Translate Languages

Youarehere You are here: Home Arrow 2009 Arrow 03 Arrow 15 Arrow cartasi.html 

MAR

15th

Do credit card providers solve bugs?


I’ve found a small accessibility bug in the website of a popular (most popular?) italian credit card provider (Cartasi.it). How long does it take them to recognize the problem? Will they answer at all? Will they just ignore bugs submitted by common users? Or will they react quickly and address the issue? UPDATE: They answer (sort of).

This opens the interesting topic about how the average Joe user can contribute to websites and portals he accesses in his everyday use. With more and more services moved onto the web, and with the whole internet going through the social revolution where every person is at the same time user and active participant, how do private companies and public institutions react to this phenomenon?

In this particular case, the bug is affecting a portal belonging to the banking and financial services sector. This is typically one of the sectors most reluctant to enter the web2.0 era. Have you ever seen ‘social banking’? Or forums where users can contribute ideas on how to improve their banking experience and talk directly to the service providers? Does it even make sense at all?

Let’s see how open they are in this simple case. A simple bug report. Bug reports are a cornerstone of opensource development. A clear indication about how open and communicative is the development process of an online portal accessed by thousands of daily users.

Here (in Italian), the exact bug report I filed. The short summary is that a focus change inside an event handler unexpectedly triggers Firefox ‘Quick Find’ feature, therefore preventing the user from activating some features offered by the website.

Note that this is not a security bug, but just an accessibility problem. In a priority scale, this is probably halfway down. It is user-facing, it cripples part of the user experience, but an easy workaround exists (disable a specific Firefox feature). So I don’t pretend a lightning-fast resolution.


Utenti che utilizzano Firefox3 nell’accedere al portale titolari incontrano il seguente problema che impedisce l’inserimento del codice CVV2 per l’attivazione dei servizi dispositivi, qualora essi abbiano attivata la funzione del browser ‘Search for text when I start typing’ (http://support.mozilla.com/en-US/kb/Accessibility#Search_for_text_when_I_start_typing)

Sintomi:
Quando si preme il tasto sulla tastiera relativo alla terza cifra, questa non viene inserita nel campo di testo preposto, ma viene invece visualizzata la funzione di ricerca veloce ‘Quick Find’ del browser. Questo impedisce l’inserimento del codice CVV2 e l’attivazione dei servizi dispositivi.

Causa:
Il campo di testo e’ associato alla funzione Javascript:

return eventOnKey(this, event, ‘focusField(\’attivaDispositivi\‘);’, CHECK_NUMERIC_INPUT );

La funzione focusField(), definita in controlCommons.js, sposta il focus sull’hyperlink ‘Attiva servizi dispositivi’ prima di ritornare ‘true’ al chiamante. In questo modo l’evento keypress viene interpretato da Firefox come avvenuto sull’hyperlink invece che sul campo di testo, attivando di conseguenza la funzione ‘Quick Find’, impedendo l’inserimento della terza cifra del campo CVV2.

Soluzione:
Varie. Ad esempio, delegare il cambio di focus ad una chiamata window.setTimeout().

The clock is ticking. Will they respond?

UPDATE 22-Mar-09: The provider answered, in a sort of way. Some days before I filed this bug, my father tried contacting the helpdesk as a normal user, describing the issue. At the time they told him that ‘everything was working properly on their side’ and that the website supported Firefox, so there couldn’t be any problem. However, barely a couple of days after my mail, my father received another reply from the helpdesk, with a detailed explanation on how to work around the bug (on Firefox, disable the ‘Search for text when I start typing feature’ ). So yes, they respond. The bug is still in the website code, but I don’t know what their release cycle is. Nonetheless, the customer was informed promptly. Curiously enough, the reply from the helpdesk was signed from a guy with exactly the same name as me (Riccardo). Coincidence or copy-paste?

Note, however, that the underlying question is still open. Should private companies make their development cycle more open, whenever their applications target million users and provide services that everybody uses in their daily life?

Riccardo Govoni, last modified on Mar 22, 2009 - 06:24


2 Comments to this page

danielefrongia at gmail dot com 11 months ago, daniele said:

fBravo Riccardo!
Pretty interesting article.

I think they won't respond...;-)

hce at insiberia dot net 8 months ago, HCE said:

I reported the same bug (but with much less research on the causes), and I just got a reply from the customer service, "disable quick find".