[simonh]

The thing to bear in mind about banks is that nowadays they are really computerized service companies that happen to specialize in finance. Competent tech isn't just a competitive edge, it's fundamental to being able to operate at all.

[branchless]

I've worked in two of the biggest US banks for years and I can confidently say both important departments were far from completely understood by most people working there, let alone outsiders doing an audit.

Most of the complexity is in the messages passed between systems. In a code audit it's fine to remove sending tag X by system A but then you find out when you hit prod system B used tag X and now it's not there which causes a problem in system C. And that would be a simplified example.

I'd be disturbed by any outsider claiming they understand the dynamics of multiple systems with millions of lines of code which often have feedback loops.

[SEJeff]

Honest question, have you ever worked for a bank? Many still run on AS/400 mainframes in the backends. Knowing what I know, that comment actually couldn't be further from the truth. Banks are insanely risk adverse, and rightfully so. If it works perfectly, they absolutely will not change it, even if the newer shinier tech has real benefits.

Source: I don't work for a bank, but have worked in electronic trading for the past 8 years and work directly with the (in)competent tech teams from other banks to clear and reconcile trading bits.

[lettergram]

Using AS/400 systems would make them a computer service company. I actually work at a bank (developing apps) and we use a massive COBOL system for a lot of data. However, we also have a massive Hadoop cluster (much larger than the COBOL systems, and firewalls everywhere.

Banks might not be the most competent at web programming, but they higher a ridiculous number of awesome security folks. I would still put them behind Apple or Google in their given domains, but many banks have pretty robust technical systems for their domain.

[Margh]

Every bank I've ever been with has had a pathetic limit on its online banking passwords. One of them (NAB) was limited to something like 10 characters and only numbers and letters.

Maybe that's changed recently but still, firewalls won't help you when somebody brute forces your users' passwords in 10 minutes.

[pc86]

> Many still run on AS/400 mainframes in the backends.

Are you implying that using old technology makes it somehow incompetent? I don't know about you, but I absolutely do not want my financial institutions to be running their risk analysis software in Node just because someone wants to try it out.

[SEJeff]

Nope. I'm implying that they don't use the latest and greatest or "best tech". I'm agreeing with your opinion and having worked with the tech teams of banks am confirming it as truth via firsthand experience.

[spiralpolitik]

Like in any industry there are good teams and bad teams. Working in finance verses working in say social does not automatically make you a bad developer.

Culturally there are two things make finance different. One is that it is a hideously conservative and risk adverse. AS/400's are used because they are well understood, very reliable, and supported by someone other than an attention deficit teenager in a bedroom.

Second is that mainstream finance doesn't see itself as a technology industry. There are areas like quant investment and high frequency trading that are, but most finance companies still look at technology as a line item on the budget rather than the foundation that their business is based on. This is changing slowly (see one) but will mostly likely require an external disruption to push change through any quicker.

[SEJeff]

Entirely agreed on all points. I work in hft and only am in this industry due to the fantastic bleeding edge tech.

[bostonpete]

So which part of simonh's comment were you saying couldn't be further from the truth? I didn't see anything in his comment about the latest and greatest or "best tech".

[uxcn]

I have seen systems that ran on hardware as old as DEC VAXs as late as 2008, but I'm not sure the reason behind not transitioning was risk aversion.

Regardless, there aren't formal controls in place. Otherwise issues like Knight Capital [1] wouldn't have happened.

[1] https://en.wikipedia.org/wiki/Knight_Capital_Group#2012_stoc...

[SideburnsOfDoom]

> about banks ... competent tech isn't just a competitive edge, it's fundamental to being able to operate at all.

Automobiles are going along that curve too. Maybe this whole VW scandal is an indication of this change?

edit and the Toyota firmware scandal in 2013 has similar implications: http://www.latimes.com/business/autos/la-fi-hy-toyota-damage...

[thomnottom]

That may be true of the largest banks, but there are hundreds of others that are running on fairly incompetent tech. Either way, external audits have been a part of them for much longer than the computerization has been.