frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Security issues with electronic invoices

https://invoice.secvuln.info/
42•todsacerdoti•1h ago

Comments

blipvert•1h ago
Any reason why they wouldn’t use EDIFACT instead?
blipvert•1h ago
OK, it’s been a long time since I worked in this space. Seems like it’s an XML version of the INVOIC message, but is it required to support the XML syntax, or does the plain old EDI format suffice?
tnorgaard•49m ago
As having implemented EDIFACT parsers and translation layers, Universal Business Language (Oasis UBL) is a bliss to work with. Yes, it's a big standard and looks scary when starting out with it, but it is very well designed for a complicated world.
esher•1h ago
Another project by Hanno Böck: https://youtube.com/@decarbonizeeverything?si=q6yczy30SZx_sA...
moffkalast•1h ago
How can there be security issues with a public document? Can't you just sign it with a cert like any other piece of data that needs a proven source?

But also let me get this straight, there is an actual EU standard for invoices? Why the does nobody follow this and I have to keep asking people to put the fucking VAT ID onto it like I'm a broken record?

rullera•1h ago
States have not starting to enforce them until recently. As I understand it the goal is to have all members using them in a couple of years time
IncreasePosts•1h ago
Because when some things parse the document they do things like read files from the OS as specified in the document
Analemma_•1h ago
The concern is that a malicious vendor could send you an evil invoice where the XML either references external entities that get downloaded and allow potential RCE, or where the document contains references to the local execution environment which allow data exfiltration (or both). In theory a properly-secured XML parser shouldn't allow this, but history has shown that's harder than you might think.
clickety_clack•1h ago
A standard for invoices seems like something that an accounting body should create that is optional for businesses, not something mandatory created by the government. People will generally follow an optional standard to make their own lives easier, but a mandatory one introduces a compliance middleman into the invoicing process.
plantain•1h ago
That's just not how the EU functions.
victorbjorklund•56m ago
The accountancy bodies are national so it would end up with one standard per country. But yea should probably not be mandatory.
croes•47m ago
If you want something to work in multiple countries, you have little choice. Otherwise you x standards
clickety_clack•14m ago
I think there’s a difference between _wanting_ something to work and _needing_ something to work. Enforced standardized invoicing might be a very tidy and neat solution, but tidiness and neatness are not a good enough argument to mandate it in my opinion. There’s no end to the areas of our lives that could be regulated if that’s the standard we’re aiming for, and I don’t particularly want to live in such a uniform, straightjacketed environment.
autoexec•2m ago
Would you rather governments insist on everyone using the same format when invoices are submitted to them or would you rather have massive amounts of taxpayer money spent on managing countless conflicting standards, any number of which may also include their own security issues. At a certain scale it just makes sense to say "Okay everyone, we have to pick a way to do this".

If tidiness and neatness are not a good enough argument to mandate it taxpayer savings, time efficiency, and better software should be.

Fraaaank•41m ago
Electronic invoicing makes the live of the receiver easier. The sender has to adapt the standard.

Besides, many standards have been created over the past 20 years, yet most invoices are still only sent as PDF.

autoexec•17m ago
> People will generally follow an optional standard to make their own lives easier

People invent their own standard to make their own lives easier at the cost of making everyone else's lives miserable which is exactly what the European Committee for Standardization was intended to prevent.

perlgeek•2m ago
In the EU there is the "reverse charge" mechanism for VAT when commerce crosses country borders, and it is often used for defrauding EU countries / governments.

The invoicing standard is an attempt to mitigate reverse charge fraud by gathering more machine-readable data. Some countries even demand that b2b invoices are sent to the country, which then dispatches a copy to the recipient.

Knowing this background, it's pretty clear why the EU is making it mandatory.

Personally, in the abstract I like the idea to mandate the use of an open standard, I think we have way too many inefficiencies from treating many things as text documents that could be data structures. I don't like this particular standard though, it's bloated and the result of a typical top-down process.

I much prefer it when there are competing standards for a while, and one or a couple of winner emerge on technical merits. THEN I have no objections to a regulatory body picking a standard and mandating it.

encom•59m ago
>European Union

>needless complexity

First time?

VoidWhisperer•49m ago
Aside from the security issue, it seems like an awful idea for a government (or governments, in this case) to say 'hey, you need to follow this standard for invoicing. But also, you have to pay to see the entire standard'.. almost feels like extortion a bit
a3w•23m ago
DIN is not a government; CEN is an NGO, too.

But yes, for commercial offers, presumption of conformity mean you have to pay for norms to adhere to law. Big fail.

Especially since non-commercial but persistent and public, not "for profit", is still surmised in e.g. warranty laws. (E.g. geschäftsmäßige Nutzung / usage with said two terms, even for F/LOSS)

TheJoeMan•12m ago
The right to access standards that have been incorporated-by-reference into law is still being established by various countries' court systems.

For example, in the USA https://www.rcfp.org/briefs-comments/astm-v-upcodes-inc/

This is an especially hot topic in the EU in medical device regulations: https://www.bsigroup.com/en-GB/insights-and-media/insights/b...

looperhacks•3m ago
To be clear: The ones who need to follow the standard (companies that create invoices) do not need access to the standard, only some supplier does. And there are a lot of things that the government requires that costs money - you could see it as another tax.

