8 ms·

Admittedly, I don't know the specifics e.g. if there was obvious negligence. However, this seems like a major fine for a security vulnerability. The statement g

• ckastner 7y ago
  > Certainly, calling out poor security practices is a good thing, however this level of scrutiny is going to require a major shift in mentality for a large portion of the industry. "Move fast and break things" just isn't going to cut it anymore. When 339 million guest records are involved, anything less shouldn't cut it anymore.
  • polskibus 7y ago
    30p per record doesn't seem much.
    • jocro 7y ago
      Only a tenth of those are in the EU, mind.
      • addicted 7y ago
        $3 per EU record doesn't sound all that much either.
        • dragonwriter 7y ago
          It's about £3.3 per EEA record, which is closer to $4 than $3, not that likely changes whether it seems like all that much.
        • vkou 7y ago
          The monetary value of the median hotel guest record to the sort of nefarious powers that be that scoop up hotel guest databases is ~$0. It may even be a negative amount. The monetary value of a particular person of interest's guest record may be more than that, but those people are few and far between. If you disagree, please let me know who I can get in touch with, who will pay me $4/guest record. I'll quit my day job, and set up camp outside a hotel lobby, recording guests and license plates.
          • arcticbull 7y ago
            It might have something to do with a 5.25 million unencrypted passport numbers and 8.6 million payment cards, Of which no doubt mine was one
          • kragen 7y ago
            The benefit to the nefarious buyer is not the same as the damage to the hotel guest. In fact, there's no reason to even expect them to be similar in value. And the relevant measure of central tendency is the mean, not the median, since we're looking at the sum of all the damages from all the records being copied. Keeping one gay Egyptian dude from getting outed and killed justifies protecting hundreds or thousands of boring middle-class vacationers from Ohio.
            • vkou 7y ago
              The personal, quantifiable damage to me of every one of my guest records in my past five years getting stolen by some shadowy cabal is zero. That's because I haven't done anything particularly interesting. Neither have most people. If you're ready to wire me a few hundred dollars, I'll be happy to share records of my, and my wife's stays with you. It'll be a waste of your money, but who am I to judge? A few people have done some very interesting things. For them, those numbers are substantially higher than zero. You haven't disproven my point. The quantifiable, median damage is zero. This is relevant, because this sub-thread tries to quantify the harm by taking the fine, divides it by the number of records, produces $3, and posits that the leak has done more than that amount of harm. Because, obviously, if any harm comes, the harm is over three dollars. Well, yes. It is. If you can measure the harm, of course it's more than three dollars. For most people, though, the harm is immeasurable. Pointing out that the median harm is zero exposes the absurdity of the original argument.
    • ckastner 7y ago
      As I mentioned in another comment: It sets an important precedent for future acquisitions.
      • polskibus 7y ago
        Yup, that's the whole point of GDPR - see data as a liability (not just as an asset).
  • TallGuyShort 7y ago
    "Move fast and break things" was never going to cut it. Anyone who has the word "engineer" in their job title, certified or not, should expect better of themselves.
    • ljm 7y ago
      That maxim only works out when you’ve got such a solid CI/CD setup that you can roll out to a tiny percentage of users and automatically roll back and notify if they error out. Move fast and break things all you want if you have such an amazing safety net. But at that point you’re not breaking anything, you’re just letting the real world fill in the gaps in your test suite with an insignificant impact. Still, not good enough if you’re dealing with money, medical stuff, vehicles, etc. You’re getting into life or death territory there.
• mc32 7y ago
  >”Move fast and break things" just isn't going to cut it anymore.” That motivational quote should never have made it out into corporate communication. It was embraced by everyone[1] because it seemed edgy and hey that company is successful in spite of itself. That should never have been embraced by anyone especially outside specific contexts. [1]Just about everyone embraced it because it was a kind of punk attitude in the face of stodgy enterprise development schedules. Everyone wanted to seem cool, so they went whole hog.
  • rusk 7y ago
    I've seen this with medical devices. The amount of callouts these days for service technicians for newer equipment is ridiculous, to the point that you can't even get service technicians to come out any more! and yes, this does mean certain services knocked out for days at a time.
    • levythe 7y ago
      That's a real surprise. I was under the impression that medical equipment was incredibly difficult to get approved for use.
      • rusk 7y ago
        A common misconception https://www.youtube.com/watch?v=-tIdzNlExrw https://www.youtube.com/watch?v=-tIdzNlExrw
      • thefounder 7y ago
        In Europe is easier to get approved but this is changing...
      • bilbo0s 7y ago
        Well, in the US, there's the FDA. And that is a bit more stringent than EU. But even in the US, medical equipment breaks down. Just not at near as high a rate.
