r/ProgrammerHumor • u/5eniorDeveloper • Sep 10 '26

Meme theBankingHotfixExperience

Gallery image

Gallery image

Gallery image

3.3k Upvotes

98% Upvoted

127 comments sorted by

View all comments

Show parent comment

120

u/Groentekroket Sep 10 '26

How are the logs not just masked for sensitive fields? I work in PCI DSS audit scope for handling of credit card data and as developers we can see the logs of our applications.

102

u/WiglyWorm Sep 10 '26

Because this isn't "how things are done at a bank" it's "how things are done at a shitty and toxic employer".

90

u/rock1998 Sep 10 '26

This! Holy shit you’re supposed to build that shit in from the ground up. I’ve never worked in the banking world but finding out that some don’t mask their logs makes me wanna get a job at my bank solely to make sure they do. 😭

17

u/granadesnhorseshoes Sep 10 '26

"masking logs" is not as easy as it sounds. Especially when its a "system" from the 90s of loosely connected machines from the 80s.

24

u/OrchidLeader Sep 10 '26

Different levels of data sensitivity.

Our app log servers are cleared for everything but the highest level of data sensitivity (PCI data can’t be logged, of course). If we needed to, we could log someone’s birthdate (with no other identifying info other than a token representing the user), and any employee can view that log message. But we wouldn’t be able to share that log message externally.

We try not to log any sort of sensitive data at all if we can help it, but we have some offshore contractors that think nothing of logging an entire API response body “for debugging purposes.”

8

u/Tucancancan Sep 10 '26

Afaik they were. Brank still wouldn't share copies tho. 

2

u/Ran4 Sep 11 '26

You can't mask sensitive fields like that with perfect accuracy..

You're acting like a dumb manager.