lol768

> I have dealt with banking environment when they required SSL with at least 1-year validity on the callback API URL

Why are (some) banks always completely clueless about these things? Validating ownership of the domain more often (and with an entirely automated provisioning set-up that has no human weak links) can only be a good thing.

Perhaps the banking sector will finally enter the 21st century in another ten years?

They've given "targets" and deadlines before and failed to meet them. I would take whatever they say with a large portion of salt.

Completely agree with this, it's a case of "perfection is the enemy of good" and if you do go to these lengths and abstract so much of it away, it'll be a nightmare to maintain and support as well.

> Earlier this month Andy Lord, the boss of Transport for London, sat down at a scheduled board meeting and praised his organisation’s response to a “highly sophisticated” cyberattack, which began with reports of “suspicious activity” on Sunday 1st September.

> “The vast majority of Londoners would not know this attack has happened,” the TfL commissioner told board members including mayor Sadiq Khan. Lord later added: “Because it’s been so well-managed people didn’t understand the scale and impact.”

Are these people completely delusional? They've taken away passenger's visibility to see what they were being charged for; they killed all of the open data feeds (though a few of these have just now been restored in the last couple of days). Back in September, they disrupted all of their staff's productivity by locking everybody out and forcing them to try and do their jobs without any access to technology. And.. there's still no end in sight for a restore of the contactless portal.

The way they've managed the incident and the collateral damage suggests there were not nearly enough security controls present in the first place (in terms of containing the breach). How many weeks on are we now without service restoration? For a cyberattack perpetrated by one seventeen year old?

If it was an SME who didn't do anything technical and had been caught completely unprepared, I might be more understanding.

Yeah, the whole charset/collation design is a complete dumpster fire.

In the example in the docs, they show someone marking an image that has slipped through the filter as one that's AI generated. But, it comes from Adobe Stock - and I think this really highlights the biggest weakness with how they've gone about implementing this. It's not looking at the images at all, it's looking at where they come from.

The problem is that now that Pandora's box has been opened, all sorts of sites (incl. anywhere like social media that accepts user content) are going to have comingled AI-and-legitimate images that they host.

This is a hard problem to solve.

Quite happy paying £26.80 / £73.50 for all of that.

It's in a country's interests to help maintain the public's health, and that includes subsidising their dental costs (otherwise, they end up taking up primary care time instead).

They have definitely turned off comments. Attempting to post one refreshes the page but nothing happens, and the comment never appears.

> How long til we're all on Ozempic?

It's genuinely quite depressing that so many people in the United States have a weight problem that the overwhelming majority of the population would benefit from this and headlines including "we are all" are not inaccurate.

I don't think other countries are necessarily perfect here, but 74% of Americans don't have a healthy weight when you look at their BMI. That's a staggering statistic. Something is seriously wrong societally, and the priority should absolutely be non-pharmaceutical interventions.

An interesting read. I've been a Monzo customer ever since the sign-up process was "come to the office and we'll give you your card and help you get the Beta version of the app installed" and it's been interesting, exciting (and sad, in some ways) to see it grow and morph into what it is today.

Back then, you were more likely than not to get an engineer dealing with your customer support queries. There was a Slack community, a forum community and it felt very much like a scrappy little start-up that was truly making a difference in what - in the UK - had been an industry dominated by companies that didn't really care about user experience or modern technology (I'd had the misfortune of doing work for some of those banks). They even had an API which customers could use to get their own data!

The pace of progress was rapid, too. I remember asking Tom if he'd ever consider offering business current accounts, since the competition was pretty dire at the time - the answer back then was a "no, we're focussing on retail" - but I'm happy to use my Monzo business account daily now!

I had the opportunity to work on a proposal and sit down with some folks from one of Monzo's partnerships team a few weeks back for a potential collaboration which ultimately didn't end up going forwards. The staff were lovely, but it didn't feel like quite the same company I'd visited in-person years ago to collect my pre-paid card from. I guess that's something that inevitably happens as companies scale up.

You know what else uses power? Ads! Particularly the flashy animated ones that fingerprint the browser and hoover up data to prove you're a real human ad impression. I'd wager it doesn't take too many of those slipping through the net to completely undo your "power saving" of a slightly more efficient way of blocking resources.

Has anyone actually done some quantitative research here? I've been using Firefox with uBO for years on Android and of all the apps on my phone, Firefox is not the one that's chewing through battery.

