XML parse error due to ofxhome returning an AI ad

[Skyedra]

I was getting a xml.etree.ElementTree.ParseError: not well-formed (invalid token): line 43, column 155 error today.

This appears to be due to F5 acquiring leaksignal who were previously operating ofxhome after the original maintainer passed it on. Now that ofxhome isn't erroring, but returning unparseable data (an html ad for some kind of AI thing), ofxtools broke (thanks F5 😭).

The easy workaround so far is inside site-packages/ofxtools/ofxhome.py change the url to something that won't resolve:

#URL = "http://www.ofxhome.com/api.php"
URL = "http://ofx-home-is-down/";

Longer term, if anyone has the full data dump with proper formatting from http://www.ofxhome.com/api.php?dump=yes, maybe that could be included in ofxtools directly or in another github repo.

[Skyedra]

So I asked @ddoherty03 to upload the last available version of the data dump, and that's now up here: https://github.com/ddoherty03/ofxhome_dump Should prove to be useful! Maybe someone can make an API compatible endpoint using this, or update ofxtools to use the xml directly, etc.

OFX lives on!

[Skyedra]

Also, I did send a message to F5's DNS contact about the situation, no response yet...

[emin63]

Thanks for the work-around. What's required for a fix? Do we need to modify ofxhome.py to use the dump you provided? Or is the idea that we need to put the dump on a static web server somewhere? Happy to try and help if it is something with my expertise.

[Skyedra]

You're welcome :)

There are several possible solutions I can think of... in order of most favorable to least favorable:

1. The current owners, leaksignal/F5, get ofxhome.com up and running again. Then all the client programs like ofxtools would just work. However, I don't think F5 has any interest in running an open source finance API, so this strategy seems unlikely.

2. We manage to get the ofxhome.com site code from either F5, leaksignal or the original author (Jesse). Then someone steps up to re-host and maintain the API/site. If we didn't get the original domain, we'd have to register a new domain and get client programs to update API url in ofxtools and any other programs that uses ofxhome.com API url.

3. Someone goes to the trouble of re-coding all of ofxhome.com on a new domain. This may or may not be API compatible with the original ofxhome.com API depending on how much work a volunteer wants to do, but if it was, hopefully minimal client changes needed in ofxtools beyond a domain name change.

4. Or just give up on ofxhome.com API entirely and recode ofxtools to use the XML data dump. This has the down side that people can't use a UI to contribute information about OFX urls, but versus entirely recoding all of ofxhome is maybe more realistic / less work.

Regarding communications:

• I still have not heard anything back from F5. I have now tried again on a couple different addresses, but it is seeming less likely and a decent chance the domain has been lost to whatever advertising/SEO they're using it for now. We should wait a bit longer, but if not, we can try to be loud on social media to get the domain rescued since that is often the only way for large corporations to hear us =\
• I also tried e-mail original author's ofxhome address + leaksignal's ofx address. Surprisingly, neither of these mails have bounced so maybe they are still active. I am hoping one of them decide to re-host it, but if not, maybe we can get the code and someone else can do it.

My recommendation for now is to wait to see if any of F5, Jesse, or leaksignal get back to me/us. That would save a ton of time in having to re-code the site, import data, etc. And if we're really lucky, maybe one of the aforementioned will just put the site back online with no work from us required. If we don't hear back and it seems we're on our own, then we can decide if we want to do solution number 3 or 4.

