<story><title>Deutsche Bank&apos;s “dysfunctional” IT division (2018)</title><url>https://www.efinancialcareers.co.uk/news/2018/04/technology-at-deutsche-bank</url></story><parent_chain><item><author>LaurensBER</author><text>German speaking financial institutions are a special kind of IT hell. Perhaps it&amp;#x27;s a cultural love for rules in combination with compliance that evolves in a hellish bureaucracy, perhaps it&amp;#x27;s something in the local beer. We can only speculate but I&amp;#x27;ve never worked in an environment as dysfunctional as the ones I&amp;#x27;ve seen at big German companies.&lt;p&gt;To give a few examples:&lt;p&gt;- Running all services under a single Linux account, then requiring vendors to support password encryption in the startup scripts (everyone can access our production passwords!), then proceeding to store the production password in plain text in GIT and Confluence where everyone could read it.&lt;p&gt;- Everyone (including contractors) had access to the production environment through the testing environments, including unrestricted access to the production database (without requiring as much as a password). This was not deemed nearly as important as the passwords in the point above.&lt;p&gt;- I received an official warning for disclosing to AWS&amp;#x2F;GCloud that we did not have CI&amp;#x2F;CD setup but would be interested in getting one up and running at some point. This was considered to be &amp;quot;sensitive&amp;quot; information.&lt;p&gt;- Ansible deployments taking 12 hours (on a 6 server environment) because as it turns out, some random &amp;quot;security&amp;quot; settings slowed down SSH, incompetent people not really understanding what they we&amp;#x27;re doing did the rest.&lt;p&gt;- Ansible being blocked because someone in the security department read that it only required HTTPs access, turned out that they were reading the documentation for the WebUI.&lt;p&gt;- Requiring manual deployment of PR&amp;#x27;s to test environments and manual testing, the &amp;quot;evidence&amp;quot; + logs of doing this was to be documented in a Word document and attached to the PR.&lt;p&gt;- Automation and DevOps was banned because &amp;quot;The law does not allow us to do this&amp;quot;&lt;p&gt;- No rsync due to security reasons, great fun when you had to sync 200k small files :)&lt;p&gt;- PRs were kept around for months, so &amp;quot;senior&amp;quot; developers could estimate the risk. This included fixes that were hotfixed in production so that it was guaranteed to break again at the next 12 hour deployment (thus giving the same developers even more reasons to be even more &amp;quot;cautious&amp;quot; with all future PRs)&lt;p&gt;- Three different database schema&amp;#x27;s, three different database technologies, microservices, a React frontend, 50 outsourced developers for an internal CRUD application with 2000 entities, to be used by 10-20 users&lt;p&gt;- All .exes not on a whitelist were banned, so in order to run your application you just had to rename it to word.exe :)&lt;p&gt;- At one point external developers were hired, we requested a desktop for them that would allow them to &amp;quot;write&amp;quot; code. They got a locked down VM with notepad installed and nothing else</text></item><item><author>arianvanp</author><text>Yeh you notice it as a customer.&lt;p&gt;I can&amp;#x27;t choose a password for my account; instead they assigned me a 6-digit PIN (Not kidding. A PIN).&lt;p&gt;When I registered my account at a local branch I gave them my dutch phone number.   Their website&amp;#x27;s transaction page wouldn&amp;#x27;t load due to a JavaScript parsing error over the dutch phone number format. I called customer support and they basically reacted as if water was burning. They would promise to get back to me. 3 weeks later I still couldn&amp;#x27;t access my online bank account&amp;#x27;s transaction page. I ended up eventually manually editing the HTML in inspector in order to be able to navigate to the page where I could update my phone number to a German one and I never heard back from support.&lt;p&gt;I tried opening a depot account for trading stocks. It just says &amp;quot;Internal server error. your account id is incompatible. Please open an additional account with Deutsche Bank&amp;quot;. I then tried this; had to go to KYC all over again; but I can&amp;#x27;t because I can&amp;#x27;t register two accounts on the 2FA app that is mandatory to have on my phone.  Customer support adviced to get a second phone (??).&lt;p&gt;and I&amp;#x27;m just a normal customer. It&amp;#x27;s impossible to bank with this bank. Every time I have to interact with them it feels like i&amp;#x27;m in some weird fever dream.</text></item></parent_chain><comment><author>intelVISA</author><text>&amp;gt; - PRs were kept around for months, so &amp;quot;senior&amp;quot; developers could estimate the risk. This included fixes that were hotfixed in production so that it was guaranteed to break again at the next 12 hour deployment (thus giving the same developers even more reasons to be even more &amp;quot;cautious&amp;quot; with all future PRs)&lt;p&gt;Classic strategy :D, those aren&amp;#x27;t seniors: they&amp;#x27;re Gods.</text></comment>
