13, 2022 @10:05PM (#33979533)
"For testing purposes, these 10 account numbers should be allowed to remove cash from any of our ATMs. The testers will put the money back." It doesn't sound that nefarious. If you told me this is how ATMs are currently being tested in the industry, I wouldn't be able to contradict you.
[ Parent | on HN ]
Re:A software change allowed FTX to use client money by headsoup on Wednesday December 14, 2022 @07:06AM (#33982414)
"In production, boss?" I don't think so.
[ Parent | on HN ]
Re:A software change allowed FTX to use client money by imtringued on Wednesday December 14, 2022 @06:49AM (#33982300)
That is very nefarious. You can cancel ATM fees but withdrawing unlimited money?

Just deposit the money before withdrawing it.

[ Parent | on HN ]
Re:A software change allowed FTX to use client money by salawat on Tuesday December 13, 2022 @10:50PM (#33979806)
...A bench test of an ATM probably doesn't involve real money. No one in finance is stupid enough to use real money on production environments for testing purposes.

There is test... And there is PROD. Never do the two meet. Ever.

If someone out there does, please make yourself known so we can get the investigators over there ASAP.

[ Parent | on HN ]
Re:A software change allowed FTX to use client money by ragtete on Wednesday December 14, 2022 @02:40AM (#33981013)
Huh? You're telling me that you think they never test ATMs in prod? That's ridiculous.

You think they're just guessing that the test environment perfectly matches the prod environment?

[ Parent | on HN ]
Re:A software change allowed FTX to use client money by malandrew on Wednesday December 14, 2022 @03:22AM (#33981224)
You can test in production if you have multi-tenancy aware services, where tenancy is some string value like Foo to make sure reads to Foo can only read data that was written to Foo.
[ Parent | on HN ]
Re:A software change allowed FTX to use client money by headsoup on Wednesday December 14, 2022 @07:08AM (#33982428)
That's not testing in production, that's just the same as saying your test VMWare environment is in the same datacentre as your prod VMWare environment.
[ Parent | on HN ]