[ddoherty03]

Thanks for the update. ==================================================== Daniel E. Doherty D.E. Doherty Law Office, LLC 7300 W. 110th Street, Suite 930 Overland Park, KS 66210 913.338.7182 (Phone) 913.338.7164 (FAX) ***@***.***

…

On Mon, Mar 31, 2025 at 11:50 PM Skye ***@***.***> wrote: You're welcome :) There are several possible solutions I can think of... in order of most favorable to least favorable: 1. The current owners, leaksignal/F5, get ofxhome.com up and running again. Then all the client programs like ofxtools would just work. However, I don't think F5 has any interest in running an open source finance API, so this strategy seems unlikely. 2. We manage to get the ofxhome.com site code from either F5, leaksignal or the original author (Jesse). Then someone steps up to re-host and maintain the API/site. If we didn't get the original domain, we'd have to register a new domain and get client programs to update API url in ofxtools and any other programs that uses ofxhome.com API url. 3. Someone goes to the trouble of re-coding all of ofxhome.com on a new domain. This may or may not be API compatible with the original ofxhome.com API depending on how much work a volunteer wants to do, but if it was, hopefully minimal client changes needed in ofxtools beyond a domain name change. 4. Or just give up on ofxhome.com API entirely and recode ofxtools to use the XML data dump. This has the down side that people can't use a UI to contribute information about OFX urls, but versus entirely recoding all of ofxhome is maybe more realistic / less work. Regarding communications: - I still have not heard anything back from F5. I have now tried again on a couple different addresses, but it is seeming less likely and a decent chance the domain has been lost to whatever advertising/SEO they're using it for now. We should wait a bit longer, but if not, we can try to be loud on social media to get the domain rescued since that is often the only way for large corporations to hear us =\ - I also tried e-mail original author's ofxhome address + leaksignal's ofx address. Surprisingly, neither of these mails have bounced so maybe they are still active. I am hoping one of them decide to re-host it, but if not, maybe we can get the code and someone else can do it. My recommendation for now is to wait to see if any of F5, Jesse, or leaksignal get back to me/us. That would save a ton of time in having to re-code the site, import data, etc. And if we're really lucky, maybe one of the aforementioned will just put the site back online with no work from us required. If we don't hear back and it seems we're on our own, then we can decide if we want to do solution number 3 or 4. — Reply to this email directly, view it on GitHub <#193 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADQO3HSRPXZSKTYAHDJLNL2XILJTAVCNFSM6AAAAABZO4CJDWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDONRYGA4TCNRQGI> . You are receiving this because you were mentioned.Message ID: ***@***.***> [image: Skyedra]*Skyedra* left a comment (csingley/ofxtools#193) <#193 (comment)> You're welcome :) There are several possible solutions I can think of... in order of most favorable to least favorable: 1. The current owners, leaksignal/F5, get ofxhome.com up and running again. Then all the client programs like ofxtools would just work. However, I don't think F5 has any interest in running an open source finance API, so this strategy seems unlikely. 2. We manage to get the ofxhome.com site code from either F5, leaksignal or the original author (Jesse). Then someone steps up to re-host and maintain the API/site. If we didn't get the original domain, we'd have to register a new domain and get client programs to update API url in ofxtools and any other programs that uses ofxhome.com API url. 3. Someone goes to the trouble of re-coding all of ofxhome.com on a new domain. This may or may not be API compatible with the original ofxhome.com API depending on how much work a volunteer wants to do, but if it was, hopefully minimal client changes needed in ofxtools beyond a domain name change. 4. Or just give up on ofxhome.com API entirely and recode ofxtools to use the XML data dump. This has the down side that people can't use a UI to contribute information about OFX urls, but versus entirely recoding all of ofxhome is maybe more realistic / less work. Regarding communications: - I still have not heard anything back from F5. I have now tried again on a couple different addresses, but it is seeming less likely and a decent chance the domain has been lost to whatever advertising/SEO they're using it for now. We should wait a bit longer, but if not, we can try to be loud on social media to get the domain rescued since that is often the only way for large corporations to hear us =\ - I also tried e-mail original author's ofxhome address + leaksignal's ofx address. Surprisingly, neither of these mails have bounced so maybe they are still active. I am hoping one of them decide to re-host it, but if not, maybe we can get the code and someone else can do it. My recommendation for now is to wait to see if any of F5, Jesse, or leaksignal get back to me/us. That would save a ton of time in having to re-code the site, import data, etc. And if we're really lucky, maybe one of the aforementioned will just put the site back online with no work from us required. If we don't hear back and it seems we're on our own, then we can decide if we want to do solution number 3 or 4. — Reply to this email directly, view it on GitHub <#193 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADQO3HSRPXZSKTYAHDJLNL2XILJTAVCNFSM6AAAAABZO4CJDWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDONRYGA4TCNRQGI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[Skyedra]