<story><title>Deutsche Bank&apos;s “dysfunctional” IT division (2018)</title><url>https://www.efinancialcareers.co.uk/news/2018/04/technology-at-deutsche-bank</url></story><parent_chain><item><author>LaurensBER</author><text>German speaking financial institutions are a special kind of IT hell. Perhaps it&amp;#x27;s a cultural love for rules in combination with compliance that evolves in a hellish bureaucracy, perhaps it&amp;#x27;s something in the local beer. We can only speculate but I&amp;#x27;ve never worked in an environment as dysfunctional as the ones I&amp;#x27;ve seen at big German companies.&lt;p&gt;To give a few examples:&lt;p&gt;- Running all services under a single Linux account, then requiring vendors to support password encryption in the startup scripts (everyone can access our production passwords!), then proceeding to store the production password in plain text in GIT and Confluence where everyone could read it.&lt;p&gt;- Everyone (including contractors) had access to the production environment through the testing environments, including unrestricted access to the production database (without requiring as much as a password). This was not deemed nearly as important as the passwords in the point above.&lt;p&gt;- I received an official warning for disclosing to AWS&amp;#x2F;GCloud that we did not have CI&amp;#x2F;CD setup but would be interested in getting one up and running at some point. This was considered to be &amp;quot;sensitive&amp;quot; information.&lt;p&gt;- Ansible deployments taking 12 hours (on a 6 server environment) because as it turns out, some random &amp;quot;security&amp;quot; settings slowed down SSH, incompetent people not really understanding what they we&amp;#x27;re doing did the rest.&lt;p&gt;- Ansible being blocked because someone in the security department read that it only required HTTPs access, turned out that they were reading the documentation for the WebUI.&lt;p&gt;- Requiring manual deployment of PR&amp;#x27;s to test environments and manual testing, the &amp;quot;evidence&amp;quot; + logs of doing this was to be documented in a Word document and attached to the PR.&lt;p&gt;- Automation and DevOps was banned because &amp;quot;The law does not allow us to do this&amp;quot;&lt;p&gt;- No rsync due to security reasons, great fun when you had to sync 200k small files :)&lt;p&gt;- PRs were kept around for months, so &amp;quot;senior&amp;quot; developers could estimate the risk. This included fixes that were hotfixed in production so that it was guaranteed to break again at the next 12 hour deployment (thus giving the same developers even more reasons to be even more &amp;quot;cautious&amp;quot; with all future PRs)&lt;p&gt;- Three different database schema&amp;#x27;s, three different database technologies, microservices, a React frontend, 50 outsourced developers for an internal CRUD application with 2000 entities, to be used by 10-20 users&lt;p&gt;- All .exes not on a whitelist were banned, so in order to run your application you just had to rename it to word.exe :)&lt;p&gt;- At one point external developers were hired, we requested a desktop for them that would allow them to &amp;quot;write&amp;quot; code. They got a locked down VM with notepad installed and nothing else</text></item><item><author>arianvanp</author><text>Yeh you notice it as a customer.&lt;p&gt;I can&amp;#x27;t choose a password for my account; instead they assigned me a 6-digit PIN (Not kidding. A PIN).&lt;p&gt;When I registered my account at a local branch I gave them my dutch phone number.   Their website&amp;#x27;s transaction page wouldn&amp;#x27;t load due to a JavaScript parsing error over the dutch phone number format. I called customer support and they basically reacted as if water was burning. They would promise to get back to me. 3 weeks later I still couldn&amp;#x27;t access my online bank account&amp;#x27;s transaction page. I ended up eventually manually editing the HTML in inspector in order to be able to navigate to the page where I could update my phone number to a German one and I never heard back from support.&lt;p&gt;I tried opening a depot account for trading stocks. It just says &amp;quot;Internal server error. your account id is incompatible. Please open an additional account with Deutsche Bank&amp;quot;. I then tried this; had to go to KYC all over again; but I can&amp;#x27;t because I can&amp;#x27;t register two accounts on the 2FA app that is mandatory to have on my phone.  Customer support adviced to get a second phone (??).&lt;p&gt;and I&amp;#x27;m just a normal customer. It&amp;#x27;s impossible to bank with this bank. Every time I have to interact with them it feels like i&amp;#x27;m in some weird fever dream.</text></item></parent_chain><comment><author>luplex</author><text>Most likely it&amp;#x27;s a lack of talent, and lack of political will to actually take IT seriously.</text></comment>