25 ms·

American Airlines is trying to stop a popular app used by flight attendants

500 points by josephcsible 4y ago

galonk 4y ago
AA sounds like a horrible company. They had a design legacy from when their logo and identity were designed by Massimo Vignelli, but they threw it away and didn't seem to have any concept of its value. Their website has terrible design and usability. When a blogger posted an article about how bad it was, one of the designers at AA reached out anonymously and said they understood his criticisms and that they were working to make the site better. AA searched their mail servers to find that employee and fired them for... caring, I guess?
cwkoss 4y ago
Are American Airlines workers unionized? I wonder if they could collaborate with their union and get additional protections to workers' ability to access this data portably.
ineedasername 4y ago
Descriptions of what the app does are very vague. What does it actually do?
ecommerceguy 4y ago
Clever PR at work here.
elmerfud 4y ago
I guess these flight attendants have never flew their own airline as a customer. This doesn't shock me at all from AA.
- dcdc123 4y ago
  I have never had an uneventful flight on American. I avoid them even if it costs me more time and money.
  - pb7 4y ago
    Everyone has “that story” about one particular airline but AA is particularly bad because a large portion of their fleet is old and requires a lot of maintenance which unsurprisingly causes delays and cancelations. I echo the statement that I’ve never had an uneventful flight on AA. I fly a lot and can confidently say other major airlines are more reliable but usually also more expensive.
    - acchow 4y ago
      This is why I’ll only book an AA flight on newer metal. It’s overall a smoother experience.
    - quartz 4y ago
      Pre-bankruptcy AA was so good. Exec plats were treated super well and their fleet was massive— even if a plane had an issue they could almost always hot-swap it out for another one. Despite the website feeling dated now it used to be one of the only airlines where the website accurately reflected the backend system (even phone agents couldn’t touch your booking if you had it open on the site) and their lounges were solid too. These days I agree they’re towards the bottom of the stack sadly… everyone else caught up and they stayed still. I mostly fly Delta now almost entirely for the on-time performance.
      - pb7 4y ago
        I mostly fly United due to living in one of their hubs and have become accustomed to reliable service on well maintained planes. Every time I hear complaints about rampant delays or cancelations, I wonder what year they’re living in. But then I end up flying American and I realize it’s not the year, it’s the airline. Even in their biggest hubs, there is always delay-inducing last minute maintenance with no hot swap available. I just experienced this recently and was immediately reminded of this time last year when they made headlines about canceling a massive percentage of flights daily for months. I actually much prefer AA’s website to United’s. AA’s may seem dated but it’s fast and the UI predictable. United’s feels like it’s fighting me.
sidewndr46 4y ago
I don't understand. What does this app do?
- derekbaker783 4y ago
  From TFA: "it displays information required by crew members to manage their rosters and work lives in a single app. The app is particularly popular among the large number of ‘reserve’ flight attendants at American Airlines because it gives them more control over their schedules, and the app has other features such as a calculator to make sure crew are working to legal limits."
  - ajkjk 4y ago
    That's pretty vague.
    - sidewndr46 4y ago
      Yeah, this was what I was trying to understand. This makes it sound like the app could be a daily listing of flights they need to work. Is that all it is?
      - mathieuh 4y ago
        The article suggests this is a single app which offers a single entry point into many disparate systems, which currently flight attendants have to access individually in order to do their jobs.
      - pc86 4y ago
        There is a top-level comment higher up that lists the individual features. One is notably absent from AA's internal systems: checking that FA schedules are consistent with the regulations governing how much they can work. But the crux of it is that is takes the FA's AA credentials, collects their personal data from disparate internal AA systems, and displays it in a sane way to the FA. And presumably at least a couple of the features (like the legality checker) are sugar on top. I would not underestimate how terrible internal legacy systems at a company like AA could be. It seems completely reasonable to me that this app could save FAs an hour a day or more. And if they're like pilots (who are typically only paid on time from wheels up to touchdown) that is likely an unpaid hour.
dboreham 4y ago
Rule #1: don't start a business that depends on data owned by some other business. Rule #1-1: especially if your product adversely affects the other business. Rule #1-2: especially if the other business is much larger than yours.
- saurik 4y ago
  While true, is that relevant? This app is free and doesn't even have in-app purchases, so it sounds like it was just built by a person (one sufficiently human to its users that the reviews are directly written to or about "Jeff") who had some reason to care for this community and isn't a "business".
  - TobyTheDog123 4y ago
    While true, is that relevant? I can easily see Apple siding with a business as large as AA over a single person trying to make a useful app for people.
    - mannerheim 4y ago
      If you choose a walled garden, you'll have to live at the mercy of gatekeepers.
- renewiltord 4y ago
  Well, it's not a business, and it doesn't adversely affect the other business so this is fine. The complaint isn't really by the app developer. It's mostly that life is being made hard for the attendants through blocking the developer.
  - mannerheim 4y ago
    It adversely affects AA by making it more difficult to overwork their employees.
- deleted 4y ago
  [deleted]
shagie 4y ago
The app: https://apps.apple.com/us/app/sequence-decoder/id1439988599 https://apps.apple.com/us/app/sequence-decoder/id1439988599 For the public: -Past and future departure information for all airports -Past and future arrival information for all airports -Individual flight info lookup For flight attendants: -Flight specific info inflight -ETB alerts -Open time alerts -Flight alerts -Open time display -Sequence details -Calendar -Reserve call out list -Standby list -Crew chat -Save notes about crew members -Display prior sequences flown together with others -Layover weather forecast -Pilot sequence info -Legality checker -Hotel amenities and pickup locations
- deleted 4y ago
  [deleted]
- ketzo 4y ago
  Two thoughts: 1. Wow, that looks like an extremely useful app if you're a flight attendant! 2. How is their employer not providing this functionality? I guess maybe they are, but only parts, or it's a shittier version. But still.