It took a couple days, but my mail to Jesse bounced. Does anyone have a way to contact him not via the ofxhome.com domain to see about getting the site source code?

[RobAtForm]

Assuming it's the same guy you could send a message on linked in https://www.linkedin.com/in/jesse-liesch-a21866/ or assuming he is at google trying an address like jesse.liesch@google.com? I'm honestly not sure if this is even the same person but thought it might be worth a shot.

[Skyedra]

I don't want to deal with setting up a linkedin, but I'll try the e-mail, thanks

(update: it also bounced)

[jfly]

3. Or just give up on ofxhome.com API entirely and recode ofxtools to use the XML data dump

IIUC, ofxtools sort of already does this. There's this update_fi_cfg.py script which generates this fi.cfg from the data on ofxhome.

Under the hood, it looks like ofxtools first fetches config from fi.cfg, and then updates that with the (presumably more up to date) data from ofxhome.

For my credit card provider (Citi) that I use ofxget to fetch data from, all the relevant configuration is already present in that fi.cfg file: https://github.com/csingley/ofxtools/blob/0.9.5/ofxtools/config/fi.cfg#L2134-L2144. ofxtools goes on to try to fetch data from ofxhome (which fails), but I don't need it to do that. By just commenting out the call to merge_from_ofxhome, I'm able to get things going again. YMMV.

It looks like fi.cfg was last updated Jan 2022. @csingley, would you accept a PR to ofxtools where we run update_fi_cfg.py against that latest ofxhome dump in https://github.com/ddoherty03/ofxhome_dump?

[jfly]

@csingley, would you accept a PR to ofxtools where we run update_fi_cfg.py against that latest ofxhome dump in https://github.com/ddoherty03/ofxhome_dump?

@csingley ping on this! I'm happy to do this, but don't want to put the effort in unless I know it's welcome.

[JustinDSN]

@csingley, would you accept a PR to ofxtools where we run update_fi_cfg.py against that latest ofxhome dump in https://github.com/ddoherty03/ofxhome_dump?

@csingley ping on this! I'm happy to do this, but don't want to put the effort in unless I know it's welcome.

Would love to see this issue resolved! Thanks for volunteering @jfly it's appreciated. Understand the desire to ensure the PR will be accepted.

[jfly]

I poked at this a bit today, and am not sure if there's any useful data in the dumps on https://github.com/ddoherty03/ofxhome_dump. Every single institution has a nonzero sslfail, which ofxtools update_fi_cfg.py ignores.

╭─ ~/src/github.com/ddoherty03/ofxhome_dump 17:02:37 (master) 
╰─❯ git grep sslfail | sort | uniq -c
   1030 ofxhome_dump_2023-09.xml:<sslfail>5</sslfail>
     84 ofxhome_dump_2023-09.xml:<sslfail>7</sslfail>
   1011 ofxhome_dump_2024-02.xml:<sslfail>5</sslfail>
    103 ofxhome_dump_2024-02.xml:<sslfail>7</sslfail>
      1 README.org:lastsslvalidation as well as ofxfail and sslfail counts.

If anyone more familiar with the data can chime in about how to interpret it, I'm willing to do the gruntwork.

I do think we should just tear out all the ofxhome code from ofxtools (it's not doing anyone any good), and folks who have issues and can send in PRs to update fi.cfg.

[jfly]

@csingley, friendly ping on this. Would you accept a PR that tears out all the ofxhome code from oxftools?