chriseyre2000

Dora (not not that one) is an attempt by the EU to reduce risk in the financial industry from IT systems.

This follows other transformational legislation such as S-Ox (which does not even mention IT) and GDPR (no you do not need to ask permission for required cookies, 3rd party cookie can’t be required…)

It mandates required practices and reporting of incidents to regulators. The aim is laudable but the act itself is clumsy. It has been written by lawyers without a deep understanding of technology. No developer would have called it DORA!

However it does contain some good concepts:

You must have a robust process for incidents and major ones require reporting to regulators.

You must back up all critical data.

You must understand your own systems.

You must perform security analysis and manage updating of known issues.

The specific one that I want to discuss is the no deprecated libraries.

Introducing this can be problematic especially in the Javascript/Typescript ecosystem.

Javascript has very fine grained packages and each has dependencies on others. Looking at the react starter kit once I found 10k packages! Given that number you are almost guarenteed to find one that has been deprecated/upgraded in any week.

This gets worse when you find packages that need to be aligned, but don’t raise warnings when they get out of step.

Typescript also provides the illusion of type safety. This means you need to convince the compiler that everything is fine, yet at runtime it may still explode.

One safe option is if the library is redundant. Deletion is a good option.

Some items require another library to be upgraded as a plugin is now no longer needed.

The complex one I am working on is an internal code generation compiler. The next version of the compiler does not need the typescript helper tool. The downside is that the tool has been rewritten across the major upgrade and includes breaking changes and external dependency upgrades.

It may be worth having a “not a problem” list for certain deprecations. That has to count as managed.

version: "3" services: db: image: "postgres:11" environment: - POSTGRES_PASSWORD=postgres container_name: "my_postgres" ports: - "54320:5432" volumes: - my_dbdata:/var/lib/postgresql/data volumes: my_dbdata: {}

Late last year I was the victim of identity theft (again).
Apparently this is not actually a crime!

Someone had attempted to take out two credit cards in my name.
One of the cards arrived at my house which is what triggered the investigation.

Contacting the credit card companies is not always as simple as it should be.
One of them had a fraud department that works outside of office hours.
The other had better fraud detection (they did not send me a card) but required me to spend half and hour on their phone system before I was able to talk to someone. You need to include a fraud path in your call centre messages.
Not all people calling have a customer number.

I have been using https://www.checkmyfile.com/ to perform cross agency checks.
Each of the credit card companies had made 2 hard searches against my account.

Hard searches are recorded as attempts to get credit.
Soft searches are simply other companies keeping an eye on your data.

These make it onto your credit file almost immediately.
Getting them removed is much slower.

To start with the credit agencies will only deal with the people who notified them.
It can take a company 2 weeks to make this call. It can take a credit agency 6 weeks to remove it from your file.
This does mean that any incident can require 3 months of fees to the checking service.

I am now 6 weeks from the event and I still have one credit search to remove.

	Tim Mackinnon on Formal Schemas and Property…
	Carlos Herrera on Experimenting With Elixir in…
	chriseyre2000 on Thoughts On Contentful Mi…
	Joona on Thoughts On Contentful Mi…
	What is Normal? Part… on What Is Normal Anyway?

	Tim Mackinnon on Formal Schemas and Property…
	Carlos Herrera on Experimenting With Elixir in…
	chriseyre2000 on Thoughts On Contentful Mi…
	Joona on Thoughts On Contentful Mi…
	What is Normal? Part… on What Is Normal Anyway?

Author: chriseyre2000

A real world Jarndyce and Jarndyce

Credit Rating Agencies

Applying Hindu Theology to Software

Rewilding Software

Dora and the upgrade treadmill

Ash Framework Book – Part 1

Credit Rating Agencies

HMRC Self Assessment A Review

Google Play Phone Number Authentication

Airports now have Exit Through The Gift Shop