  - pjc50 4y ago
    The critical bit is probably the "legality checker". Absolutely no way an employer would offer one of those. Reading between the lines, flight attendant scheduling is probably quite .. adversarial, as shift scheduling at restaurants can be. The employer would like employees to have the minimum information so they meekly accept the shifts they're given.
    - badcppdev 4y ago
      What's a legality checker?
      - mannerheim 4y ago
        My guess is it checks whether their shifts are compliant with labour laws.
steverob 4y ago
Looks like its pulling data from Jetnet which is a flight management tool used by these Airlines?
- deleted 4y ago
  [deleted]
nnm 4y ago
It is commonsense to use the hardware/software authorized by your employer to do the work. One side story. It is third party app that is not authorized by AA. Instead of get permission through a contract, the app developer scraped AA's data without AA's permission.
- Retric 4y ago
  You don’t need specific permission to scrape data.
  - onphonenow 4y ago
    If it’s your employers you do If it’s an app on apples App Store you do
    - hedora 4y ago
      Source? The courts have consistently ruled the other way on the question of scraping. If you then share confidential information with third parties your employer may (or may not) have a case.
      - onphonenow 4y ago
        All the rulings here have enforced employers rights to their data. The google engineer using their login to scrape users private emails and then running it through a third party platform would be fired.
      - notahacker 4y ago
        App screenshot on the appstore shows a list of names associated with a rota, presumably crew member names scraped from the airlines' password-protected crew portal. It's not especially surprising airlines don't want unauthorised third party apps accessing and storing personal data from their intranets, even if the third party developer is very ethical about not leaking it to people without passwords and makes beautiful UX
arciini 4y ago
I'm sad that this is happening to an app that's useful to its users, but the reality is that scraping is legal, always possible, but difficult. This particular case is a bit harder since it's not purely using public data, but may still qualify since it's likely scraping with legally-obtained credentials. I know of businesses (scraping for ride-sharing, scraping for business intelligence for retailers, scraping from LinkedIn - see HiQ Labs v. LinkedIn) that have continuously succeeded via scraping in ways that large businesses oppose. The key is: you must make enough profit to justify dedicating engineering and legal techniques to defend your scraping. - Scraping public data is legal, as affirmed by the Supreme Court in Van Buren v. United States [1] and HiQ Labs v. LinkedIn [2]. Defending yourself or suing the data owner in court are both expensive though - Defeating anti-scraping via technical means is pretty much always possible, but can be costly depending on the scraped site's technical expertise and value in keeping their data private. The benefit to you must exceed the cost to you, and ideally should also exceed the cost to the data owner - Mobilizing PR and internal resistance may also be effective, but it's usually hard to have outcry from a large enough group to change an organization's policies. In this case, the union can push for it, but AA may try to withhold improvements until the next set of union negotiations 1. https://en.wikipedia.org/wiki/Van_Buren_v._United_States https://en.wikipedia.org/wiki/Van_Buren_v._United_States 2. https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn
- YeBanKo 4y ago
  Playing devil’s advocate here: this is not the same as scraping LinkedIn data. Linkedin data is public. This app requires a login info from a flight attendants to scrape their schedules. When you try to log in, you can choose to login as public or as a AA flight attendant. It sucks, but I also understand why a company may be unhappy, that a third party handles credentials and accesses internal data. What they can: - build a 3rd part integration API, which opens up a whole can of worms. Not many tech-first companies can do it right, for an airline it’s a very challenging steps. - build their own, but they already failed there if their employees turn to 3rd party - ignore and let it run. This is basically unauthorized access to go and hope that the guy names Jeff won’t screw up. - deny and prevent access. This is probably technically the easiest and safest from legal standpoint.
RcouF1uZ4gsC 4y ago
What seems unsaid in the article but seems to be the case, is that the app is logging in to American Airlines systems using the flight attendant credentials and then scraping. If this is the case, I think American Airlines is justified in trying to block them. An app storing/using credentials for a different service is a data breach waiting to happen.
- nnm 4y ago
  It is commonsense to use the hardware/software authorized by your employer to do the work.
  - TobyTheDog123 4y ago
    This is nonsense. This would be like claiming you have to use a company-sponsored to-do list app, or a company-sponsored git client, or a company-sponsored text editor, or a company-sponsored FTP client. I'd hate to be at any job that enforces any single one of those. There are many arguments against this app, but this is not one of them.
    - alar44 4y ago
      Really? Maintaining consistency across users is a huge part of IT. I can't imagine working somewhere where everyone just uses whatever software they want. Support would be a nightmare.
    - a4isms 4y ago
      I'm not entirely sure that is a nonsensical argument. I am permitted to use any client I like to perform SQL queries of our customer data, but if the client were to happen to route the data through a third party, I would be in employment-jeopardy breach of our security policies. Similar rules goes for hardware: I can bring my own device for reading and locally storing our email and chats, but customer data is not to be accessed on any hardware not authorized by the company. Roster data is not customer data, and there are reasonable arguments to be made that this is not an exact parallel. But in principle, I can understand a company wanting to have control over certain types of data and how it might be exfiltrated from the company, even if it is intended for employees to use to do their jobs.
jmslbam 4y ago
Reminds me of those Stockholm parents that built an app by obtaining data, in a legal way, that worked better the the manufactorer build themselfs.... https://www.wired.com/story/sweden-stockholm-school-app-open-source/ https://www.wired.com/story/sweden-stockholm-school-app-open... :)
- kleiba 4y ago