        • 7y ago
• q3k 7y ago
  > "Move fast and break things" just isn't going to cut it anymore. Good.
  • drstewart 7y ago
    I'd go further and say anyone running serious enterprises that have important security implications should not be taking it lightly. Nobody should "run an ISP for fun". Cowboys like that, or people who describe themselves as "hackers" have no place in the industry.
• diminoten 7y ago
  GDPR doesn't apply to companies still in the "Move fast, break things" phase.
  • Benjamin_Dobell 7y ago
    It does if said companies plan on being acquired, which is precisely what happened here: > It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016
    • diminoten 7y ago
      Starwood is by far big enough to have the GDPR apply to it independently. Starwood was well beyond the "move fast and break things" phase of companies. Many companies aren't, and if you're trying to say all startups have to comply with GDPR on day 1, you are wrong.
      • supermatt 7y ago
        Yes they do, from day 1. Maybe you are confused between this and the recent copyright stuff
        • diminoten 7y ago
          https://www.internetlegalattorney.com/are-there-gdpr-exemptions-for-u-s-small-businesses/ https://www.internetlegalattorney.com/are-there-gdpr-exempti... > U.S. based businesses may actually be exempt based upon some interpretation of Article 3.2(a):
          • supermatt 7y ago
            OK - so basically, if you don't knowingly provide (or envisage providing) goods or services to EU customers. This is a very different situation from your original statements based on size and maturity of a company - but I'll concede that the EU reach clearly only applies to EU interests .
• crumpets 7y ago
  >ensure its security, just like they would do with any other asset. This motivation is asinine. Record leaks don't do anything to harm the original records and it's not like Marriott's secret sauce is a list of customer records. Companies don't protect assets from things that don't cause the assets harm. Personal data does not have value to the company in that regard. It's a liability more than an asset.
  • formercoder 7y ago
    The definition of an asset is something that provides probable future economic value to the firm. Personal data seems to fall under this category to me.
    • marcus_holmes 7y ago
      Hopefully this fine will help wake the industry up to the fact that this asset comes with considerable regulatory costs, and that those costs may well be more than the value of the asset. Hopefully that will stop them hoarding personal data. GDRP is working as intended :)
  • amputect 7y ago
    If personal data doesn't have value to the company and it's not an asset, then the company shouldn't be collecting and storing it. Making storing personal data a liability is good if the goal is to prevent companies from storing personal data unless there's a strong business need (and corresponding level of care) involved.
• Too 7y ago
  The idea is to make hoarding data "just because you can" a liability. If you think it has value you should also protect it likewise. If you think data has less value than "move fast and break things" then simply delete the data ASAP after you don't need it anymore.
• Zenst 7y ago
  > "Move fast and break things" just isn't going to cut it anymore. Yes, the cutting edge can cut both ways. But alas is kinda needed in IT security. So easy for a security update to come out, yet the process in some companies rightly dictates that it is tested so that the update does not break anything else. So you get a delay. So even then, that small window could see that security issue exploited and the powers that be will see you didn't apply the update instantly and you're lambasted - even for following best practices and going by the book of testing. After all, any update could have an impact upon the applications and infrastructure in ways above and beyond the issue the update is addressing. We have all encountered such issues as well. So the phrase "move fast and break things" has a younger brother now "move slow and be broken". Be nice if the powers that be (Governments) proactively audited companies IT security proactively instead of being event driven - after the horse has always bolted. I would love to see companies fined for security issues before such security issues are exploited and abused. After all, the customer always pays. Until that happens, the same mentalities in how security is treated as a priority will carry on playing out. But the other old IT saying of "if it works, don't touch it" whilst true, equally is the source of so many security issues that it just can not carry on being leaned upon.
• JustSomeNobody 7y ago
  They should be subject to independent security audits for the next X number of years in addition to the fine. It would only take a few companies having to go through this before budgets stop getting cut in IT.
• avs733 7y ago
  As came up the other day on HN, Move fast and break things used to be the way that bridges were designed (i.e., build it, test it, see if it breaks, improve it if it does). I don't think anyone would tolerate that as a way to conduct other fields of engineering anymore.
  • dgzl 7y ago
    I disagree. At the cutting edge of development, experiments and failure is impossible the avoid without incredible and expensive measures, which, you know, isn't exactly feasible in every case.
• JimDabell 7y ago
  > Certainly, calling out poor security practices is a good thing, however this level of scrutiny is going to require a major shift in mentality for a large portion of the industry. That's the point. "A major shift in mentality for a large portion of the industry" is basically GDPR's success criteria.