It's hard to understate how much better the Kotlin IDE support is vs Scala. In terms of reliability the Scala IntelliJ plugin really seemed to go downhill for me with Scala 3, which was a real shame.

Why does this extension even exist on AMO? The article says it's the "Lite/Manifest v3 version" - why would you ever install the inferior edition meant for legacy browsers, instead of the one that blocks ads properly that's meant for Firefox?

> where I live there's one a week

You're lucky you have this! So many councils have moved to every-three-weeks for general refuse, now. Council tax hasn't gone down to compensate, mind you. Not even the recycling is weekly.

> Are you trying to suggest that TfL are using are a cyber attack as cover to permanently cancel Oval?

I'm suggesting it likely would've been delayed anyway, based on how the project was going prior to the cyber attack, and the cyber attack is the latest convenient reason for it not being rolled out according to the (already behind) schedule.

It's not just Oval, it very much appears from an external perspective that most projects that TfL touch don't get done on time or completed to the promised standard. There are countless examples, the 4G/5G coverage rollout on the underground is yet another: https://www.railforums.co.uk/threads/lu-elizabeth-line-4g-up...

It's tiresome to see repeatedly happening.

> You honestly don’t seem to have any real grasp of how long project like Oval actually take to implement

I don't think the timeframes in the original tender were that unrealistic, and to be clear, the tender was published well after the lifting of the Covid-19 lockdown restrictions in the UK. If TfL didn't think those timescales were realistic, it shouldn't have bid for the contract.

What I have heard are - if true - some truly ridiculous stories (manual fares data entry, instead of automated ingest of the NR fares data, which already has all of the PAYG fares) about how this is being implemented, which would explain a lot about some of the reasons behind the delays if correct. It's certainly not the fault of the TOCs involved, that's for sure.

The link you've provided (August 2024) pre-dates TfL's announcement of an indefinite delay to Oval Phase 1 [1] which was originally scheduled to happen by the end of 2022.

The switch on did not happen on September 22nd, 2024 - and the previous date in March was also missed.

[1] https://x.com/c2c_rail/status/1834254076151832814

> Yes they are.

Right, so when you said "there’s no way of meaningfully marking a contactless card as being paired with a railcard", there was nothing of substance to actually support that assertion.

What you've proven to me is that TfL are in exactly the position where they could deliver this if they wanted to and put their minds to it, but it nonetheless hasn't happened. Just like Oval (how late is that now?)

I am quite cynical about TfL, yes, and suspect that they just see this as likely to cause a financial hit when it comes to revenue, which is probably why it hasn't been prioritised. The status quo is a convenient one. I'm sure it'll happen one day when the tech debt of Oyster forces it to happen, but it won't be done proactively for passenger benefit.

> It’s substantially harder to support railcards, and perform correct enforcement of them, with contactless cards. There’s no way of meaningfully marking a contactless card as being paired with a railcard, which would allow ticket inspectors to actually know that when performing enforcement. It would be come trivial for people to defraud TfL using railcards, if there was no mechanism for allowing spot checks on people travelling.

I'm not sure I buy this. Aren't TfL given privileged access to be able to retrieve back the FPAN (or if not that, a customer-specific Payment Account Reference, as defined by EMVCo)? If they weren't, the Contactless travel history portal wouldn't be able to display travel journey undertaken using Apple/Google Pay - and yet this usecase does work, so clearly there is a capability to associate payments made using different DPANs and the underlying physical card and to recognise those transactions are belonging to a single customer.

Subsequently, there is clearly a customer-specific identifier that TfL could, if it desired to do so, tie together with a record which states the customer owns a railcard (after validating the railcard number using the National Rail API).

Why do you think RID2 wouldn't be able to ask a server to check this at inspection time?

I'd agree with this. At some point in the past, a final-salary defined benefit pension and the job security may have gone some way to levelling the playing field a bit.

It's not an assumption. If you have a railcard, you cannot associate it with a contactless card. That's just not a supported task. Therefore if you travel off-peak, you will be charged more than you would if you had used an Oyster card because you will be charged the public rate instead of the discounted fare you were actually entitled to pay. It's very simple.

https://tfl.gov.uk/fares/free-and-discounted-travel/national...

> The TfL contactless system doesn’t generally overcharge, as long as you properly tap-in and tap-out.

> The contactless system is substantially more capable for handling these issues correctly, and generally better at charging less, than the older Oyster system.