  Landgren would dig through endless convoluted menus to find out what his children were doing at school. If working out what his children needed in their gym kit was a hassle, then working out how to report them as sick was a nightmare. This seems very removed from my own school days: - find out what the children were doing at school: you couldn't, really, the curricula were not public. You could ask your kids after school, but I guess most parents were not really that interested anyway. - what his children needed in their gym kit: shorts, t-shirt, sneakers. Every time. What else could it be? - working out how to report them as sick: I suppose parents called the school in the morning(?) but as teachers were usually unaware of the reasons for a child's absence anyway they might as well not have done that at all. After the first term, the schoolmates would just inform all other teachers that X was sick, assuming so from the absence. Then, when X came back to school, they would bring a hand-written note from the parents explaining.
  - yamtaddle 4y ago
    I truly think computerized school communication is worse than notes in backpacks and the occasional mailed letter. They send way too much useless shit, way too often, so you end up ignoring a lot of it; use way too many channels to do it; design sites poorly—how about the year's calendar on the first page for a given school, above "the fold", with a link to subscribe your preferred calendaring software to it, right there, office contact info off to the side, also above "the fold"? And no horrible excessively-complex half-broken themes making it difficult to navigate? Nah, that'd be too helpful; and everything's in several different systems, all bad, and all in various states of up-to-date or neglected, so it can be hard to guess where you need to look for something and hard to know whether it's accurate when you do find it (especially if the apparent signal is "empty" or "nothing there" or "no information"—is that true, or has it just not been updated lately?)
TobyTheDog123 4y ago
How long until Apple removes this app for the same reasons as The OG App? https://news.ycombinator.com/item?id=33015769 https://news.ycombinator.com/item?id=33015769 5.2.2 Third-Party Sites/Services: If your app uses, accesses, monetizes access to, or displays content from a third-party service, ensure that you are specifically permitted to do so under the service’s terms of use. Authorization must be provided upon request.
- tsol 4y ago
  Hmm honestly it looks like they'd be in the right to take it down too. I support the app and I think it's cool what they're(the app makers) doing, but it's not surprise that app stores might not be cool with the DIY nature of how they get the data.
  - mylons 4y ago
    if it's not illegal to acquire the data, then this is the app store likely getting a call from AA and shutting you down. meanwhile, if you're this Jeff guy, you can submit a request to apple or google and get an email response days/weeks later. what's cool about that?
    - tsol 4y ago
      Sorry when I said 'I think it's cool what they're doing' I was referring to the app makers. The wording was a little ambiguous-- fixed.
- mylons 4y ago
  sadly waiting on the EU to dismantle app store monopolies via regulation.
golemotron 4y ago
I came here to articulate the counter position to this because people are solidly on the side of the app developer. If you run a business and your employees access your information to do their work through an un-contracted intermediary, it's a real security risk. The information can be filtered or maliciously corrupted, and the company can be easily blackmailed. I don't think the law offers any direct remedy. The best thing for AA to do is force the app developer into court and make them pay legal fees if they don't want to contract with them, compete by making something better for their employees, or contract with someone else to provide the service. It's costly on all sides but table stakes for running a business in a competitive market these days.
- stalfosknight 4y ago
  Or AA could improve their systems so that this app wouldn't be necessary. Or buy out the app. Or contract with the developer.
nnm 4y ago
One side story. There is no comments / voice on the AA side. Read like a biased article. "become a must-have" reads like exaggeration
- MattGaiser 4y ago
  > American Airlines has been contacted for comment. They have been asked for one.
- blamazon 4y ago
  There are no comments/voice on the AA side because they are likely 'accidentally' dodging labor laws (by laying obligation of checking legality on the attendants) through obfuscation of this data. That seems a large part of why it's become a 'must-have.' That kind of behavior merits this relatively 'soft' one-sided take in my opinion.
- not2b 4y ago
  By that reasoning, if the company refuses to comment an article should not be published, or if published must be rejected as one sided? That's convenient.
  - gpvos 4y ago
    You can always still publish when they don't react within a reasonable time, and add a comment to that effect, as you can often see in newspaper articles.
    - not2b 4y ago
      From the article: "American Airlines has been contacted for comment." Evidently they did not respond.
      - gpvos 4y ago
        Ah, I overlooked that. But I would have searched for it before posting a comment like nnm's above.
geekrax 4y ago
The reddit thread that this article is failing to credit to: https://www.reddit.com/r/flightattendants/comments/y38tqp/if_youre_with_aa_you_might_use_sequence_decoder/ https://www.reddit.com/r/flightattendants/comments/y38tqp/if...
driscoll42 4y ago
On the developer's Patreon (https://www.patreon.com/tschaff https://www.patreon.com/tschaff) there's a few more details. He's a former AA flight attendant, seems like there was a somewhat similar project underway internally in the airline union which he was on but got kicked off of and built this separately.
entropyie 4y ago
Yet another reason to build a website instead of an "App". It seems to me that all this could be delivered via website or PWA... Then no one could block it. Careful client side caching would help for times of no connectivity.
- k8sToGo 4y ago
  And how would that solve anything? It’s the backend that is getting blocked.
- kyle-rb 4y ago
  I'm a big advocate for PWAs, but this is a backend data issue. American Airlines isn't forcing app stores to take down the app, they're adding anti-scraping measures to prevent the app's backend from being able to request data for flights, shifts, etc.
0xbadcafebee 4y ago
"One flight attendant said of the current situation affecting Sequence Decoder that they had “never seen a company go out of their way to make life harder for their workers.”" Every large company I've worked for had an IT department (or similar) that intentionally made developers'/sysadmins' lives harder. They don't care. So the good people leave, morale drops, productivity drops, management starts implementing crap policies to force more work to get done.
- dreamcompiler 4y ago
  Same here. IT people would prefer to shut down the company rather than help it achieve its mission because they are heavily incentivized to prevent security incidents and not incentivized at all to help with the mission. Couple that with a CIO who wants to build an empire and second- or third-rate MCSE "Certified" personnel and IT inevitably becomes a huge impedance against the corporate mission.
