frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Security issues with electronic invoices

https://invoice.secvuln.info/
49•todsacerdoti•2h ago

Comments

blipvert•1h ago
Any reason why they wouldn’t use EDIFACT instead?
blipvert•1h ago
OK, it’s been a long time since I worked in this space. Seems like it’s an XML version of the INVOIC message, but is it required to support the XML syntax, or does the plain old EDI format suffice?
tnorgaard•1h ago
As having implemented EDIFACT parsers and translation layers, Universal Business Language (Oasis UBL) is a bliss to work with. Yes, it's a big standard and looks scary when starting out with it, but it is very well designed for a complicated world.
esher•1h ago
Another project by Hanno Böck: https://youtube.com/@decarbonizeeverything?si=q6yczy30SZx_sA...
moffkalast•1h ago
How can there be security issues with a public document? Can't you just sign it with a cert like any other piece of data that needs a proven source?

But also let me get this straight, there is an actual EU standard for invoices? Why the does nobody follow this and I have to keep asking people to put the fucking VAT ID onto it like I'm a broken record?

rullera•1h ago
States have not starting to enforce them until recently. As I understand it the goal is to have all members using them in a couple of years time
IncreasePosts•1h ago
Because when some things parse the document they do things like read files from the OS as specified in the document
Analemma_•1h ago
The concern is that a malicious vendor could send you an evil invoice where the XML either references external entities that get downloaded and allow potential RCE, or where the document contains references to the local execution environment which allow data exfiltration (or both). In theory a properly-secured XML parser shouldn't allow this, but history has shown that's harder than you might think.
clickety_clack•1h ago
A standard for invoices seems like something that an accounting body should create that is optional for businesses, not something mandatory created by the government. People will generally follow an optional standard to make their own lives easier, but a mandatory one introduces a compliance middleman into the invoicing process.
plantain•1h ago
That's just not how the EU functions.
victorbjorklund•1h ago
The accountancy bodies are national so it would end up with one standard per country. But yea should probably not be mandatory.
croes•1h ago
If you want something to work in multiple countries, you have little choice. Otherwise you x standards
clickety_clack•35m ago
I think there’s a difference between _wanting_ something to work and _needing_ something to work. Enforced standardized invoicing might be a very tidy and neat solution, but tidiness and neatness are not a good enough argument to mandate it in my opinion. There’s no end to the areas of our lives that could be regulated if that’s the standard we’re aiming for, and I don’t particularly want to live in such a uniform, straightjacketed environment.
autoexec•23m ago
Would you rather governments insist on everyone using the same format when invoices are submitted or would you rather have massive amounts of taxpayer money wasted on managing countless conflicting standards, any number of which may also include their own security issues. At a certain scale it just makes sense to say "Okay everyone, we have to pick one way to do this".

If tidiness and neatness are not a good enough argument to mandate this taxpayer savings, time efficiency, and better software should be.

Companies who insist on being precious about their favored invoice format can invest their own time and money on conversation tools that let them convert invoices they get into whatever format they like for their own internal records and convert them to meet the standard again when sending invoices out. That leaves them free to use what they want without making everyone else deal with their mess.

Fraaaank•1h ago
Electronic invoicing makes the live of the receiver easier. The sender has to adapt the standard.

Besides, many standards have been created over the past 20 years, yet most invoices are still only sent as PDF.

autoexec•38m ago
> People will generally follow an optional standard to make their own lives easier

People invent their own standard to make their own lives easier at the cost of making everyone else's lives miserable which is exactly what the European Committee for Standardization was intended to prevent.

perlgeek•23m ago
In the EU there is the "reverse charge" mechanism for VAT when commerce crosses country borders, and it is often used for defrauding EU countries / governments.

The invoicing standard is an attempt to mitigate reverse charge fraud by gathering more machine-readable data. Some countries even demand that b2b invoices are sent to the country, which then dispatches a copy to the recipient.

Knowing this background, it's pretty clear why the EU is making it mandatory.

