Steve: Developing on the Edge - the hell of corporate expense applications

Steve: Developing on the Edge

Thoughts on development, Web-services, technology and mountains.

22Dec
Tue2009

the hell of corporate expense applications

I had a nice trip to Oxford a couple of weeks ago, seeing what Ross and team are up to there. But there is a price, and that price is that I need to submit two train tickets and some coffee to the corporate expense infrastructure. Which I suspect is designed to run at a profit, by being so painful that people pay for things out of their own pocket, rather than claim them back

It is one of those classic legacy web applications: works on IE6, doesn't like anything else. By mandating an "everyone runs IE6" policy the enterprise IT department gets to keep their maintenance costs down, but frustrates everyone: not just the end users or the firefox teams, but the IE forward development team and any poor developer whose job involves maintaining the app. Web sites from 2001/2002 are the legacy nightmare of the next decade.

I've upgraded to IE8 now, it seems to cope. Except that I have to add the entire corporate web site set to the trusted zone, turn off the "only allow HTTPS sites here", setting, and crank up the the trusted site security to medium, but also: allow popups and enable mixed HTTPS/HTTP content. The latter is a particular problem; all the menu stuff comes up (wrongly, admittedly) in HTTP, even though the expenses site is a secure HTTPS channel. I despair.

Still, it's something to do during test runs

Posted by steve at 13:00

Comments

new comment thread

The enemies of security are manifold...reply to this thread

On 24 December 2009 at 12: 21 Tom Welsh commented:

I have a similar reaction to dealing with banks, etc. on the Web. The convenience is substantial - well worth some effort, though perhaps not much risk. My problem is that the banks and merchants, for all their perpetual chattering about security, do everything they can to frustrate it.

How many times have I been redirected to a payment site, only to find it doesn't work because I have disabled JavaScript through the good offices of NoScript? I may have made an exception for the main bank or merchant site, but then up pops this entirely different domain. There is no good escape - turning on scripting and then resubmitting the form risks making a double payment.

When will businesses that transact on the Web learn how to permit - let alone encourage - their customers to take appropriate security precautions at the client end?