That said, I actually agree with you - it's crazy that we need to pay for a stupid standard document.

tnorgaard•33m ago
This talk seems set out to prove that "XML is Bad". Yes XML-DSig isn't great with XPaths, but most of these attack vectors has been known for 10 years. There is probably a reason why the vulnerabilities found where in software not commonly used, e.g. SAP. Many of the things possible with XML and UBL simply isn't available in protobuf, json. How would you digitally sign a Json document and embed the signature in the document?

The article nor the talk appear to reference the XML standard that EN 16931 is built upon: Universal Business Language, https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=... - which is freely available. Examples can be found here: https://github.com/Tradeshift/tradeshift-ubl-examples/tree/m... . It is a good standard and yes it's complex, but it is not complicated by accident. I would any day recommend UBL over IDOC, Tradacom, EDIFACT and the likes.

Sanity Check Documents with Riftur

https://5iprojects.com/mind-the-gap-part-ii-introducing-riftur-our-first-ai-gap-analysis-tool-for...
2•jcitsme•7m ago•0 comments

Wine 11.0 RC2 – Run Windows Applications on Linux, BSD, Solaris and macOS

https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0-rc2
1•neustradamus•10m ago•0 comments

GCP Error Fixing Bot

https://medium.com/@paulmcdonald/we-built-a-bot-that-reads-our-production-errors-and-opens-prs-wi...
1•pmmucsd•12m ago•0 comments

Show HN: Tiny VM sandbox in C with apps in Rust, C and Zig

https://github.com/ringtailsoftware/uvm32
2•trj•13m ago•0 comments

Ask HN: Go all-in on AI Boom vs. enjoy parenthood?

2•pratchett•14m ago•2 comments

Show HN: VoiceGrab – Free voice-to-text for Windows using Groq Whisper

https://github.com/consulfedor/VoiceGrab
1•consulfedor•16m ago•0 comments

Pentagon Unveils New GenAI Platform, It Flags Hegseth's War Crimes

https://abovethelaw.com/2025/12/pentagon-unveils-new-genai-platform-it-immediately-starts-flaggin...
1•MBCook•16m ago•0 comments

Immigration Agents Are Using Air Passenger Data for Deportation Effort

https://www.nytimes.com/2025/12/12/us/politics/immigration-tsa-passenger-data.html
2•mikhael•19m ago•0 comments

Realtime AI Videos

https://experience.odyssey.ml/
2•oldfuture•21m ago•0 comments

Meta's New A.I. Superstars Are Chafing Against the Rest of the Company

https://www.nytimes.com/2025/12/10/technology/meta-ai-tbd-lab-friction.html
3•bookofjoe•28m ago•2 comments

What kind of person is DeepSeek's founder, Liang Wenfeng?

https://lmsherlock.substack.com/p/what-kind-of-person-is-deepseeks
2•lawrenceyan•29m ago•0 comments

Closures as Win32 Window Procedures

https://nullprogram.com/blog/2025/12/12/
2•ingve•30m ago•0 comments

WebKit Features for Safari 26.2

https://webkit.org/blog/17640/webkit-features-for-safari-26-2/
1•enz•33m ago•0 comments

Capsudo: Rethinking Sudo with Object Capabilities

https://ariadne.space/2025/12/12/rethinking-sudo-with-object-capabilities.html
2•fanf2•33m ago•0 comments

Speck.js – An AI-native web framework with zero imports

https://speckjs.dev/
1•SpeckOs•34m ago•1 comments

Stratolaunch Systems

https://en.wikipedia.org/wiki/Stratolaunch_Systems
2•rolph•42m ago•1 comments

How I rehumanize the college classroom for the AI-augmented age

https://theconversation.com/how-i-rehumanize-the-college-classroom-for-the-ai-augmented-age-269168
2•eatonphil•44m ago•0 comments

How long does it take to get an EIN?

https://www.clerky.com/irs-ein-processing-times
2•swampthing•45m ago•0 comments

Can a slow-release bolus crack methane reduction for pasture raised cattle?

https://agfundernews.com/can-a-slow-release-bolus-crack-methane-reduction-for-pasture-raised-catt...
3•rmason•45m ago•1 comments

Runmat

https://runmat.org
3•limbicsystem•45m ago•0 comments

Are we stuck with the same Desktop UX forever? [video]

https://www.youtube.com/watch?v=1fZTOjd_bOQ
1•dsego•46m ago•0 comments

Footage appears to show aircraft larger than football field soaring over Calif

https://www.sfgate.com/bayarea/article/footage-aircraft-larger-football-field-california-21237276...
4•toomanyrichies•46m ago•1 comments

Living Particle System

https://creative-art-points.vercel.app/
2•lovegrenoble•46m ago•0 comments

DNS

3•code_Whisperer•47m ago•6 comments

Show HN: I built a GitHub application that generates documentation automatically

https://codesummary.io
3•jerrodcodes•48m ago•0 comments

Radiance Meshes for Volumetric Reconstruction

https://half-potato.gitlab.io/rm/
2•thethirdone•49m ago•0 comments

Newly launched document-to-portfolio-website, would love to get some feedback

https://boldlyhq.com/
1•yinychan•55m ago•1 comments

Referral to coach for fundraising for pre-revenue seed capital?

3•FWKevents•55m ago•1 comments

Fraudulent gambling network may be something more nefarious

https://arstechnica.com/security/2025/12/fraudulent-gambling-network-may-be-a-nation-state-spying...
4•PaulHoule•57m ago•0 comments

S&P500 retreats from record/closes down for week as investors rush from AI trade

https://www.cnbc.com/2025/12/11/stock-market-today-live-updates.html
2•MilnerRoute•57m ago•0 comments