- GlenTheMachine 4y ago
  Our IT security people give every impression that their preferred solution would be to drop all the computers in the river and lock the doors. I naively went to them once with a suspected security intrusion event; they threatened to have me arrested. I couldn't convince them that I wasn't the one responsible.
  - RockRobotRock 4y ago
    At a previous company I worked, my team (system’s infrastructure) would purposefully avoid the cyber security team, and even attempt to sweep security issues under the rug, because they were so awful to work with.
    - rootsudo 4y ago
      Can't say any intrusion happen if you don't accept reports or investigate anything. :D
- ajmurmann 4y ago
prvit 4y ago
If we’re talking about apps in the airline industry, take a look at Stafftraveler (https://stafftraveler.com/ https://stafftraveler.com/) Everyone in the industry uses this app. What is it for? Leaking passenger load data from internal systems to employees of other airlines. Presumably all the data gets sold by the platform operators to some hedge funds for big bucks.
oxymoron 4y ago
I am not convinced that AA is actively trying to block this app. I used to work for a major anti-bot vendor, so from that I know that all airlines suffer heavily from price scraping and try to protect their flight search endpoints. The impact to them is due to fees from the centralized data services that all airlines depend on.
- Syzygies 4y ago
  "Never attribute to malice what can be explained by incompetence." I fly American between JFK and SFO regularly, including today. They have the best prices these days for an "international" business class on this route. The food is good, the flight attendants are friendly and good at their jobs... Automobile manufacturers offer pathetic "center console" software compared to Apple, Google. American's in-flight entertainment system makes auto makers look like geniuses. They just don't understand software.
  - waynecochran 4y ago
    American Airlines has by far the worst web page for any airline. Frequent broken pages. Good luck if you have a question.
  - crznp 4y ago
    Corollary: if you think that everyone is incompetent, perhaps you're missing something. For instance, you fly with AAL because of price, food, service. What sort of entertainment system would change your mind? It is hard to create something that works for everyone, is integrated with a plane that doesn't have a lot of downtime, etc. I'd rather just use my own device, so the best entertainment system in the world is unlikely to change who I fly with. So why invest in that? Or on the original topic: the problem is not that they can't develop a similar app -- if nothing else, they could license this one or just turn a blind eye. It seems like they don't want it to exist.
    - Arainach 4y ago
      It's really not. From what I've seen of crashes and boot up screens, most airlines seem to use some rebranded Android experience. I'm fairly confident that's what American used the most recent time I flew them based on some navigation buttons that appeared on the bottom at one point. There's a lot of Android devs out there in the world, but AA does seem to hire or subcontract to some particularly bad ones.
jay-anderson 4y ago
We have bots scraping some of our pages at work. We've attempted to reach out but haven't received a response. We don't mind the bots so much themselves, but we want them to be well behaved. Currently they are making calls over and over again that return a 4xx response and are a significant portion of our traffic. We want to request that they stop making bad requests and slow down (we do have throttling in place, but this just gave them more errors to ignore and retry.). I'd love for an open third-party like this one. It'd even help with prioritizing features that we're missing in our first-party products.
- runjake 4y ago
  Isn't this where you put a stop to existing requests and implement free API keys?
- a1369209993 4y ago
  > but this just gave them more errors to ignore and retry. So null-route the offending IPs on a [0]24-hour timeout? The problem you're describing isn't "scraping", it's "low-grade denial-of-service attack (that you suspect might be a result of attempted scraping)", and should be addressed accordingly. (The parenthesised part doesn't really matter.) 0: exponentially increasing up to -, for automated versions, but you're presumably already familiar with the current batch of offending source addresses.
  - a1369209993 4y ago
    [Too late to edit:] Also, double check that your first-stage throttling actually increases the latency of the requests, such that a user-agent that doesn't issue multiple requests concurrently (but starts a new request immediately on recieving a response) will automatically self-rate-limit. This should be standard for any 'serious' HTTP server, but I've seen a few that incorrectly go straight from "serve 200 OK instantly" to "serve 429 Too Many Requests, also instantly" rather than "serve 200 OK after ~1 second", and sending 429 only when there are actually too many requests (in particular, more than one at any given time).
bananamerica 4y ago
Can someone provide an explanation on what value this app brings do the flight attendants and what would mean for them to not have it anymore?
mfext 4y ago
I worked briefly years back on a web app at AA that provided the scheduling features for flight staff that this app provides. I didn’t see what happened to it in the end, but reading the app’s feature list, it sounds like that app plus social elements and weather. From scraping, which is scary IMHO.
jdelman 4y ago
Reminds me a bit of the dispute between McDonald's/Taylor and Kytch. An independent company Y stepping in to fix a particularly broken aspect of another company X's workflow (or literally a piece of hardware), company X responds badly, company X doesn't have the internal resources to do better, or company X is purposely not fixing things for some dumb and/or profit-motivated reason. A possible solution: build your scraper as a Chrome extension and have legitimately logged-in users periodically hit that SCRAPE button.
- RockRobotRock 4y ago
  This wouldn’t work in the context of a mobile app though.
dddrh 4y ago
Is there a linked source or way to validate the claims? I'm curious to learn more but the author didn't link or reference any. The comments seem to verify it but I don't find them trustworthy either.
tomohawk 4y ago
Typical adversarial relationship that develops between companies and unionized employees. It becomes more about winning the power struggle than getting work done or having a good life. And also more about the rules in the current contract than anything else. If the current contract doesn't have any rules about it, then employees are just stuck with it until the next contract negotiation between the union and the company. Thems the breaks.