Personally, in the abstract I like the idea to mandate the use of an open standard, I think we have way too many inefficiencies from treating many things as text documents that could be data structures. I don't like this particular standard though, it's bloated and the result of a typical top-down process.

I much prefer it when there are competing standards for a while, and one or a couple of winner emerge on technical merits. THEN I have no objections to a regulatory body picking a standard and mandating it.

looperhacks•16m ago
As I understood it, this _is_ the standard that won. It's not like the EU invented it.
looperhacks•21m ago
> People will generally follow an optional standard to make their own lives easier

You must be new to the internet /s

A company does not gain anything by sending "better" invoices that follow a standard. Only if they receive standardized invoices, but usually not enough to pay extra for it. The fact that standardized invoices haven't happened yet without legislation should be proof of that

encom•1h ago
>European Union

>needless complexity

First time?

VoidWhisperer•1h ago
Aside from the security issue, it seems like an awful idea for a government (or governments, in this case) to say 'hey, you need to follow this standard for invoicing. But also, you have to pay to see the entire standard'.. almost feels like extortion a bit
a3w•44m ago
DIN is not a government; CEN is an NGO, too.

But yes, for commercial offers, presumption of conformity mean you have to pay for norms to adhere to law. Big fail.

Especially since non-commercial but persistent and public, not "for profit", is still surmised in e.g. warranty laws. (E.g. geschäftsmäßige Nutzung / usage with said two terms, even for F/LOSS)

TheJoeMan•33m ago
The right to access standards that have been incorporated-by-reference into law is still being established by various countries' court systems.

For example, in the USA https://www.rcfp.org/briefs-comments/astm-v-upcodes-inc/

This is an especially hot topic in the EU in medical device regulations: https://www.bsigroup.com/en-GB/insights-and-media/insights/b...

looperhacks•24m ago
To be clear: The ones who need to follow the standard (companies that create invoices) do not need access to the standard, only some supplier does. And there are a lot of things that the government requires that costs money - you could see it as another tax.

That said, I actually agree with you - it's crazy that we need to pay for a stupid standard document.

tnorgaard•55m ago
This talk seems set out to prove that "XML is Bad". Yes XML-DSig isn't great with XPaths, but most of these attack vectors has been known for 10 years. There is probably a reason why the vulnerabilities found where in software not commonly used, e.g. SAP. Many of the things possible with XML and UBL simply isn't available in protobuf, json. How would you digitally sign a Json document and embed the signature in the document?

The article nor the talk appear to reference the XML standard that EN 16931 is built upon: Universal Business Language, https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=... - which is freely available. Examples can be found here: https://github.com/Tradeshift/tradeshift-ubl-examples/tree/m... . It is a good standard and yes it's complex, but it is not complicated by accident. I would any day recommend UBL over IDOC, Tradacom, EDIFACT and the likes.

GNU Unifont

https://unifoundry.com/unifont/index.html
83•remywang•1h ago•33 comments

macOS 26.2 enables fast AI clusters with RDMA over Thunderbolt

https://developer.apple.com/documentation/macos-release-notes/macos-26_2-release-notes#RDMA-over-...
108•guiand•1h ago•35 comments

Security issues with electronic invoices

https://invoice.secvuln.info/
51•todsacerdoti•2h ago•27 comments

Rats Play Doom

https://ratsplaydoom.com/
70•ano-ther•2h ago•30 comments

Ensuring a National Policy Framework for Artificial Intelligence

https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-nati...
15•andsoitis•22h ago•22 comments

Show HN: Tiny VM sandbox in C with apps in Rust, C and Zig

https://github.com/ringtailsoftware/uvm32
7•trj•34m ago•0 comments

Pg_ClickHouse: A Postgres extension for querying ClickHouse

https://clickhouse.com/blog/introducing-pg_clickhouse
46•spathak•2d ago•13 comments

SQLite JSON at full index speed using generated columns

https://www.dbpro.app/blog/sqlite-json-virtual-columns-indexing
282•upmostly•9h ago•91 comments

