Hacker News Reader

Comment by twunde | Hacker News Reader

I think the most impressive part is that apparently the same system and code had been running for 15 years as the number of transactions reported on had increased exponentially

View on HN

They did, it just left out a few transactions (26,810 transactions over 15 years is a very small number).

Good point. Just under 5 transactions a day really. I think the point that's really annoyed the sec is the number of years they have to go back and correct now that they have the right data.

And these systems clear around 1.5-2.5 million transactions a day at the moment.

I think it's the bad kind of impressive, one where ATMs still run COBOL.

i think the bad kind of impressive would be replacing a system that's had thousands of man-years of real world user testing without a really really really critical reason.

Why do you think it's necessary to constantly re-write code using the latest popular trends?

Programmers reinvent the universe every few years, but really nobody else does.

I'd have to disagree on that part. The ATMs that the company I work for run Windows. We are the largest manufacturer, until the other 2 big ones finish merging.

Besides, C is 44 years old and used on a ton of stuff.

Interesting. Windows CE? Are there any glaring technical issues you've run into over the years? What processors are the ATMs using?

I took this in the UK two years ago: https://4z2.de/atm_windows.jpg - I don't know enough about how the various versions of Windows look but maybe this helps.

It also doesn't look very trust-inspiring.

You need to trust the bank's network security more than you trust the ATM itself.

There were some high profile breaches at some retailers in the past couple years that exploited some 0days. How can you defend your POS/ATM against a 0day if the retailer/bank has bad network security practices?

I guess these machines are not connected to the Internet, and have a very limited user interface surface.

Flaws are less important.

In the US, we have private leased lines to connect with some of the major banks. But the banks most likely use something else to connect to the ATMs.

Most attacks are physically breaking into the cash safe but there were some attacks a couple years ago where people were plugging into the USB port and getting money or something.

I'm not GP, but if I had to guess it would be Windows Embedded, I know of a number of ATMs that use it.

The bad kind of impressive would be getting running ATMs on NodeJS.

ducks

May I introduce you to the "Lamassu Bitcoin ATM"?

This is a thing.

What advantages do you anticipate from a complete rewrite?

Reply on news.ycombinator.com