500 points by josephcsible 4y ago

AA sounds like a horrible company. They had a design legacy from when their logo and identity were designed by Massimo Vignelli, but they threw it away and didn't seem to have any concept of its value. Their website has terrible design and usability. When a blogger posted an article about how bad it was, one of the designers at AA reached out anonymously and said they understood his criticisms and that they were working to make the site better. AA searched their mail servers to find that employee and fired them for... caring, I guess?

cwkoss 4y ago

Are American Airlines workers unionized? I wonder if they could collaborate with their union and get additional protections to workers' ability to access this data portably.

ineedasername 4y ago

Descriptions of what the app does are very vague. What does it actually do?

ecommerceguy 4y ago

Clever PR at work here.

elmerfud 4y ago

I guess these flight attendants have never flew their own airline as a customer. This doesn't shock me at all from AA.

dcdc123 4y ago
I have never had an uneventful flight on American. I avoid them even if it costs me more time and money.
- pb7 4y ago
  Everyone has “that story” about one particular airline but AA is particularly bad because a large portion of their fleet is old and requires a lot of maintenance which unsurprisingly causes delays and cancelations. I echo the statement that I’ve never had an uneventful flight on AA. I fly a lot and can confidently say other major airlines are more reliable but usually also more expensive.
  - acchow 4y ago
    This is why I’ll only book an AA flight on newer metal. It’s overall a smoother experience.
  - quartz 4y ago
    Pre-bankruptcy AA was so good. Exec plats were treated super well and their fleet was massive— even if a plane had an issue they could almost always hot-swap it out for another one. Despite the website feeling dated now it used to be one of the only airlines where the website accurately reflected the backend system (even phone agents couldn’t touch your booking if you had it open on the site) and their lounges were solid too. These days I agree they’re towards the bottom of the stack sadly… everyone else caught up and they stayed still. I mostly fly Delta now almost entirely for the on-time performance.
    - pb7 4y ago
      I mostly fly United due to living in one of their hubs and have become accustomed to reliable service on well maintained planes. Every time I hear complaints about rampant delays or cancelations, I wonder what year they’re living in. But then I end up flying American and I realize it’s not the year, it’s the airline. Even in their biggest hubs, there is always delay-inducing last minute maintenance with no hot swap available. I just experienced this recently and was immediately reminded of this time last year when they made headlines about canceling a massive percentage of flights daily for months. I actually much prefer AA’s website to United’s. AA’s may seem dated but it’s fast and the UI predictable. United’s feels like it’s fighting me.

sidewndr46 4y ago

I don't understand. What does this app do?

derekbaker783 4y ago
From TFA: "it displays information required by crew members to manage their rosters and work lives in a single app. The app is particularly popular among the large number of ‘reserve’ flight attendants at American Airlines because it gives them more control over their schedules, and the app has other features such as a calculator to make sure crew are working to legal limits."
- ajkjk 4y ago
  That's pretty vague.
  - sidewndr46 4y ago
    Yeah, this was what I was trying to understand. This makes it sound like the app could be a daily listing of flights they need to work. Is that all it is?
    - mathieuh 4y ago
      The article suggests this is a single app which offers a single entry point into many disparate systems, which currently flight attendants have to access individually in order to do their jobs.
    - pc86 4y ago
      There is a top-level comment higher up that lists the individual features. One is notably absent from AA's internal systems: checking that FA schedules are consistent with the regulations governing how much they can work. But the crux of it is that is takes the FA's AA credentials, collects their personal data from disparate internal AA systems, and displays it in a sane way to the FA. And presumably at least a couple of the features (like the legality checker) are sugar on top. I would not underestimate how terrible internal legacy systems at a company like AA could be. It seems completely reasonable to me that this app could save FAs an hour a day or more. And if they're like pilots (who are typically only paid on time from wheels up to touchdown) that is likely an unpaid hour.

dboreham 4y ago

Rule #1: don't start a business that depends on data owned by some other business. Rule #1-1: especially if your product adversely affects the other business. Rule #1-2: especially if the other business is much larger than yours.

saurik 4y ago
While true, is that relevant? This app is free and doesn't even have in-app purchases, so it sounds like it was just built by a person (one sufficiently human to its users that the reviews are directly written to or about "Jeff") who had some reason to care for this community and isn't a "business".
- TobyTheDog123 4y ago
  While true, is that relevant? I can easily see Apple siding with a business as large as AA over a single person trying to make a useful app for people.
  - mannerheim 4y ago
    If you choose a walled garden, you'll have to live at the mercy of gatekeepers.
renewiltord 4y ago
Well, it's not a business, and it doesn't adversely affect the other business so this is fine. The complaint isn't really by the app developer. It's mostly that life is being made hard for the attendants through blocking the developer.
- mannerheim 4y ago
  It adversely affects AA by making it more difficult to overwork their employees.
deleted 4y ago
[deleted]

shagie 4y ago

The app: https://apps.apple.com/us/app/sequence-decoder/id1439988599 https://apps.apple.com/us/app/sequence-decoder/id1439988599 For the public: -Past and future departure information for all airports -Past and future arrival information for all airports -Individual flight info lookup For flight attendants: -Flight specific info inflight -ETB alerts -Open time alerts -Flight alerts -Open time display -Sequence details -Calendar -Reserve call out list -Standby list -Crew chat -Save notes about crew members -Display prior sequences flown together with others -Layover weather forecast -Pilot sequence info -Legality checker -Hotel amenities and pickup locations

deleted 4y ago
[deleted]
ketzo 4y ago
Two thoughts: 1. Wow, that looks like an extremely useful app if you're a flight attendant! 2. How is their employer not providing this functionality? I guess maybe they are, but only parts, or it's a shittier version. But still.
- pjc50 4y ago
  The critical bit is probably the "legality checker". Absolutely no way an employer would offer one of those. Reading between the lines, flight attendant scheduling is probably quite .. adversarial, as shift scheduling at restaurants can be. The employer would like employees to have the minimum information so they meekly accept the shifts they're given.
  - badcppdev 4y ago
    What's a legality checker?
    - mannerheim 4y ago
      My guess is it checks whether their shifts are compliant with labour laws.