Nonsense, everyone with a railcard is routinely overcharged, by design.

For various reasons, the contactless system sadly still lags behind Oyster, with basic functionality like NR discount entitlements missing and showing no signs of emerging anytime soon. The physical infrastructure, like the gatelines, are all still controlled by Cubic as well.

Even in terms of security, you have TfL deciding to adopt SMS for multi-factor authentication (no TOTP/HOTP/push-based MFA) for their contactless portal. Which they only started enforcing a year ago. I don't get how anybody can defend decisions like these. We've known SMS is unsuitable for this use-case for years.

> What happened is that some kid phoned up helpdesk and said they were x and they had lost their phone, can you please help me to reset my password and 2fa (because the phone was nicked, its standard operating procedure right?)

Then the policies that they had in place for these eventualities were insufficient.

> From there they managed to SSO into critical shit.

We're all speculating here without many details of what actually happened, but the questions I'd be asking are:

- Was the person whose account was compromised somebody that needed to routinely have access to Oyster card refund information?

- Was the person whose account was compromised somebody that needed to routinely have access to Oyster card refund information for a handful of customers, as part of working in a support role?

- Was the person whose account was compromised somebody that needed to have access to Oyster card refund for five thousand distinct customers, accessed in a very short timeframe? Why didn't security controls exist that prevented exfiltration of those volumes of data?

- Why were TfL directly storing bank account details in the first place when there are better-equipped partners who have experience securing data that could have handled this?

- Why is TfL so awful at providing Oyster refunds in the first place? They could very easily make it so you could get refunds back onto a Debit/Credit card (without needing to store the PAN), but instead the only options they give you are bank account/sort code (which have to be given over the phone) or back onto the Oyster card - needing to be physically collected within 3 to 4 days or the refund gets "lost" - completely useless if you don't live in London.

> that shit is _hard_, even harder for a safety critical place like TFL. They have something like 40k employees, and a whole bunch of disparate systems.

I don't care, it's not good enough. Everybody in London has no choice but to share some amounts of data with TfL if they want to use the transport system. They've shown they're incompetent time and time again. They can't do the work they've committed to do on-time either, and we pay them shedloads of public funds for this level of service.

This particular incident comes after another rail-related "cyber" incident, affecting TfL who run services in London. The previous incident was perpetrated by a 17-year old, and TfL have still yet to re-enable the systems they turned off back at the end of August. This means customers can no longer check their contactless journey history or claim refunds online. My understanding is that staff were also shut off from being able to access internal systems. There is no ETA for restoration of service.

I think there's a growing problem with digital competency in some of these organisations. TfL in particular have not kept up with the times, and their once revolutionary ticketing infrastructure and software (I say "their", but it's really all just outsourced to Cubic, there's very little in-house expertise or day-to-day ownership when it comes to this stuff) feels quite dated now.

This could work great if the assistants actually had the full knowledge you'd expect from a human answering the phone. Usually if I've resorted to calling though, it's because I can't find out the answer from public sources. For example, "Can you accommodate this dietary requirement?", "Are you able to make dish X without ingredient Y?", "What sort of time of the day/week would be best for a romantic meal when you're not too busy?", "Are there any dishes you're out of, if we swing by in an hour or two?"

You can bet that these virtual assistants won't be equipped with enough knowledge, though I was impressed it knew there wasn't any outdoor seating (example in article).

I think that says more about the engineers you've been working with than anything else.

Why does it have this update mechanism, and semi-regularly force me to download a new .deb file to install w/ dpkg?

I normally look for text alternatives, to be honest. It's not necessarily a bias against YouTube, but more video-based content in general. If I can't find an alternative I'll skim it with subtitles on. I certainly wouldn't have it open for one and half hours in a 3 hour period though!

I simply cannot remember the last time I watched 90 minutes of YouTube in a 3 hour period. I don't think that activity is representative of typical usage at all!

If I look online for stats relating to use of the YouTube app in the UK, it's 20 hours a month. If that's distributed equally across the month, that's definitely not 1.5 hours in any one sitting.

Agree with this. As soon as it became apparent a large proportion of battery usage would be dominated by the YouTube activity, I became suspicious. It's not just Safari where we've seen Google playing dirty tricks either. Back in 2018 it was this:

> YouTube page load is 5x slower in Firefox and Edge than in Chrome because YouTube's Polymer redesign relies on the deprecated Shadow DOM v0 API only implemented in Chrome