Motion (YC W20) Is Hiring Senior Staff Front End Engineers

https://jobs.ashbyhq.com/motion/715d9646-27d4-44f6-9229-61eb0380ae39
1•ethanyu94•1h ago

4 billion if statements (2023)

https://andreasjhkarlsson.github.io//jekyll/update/2023/12/27/4-billion-if-statements.html
541•damethos•6d ago•156 comments

Secondary school maths showing that AI systems don't think

https://www.raspberrypi.org/blog/secondary-school-maths-showing-that-ai-systems-dont-think/
74•zdw•6h ago•157 comments

String theory inspires a brilliant, baffling new math proof

https://www.quantamagazine.org/string-theory-inspires-a-brilliant-baffling-new-math-proof-20251212/
86•ArmageddonIt•6h ago•67 comments

CM0 – A new Raspberry Pi you can't buy

https://www.jeffgeerling.com/blog/2025/cm0-new-raspberry-pi-you-cant-buy
140•speckx•7h ago•33 comments

Async DNS

https://flak.tedunangst.com/post/async-dns
85•todsacerdoti•5h ago•23 comments

Microservices should form a polytree

https://bytesauna.com/post/microservices
87•mapehe•4d ago•83 comments

Good conversations have lots of doorknobs (2022)

https://www.experimental-history.com/p/good-conversations-have-lots-of-doorknobs
29•bertwagner•4d ago•2 comments

Bit flips: How cosmic rays grounded a fleet of aircraft

https://www.bbc.com/future/article/20251201-how-cosmic-rays-grounded-thousands-of-aircraft
41•signa11•4d ago•36 comments

Epic celebrates "the end of the Apple Tax" after court win in iOS payments case

https://arstechnica.com/tech-policy/2025/12/epic-celebrates-the-end-of-the-apple-tax-after-appeal...
313•nobody9999•6h ago•203 comments

Google releases its new Google Sans Flex font as open source

https://www.omgubuntu.co.uk/2025/11/google-sans-flex-font-ubuntu
146•CharlesW•4h ago•63 comments

Fedora: Open-source repository for long-term digital preservation

https://fedorarepository.org/
89•cernocky•9h ago•43 comments

New Kindle feature uses AI to answer questions about books

https://reactormag.com/new-kindle-feature-ai-answer-questions-books-authors/
63•mindracer•2h ago•99 comments

Fast Median Filter over arbitrary datatypes

https://martianlantern.github.io/2025/09/median-filter-over-arbitrary-datatypes/
3•martianlantern•6d ago•0 comments

The true story of the Windows 3.1 'Hot Dog Stand' color scheme

https://www.pcgamer.com/software/windows/windows-3-1-included-a-red-and-yellow-hot-dog-stand-colo...
90•naves•3h ago•29 comments

From text to token: How tokenization pipelines work

https://www.paradedb.com/blog/when-tokenization-becomes-token
101•philippemnoel•1d ago•18 comments

Funerary figurines found in royal tomb identifies Pharoah

https://www.sciencealert.com/trove-of-225-exceptional-egyptian-figurines-solves-long-standing-mys...
7•Gaishan•4d ago•1 comments

The tiniest yet real telescope I've built

https://lucassifoni.info/blog/miniscope-tiny-telescope/
240•chantepierre•15h ago•63 comments

Home Depot GitHub token exposed for a year, granted access to internal systems

https://techcrunch.com/2025/12/12/home-depot-exposed-access-to-internal-systems-for-a-year-says-r...
134•kernelrocks•4h ago•83 comments

Open sourcing the Remix Store

https://remix.run/blog/oss-remix-store
19•doppp•3d ago•1 comments

The Average Founder Ages 6 Months Each Year

https://tomtunguz.com/founder-age-median-trend/
34•2bluesc•2h ago•15 comments

Framework Raises DDR5 Memory Prices by 50% for DIY Laptops

https://www.phoronix.com/news/Framework-50p-DDR5-Memory
170•mikece•6h ago•145 comments