steverob 4y ago

Looks like its pulling data from Jetnet which is a flight management tool used by these Airlines?

deleted 4y ago
[deleted]

nnm 4y ago

It is commonsense to use the hardware/software authorized by your employer to do the work. One side story. It is third party app that is not authorized by AA. Instead of get permission through a contract, the app developer scraped AA's data without AA's permission.

Retric 4y ago
You don’t need specific permission to scrape data.
- onphonenow 4y ago
  If it’s your employers you do If it’s an app on apples App Store you do
  - hedora 4y ago
    Source? The courts have consistently ruled the other way on the question of scraping. If you then share confidential information with third parties your employer may (or may not) have a case.
    - onphonenow 4y ago
      All the rulings here have enforced employers rights to their data. The google engineer using their login to scrape users private emails and then running it through a third party platform would be fired.
    - notahacker 4y ago
      App screenshot on the appstore shows a list of names associated with a rota, presumably crew member names scraped from the airlines' password-protected crew portal. It's not especially surprising airlines don't want unauthorised third party apps accessing and storing personal data from their intranets, even if the third party developer is very ethical about not leaking it to people without passwords and makes beautiful UX

arciini 4y ago

I'm sad that this is happening to an app that's useful to its users, but the reality is that scraping is legal, always possible, but difficult. This particular case is a bit harder since it's not purely using public data, but may still qualify since it's likely scraping with legally-obtained credentials. I know of businesses (scraping for ride-sharing, scraping for business intelligence for retailers, scraping from LinkedIn - see HiQ Labs v. LinkedIn) that have continuously succeeded via scraping in ways that large businesses oppose. The key is: you must make enough profit to justify dedicating engineering and legal techniques to defend your scraping. - Scraping public data is legal, as affirmed by the Supreme Court in Van Buren v. United States [1] and HiQ Labs v. LinkedIn [2]. Defending yourself or suing the data owner in court are both expensive though - Defeating anti-scraping via technical means is pretty much always possible, but can be costly depending on the scraped site's technical expertise and value in keeping their data private. The benefit to you must exceed the cost to you, and ideally should also exceed the cost to the data owner - Mobilizing PR and internal resistance may also be effective, but it's usually hard to have outcry from a large enough group to change an organization's policies. In this case, the union can push for it, but AA may try to withhold improvements until the next set of union negotiations 1. https://en.wikipedia.org/wiki/Van_Buren_v._United_States https://en.wikipedia.org/wiki/Van_Buren_v._United_States 2. https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn

YeBanKo 4y ago
Playing devil’s advocate here: this is not the same as scraping LinkedIn data. Linkedin data is public. This app requires a login info from a flight attendants to scrape their schedules. When you try to log in, you can choose to login as public or as a AA flight attendant. It sucks, but I also understand why a company may be unhappy, that a third party handles credentials and accesses internal data. What they can: - build a 3rd part integration API, which opens up a whole can of worms. Not many tech-first companies can do it right, for an airline it’s a very challenging steps. - build their own, but they already failed there if their employees turn to 3rd party - ignore and let it run. This is basically unauthorized access to go and hope that the guy names Jeff won’t screw up. - deny and prevent access. This is probably technically the easiest and safest from legal standpoint.

RcouF1uZ4gsC 4y ago

What seems unsaid in the article but seems to be the case, is that the app is logging in to American Airlines systems using the flight attendant credentials and then scraping. If this is the case, I think American Airlines is justified in trying to block them. An app storing/using credentials for a different service is a data breach waiting to happen.

nnm 4y ago
It is commonsense to use the hardware/software authorized by your employer to do the work.
- TobyTheDog123 4y ago
  This is nonsense. This would be like claiming you have to use a company-sponsored to-do list app, or a company-sponsored git client, or a company-sponsored text editor, or a company-sponsored FTP client. I'd hate to be at any job that enforces any single one of those. There are many arguments against this app, but this is not one of them.
  - alar44 4y ago
    Really? Maintaining consistency across users is a huge part of IT. I can't imagine working somewhere where everyone just uses whatever software they want. Support would be a nightmare.
  - a4isms 4y ago
    I'm not entirely sure that is a nonsensical argument. I am permitted to use any client I like to perform SQL queries of our customer data, but if the client were to happen to route the data through a third party, I would be in employment-jeopardy breach of our security policies. Similar rules goes for hardware: I can bring my own device for reading and locally storing our email and chats, but customer data is not to be accessed on any hardware not authorized by the company. Roster data is not customer data, and there are reasonable arguments to be made that this is not an exact parallel. But in principle, I can understand a company wanting to have control over certain types of data and how it might be exfiltrated from the company, even if it is intended for employees to use to do their jobs.

jmslbam 4y ago

Reminds me of those Stockholm parents that built an app by obtaining data, in a legal way, that worked better the the manufactorer build themselfs.... https://www.wired.com/story/sweden-stockholm-school-app-open-source/ https://www.wired.com/story/sweden-stockholm-school-app-open... :)

kleiba 4y ago
Landgren would dig through endless convoluted menus to find out what his children were doing at school. If working out what his children needed in their gym kit was a hassle, then working out how to report them as sick was a nightmare. This seems very removed from my own school days: - find out what the children were doing at school: you couldn't, really, the curricula were not public. You could ask your kids after school, but I guess most parents were not really that interested anyway. - what his children needed in their gym kit: shorts, t-shirt, sneakers. Every time. What else could it be? - working out how to report them as sick: I suppose parents called the school in the morning(?) but as teachers were usually unaware of the reasons for a child's absence anyway they might as well not have done that at all. After the first term, the schoolmates would just inform all other teachers that X was sick, assuming so from the absence. Then, when X came back to school, they would bring a hand-written note from the parents explaining.
- yamtaddle 4y ago
  I truly think computerized school communication is worse than notes in backpacks and the occasional mailed letter. They send way too much useless shit, way too often, so you end up ignoring a lot of it; use way too many channels to do it; design sites poorly—how about the year's calendar on the first page for a given school, above "the fold", with a link to subscribe your preferred calendaring software to it, right there, office contact info off to the side, also above "the fold"? And no horrible excessively-complex half-broken themes making it difficult to navigate? Nah, that'd be too helpful; and everything's in several different systems, all bad, and all in various states of up-to-date or neglected, so it can be hard to guess where you need to look for something and hard to know whether it's accurate when you do find it (especially if the apparent signal is "empty" or "nothing there" or "no information"—is that true, or has it just not been updated lately?)

TobyTheDog123 4y ago

How long until Apple removes this app for the same reasons as The OG App? https://news.ycombinator.com/item?id=33015769 https://news.ycombinator.com/item?id=33015769 5.2.2 Third-Party Sites/Services: If your app uses, accesses, monetizes access to, or displays content from a third-party service, ensure that you are specifically permitted to do so under the service’s terms of use. Authorization must be provided upon request.

tsol 4y ago
Hmm honestly it looks like they'd be in the right to take it down too. I support the app and I think it's cool what they're(the app makers) doing, but it's not surprise that app stores might not be cool with the DIY nature of how they get the data.
- mylons 4y ago
  if it's not illegal to acquire the data, then this is the app store likely getting a call from AA and shutting you down. meanwhile, if you're this Jeff guy, you can submit a request to apple or google and get an email response days/weeks later. what's cool about that?
  - tsol 4y ago
    Sorry when I said 'I think it's cool what they're doing' I was referring to the app makers. The wording was a little ambiguous-- fixed.
mylons 4y ago
sadly waiting on the EU to dismantle app store monopolies via regulation.

golemotron 4y ago

I came here to articulate the counter position to this because people are solidly on the side of the app developer. If you run a business and your employees access your information to do their work through an un-contracted intermediary, it's a real security risk. The information can be filtered or maliciously corrupted, and the company can be easily blackmailed. I don't think the law offers any direct remedy. The best thing for AA to do is force the app developer into court and make them pay legal fees if they don't want to contract with them, compete by making something better for their employees, or contract with someone else to provide the service. It's costly on all sides but table stakes for running a business in a competitive market these days.

stalfosknight 4y ago
Or AA could improve their systems so that this app wouldn't be necessary. Or buy out the app. Or contract with the developer.

nnm 4y ago

One side story. There is no comments / voice on the AA side. Read like a biased article. "become a must-have" reads like exaggeration

MattGaiser 4y ago
> American Airlines has been contacted for comment. They have been asked for one.
blamazon 4y ago
There are no comments/voice on the AA side because they are likely 'accidentally' dodging labor laws (by laying obligation of checking legality on the attendants) through obfuscation of this data. That seems a large part of why it's become a 'must-have.' That kind of behavior merits this relatively 'soft' one-sided take in my opinion.
not2b 4y ago
By that reasoning, if the company refuses to comment an article should not be published, or if published must be rejected as one sided? That's convenient.
- gpvos 4y ago
  You can always still publish when they don't react within a reasonable time, and add a comment to that effect, as you can often see in newspaper articles.
  - not2b 4y ago
    From the article: "American Airlines has been contacted for comment." Evidently they did not respond.
    - gpvos 4y ago
      Ah, I overlooked that. But I would have searched for it before posting a comment like nnm's above.

geekrax 4y ago

The reddit thread that this article is failing to credit to: https://www.reddit.com/r/flightattendants/comments/y38tqp/if_youre_with_aa_you_might_use_sequence_decoder/ https://www.reddit.com/r/flightattendants/comments/y38tqp/if...

driscoll42 4y ago

On the developer's Patreon (https://www.patreon.com/tschaff https://www.patreon.com/tschaff) there's a few more details. He's a former AA flight attendant, seems like there was a somewhat similar project underway internally in the airline union which he was on but got kicked off of and built this separately.

entropyie 4y ago

Yet another reason to build a website instead of an "App". It seems to me that all this could be delivered via website or PWA... Then no one could block it. Careful client side caching would help for times of no connectivity.

k8sToGo 4y ago
And how would that solve anything? It’s the backend that is getting blocked.
kyle-rb 4y ago
I'm a big advocate for PWAs, but this is a backend data issue. American Airlines isn't forcing app stores to take down the app, they're adding anti-scraping measures to prevent the app's backend from being able to request data for flights, shifts, etc.

0xbadcafebee 4y ago

"One flight attendant said of the current situation affecting Sequence Decoder that they had “never seen a company go out of their way to make life harder for their workers.”" Every large company I've worked for had an IT department (or similar) that intentionally made developers'/sysadmins' lives harder. They don't care. So the good people leave, morale drops, productivity drops, management starts implementing crap policies to force more work to get done.

dreamcompiler 4y ago
Same here. IT people would prefer to shut down the company rather than help it achieve its mission because they are heavily incentivized to prevent security incidents and not incentivized at all to help with the mission. Couple that with a CIO who wants to build an empire and second- or third-rate MCSE "Certified" personnel and IT inevitably becomes a huge impedance against the corporate mission.
GlenTheMachine 4y ago
Our IT security people give every impression that their preferred solution would be to drop all the computers in the river and lock the doors. I naively went to them once with a suspected security intrusion event; they threatened to have me arrested. I couldn't convince them that I wasn't the one responsible.
- RockRobotRock 4y ago
  At a previous company I worked, my team (system’s infrastructure) would purposefully avoid the cyber security team, and even attempt to sweep security issues under the rug, because they were so awful to work with.
  - rootsudo 4y ago
    Can't say any intrusion happen if you don't accept reports or investigate anything. :D
ajmurmann 4y ago

prvit 4y ago

If we’re talking about apps in the airline industry, take a look at Stafftraveler (https://stafftraveler.com/ https://stafftraveler.com/) Everyone in the industry uses this app. What is it for? Leaking passenger load data from internal systems to employees of other airlines. Presumably all the data gets sold by the platform operators to some hedge funds for big bucks.

oxymoron 4y ago

I am not convinced that AA is actively trying to block this app. I used to work for a major anti-bot vendor, so from that I know that all airlines suffer heavily from price scraping and try to protect their flight search endpoints. The impact to them is due to fees from the centralized data services that all airlines depend on.

Syzygies 4y ago
"Never attribute to malice what can be explained by incompetence." I fly American between JFK and SFO regularly, including today. They have the best prices these days for an "international" business class on this route. The food is good, the flight attendants are friendly and good at their jobs... Automobile manufacturers offer pathetic "center console" software compared to Apple, Google. American's in-flight entertainment system makes auto makers look like geniuses. They just don't understand software.
- waynecochran 4y ago
  American Airlines has by far the worst web page for any airline. Frequent broken pages. Good luck if you have a question.
- crznp 4y ago
  Corollary: if you think that everyone is incompetent, perhaps you're missing something. For instance, you fly with AAL because of price, food, service. What sort of entertainment system would change your mind? It is hard to create something that works for everyone, is integrated with a plane that doesn't have a lot of downtime, etc. I'd rather just use my own device, so the best entertainment system in the world is unlikely to change who I fly with. So why invest in that? Or on the original topic: the problem is not that they can't develop a similar app -- if nothing else, they could license this one or just turn a blind eye. It seems like they don't want it to exist.
  - Arainach 4y ago
    It's really not. From what I've seen of crashes and boot up screens, most airlines seem to use some rebranded Android experience. I'm fairly confident that's what American used the most recent time I flew them based on some navigation buttons that appeared on the bottom at one point. There's a lot of Android devs out there in the world, but AA does seem to hire or subcontract to some particularly bad ones.

jay-anderson 4y ago

We have bots scraping some of our pages at work. We've attempted to reach out but haven't received a response. We don't mind the bots so much themselves, but we want them to be well behaved. Currently they are making calls over and over again that return a 4xx response and are a significant portion of our traffic. We want to request that they stop making bad requests and slow down (we do have throttling in place, but this just gave them more errors to ignore and retry.). I'd love for an open third-party like this one. It'd even help with prioritizing features that we're missing in our first-party products.

runjake 4y ago
Isn't this where you put a stop to existing requests and implement free API keys?
a1369209993 4y ago
> but this just gave them more errors to ignore and retry. So null-route the offending IPs on a [0]24-hour timeout? The problem you're describing isn't "scraping", it's "low-grade denial-of-service attack (that you suspect might be a result of attempted scraping)", and should be addressed accordingly. (The parenthesised part doesn't really matter.) 0: exponentially increasing up to -, for automated versions, but you're presumably already familiar with the current batch of offending source addresses.
- a1369209993 4y ago
  [Too late to edit:] Also, double check that your first-stage throttling actually increases the latency of the requests, such that a user-agent that doesn't issue multiple requests concurrently (but starts a new request immediately on recieving a response) will automatically self-rate-limit. This should be standard for any 'serious' HTTP server, but I've seen a few that incorrectly go straight from "serve 200 OK instantly" to "serve 429 Too Many Requests, also instantly" rather than "serve 200 OK after ~1 second", and sending 429 only when there are actually too many requests (in particular, more than one at any given time).

bananamerica 4y ago

Can someone provide an explanation on what value this app brings do the flight attendants and what would mean for them to not have it anymore?

mfext 4y ago

I worked briefly years back on a web app at AA that provided the scheduling features for flight staff that this app provides. I didn’t see what happened to it in the end, but reading the app’s feature list, it sounds like that app plus social elements and weather. From scraping, which is scary IMHO.

jdelman 4y ago

Reminds me a bit of the dispute between McDonald's/Taylor and Kytch. An independent company Y stepping in to fix a particularly broken aspect of another company X's workflow (or literally a piece of hardware), company X responds badly, company X doesn't have the internal resources to do better, or company X is purposely not fixing things for some dumb and/or profit-motivated reason. A possible solution: build your scraper as a Chrome extension and have legitimately logged-in users periodically hit that SCRAPE button.

RockRobotRock 4y ago
This wouldn’t work in the context of a mobile app though.

dddrh 4y ago

Is there a linked source or way to validate the claims? I'm curious to learn more but the author didn't link or reference any. The comments seem to verify it but I don't find them trustworthy either.

tomohawk 4y ago

Typical adversarial relationship that develops between companies and unionized employees. It becomes more about winning the power struggle than getting work done or having a good life. And also more about the rules in the current contract than anything else. If the current contract doesn't have any rules about it, then employees are just stuck with it until the next contract negotiation between the union and the company. Thems the breaks.