When 339 million guest records are involved, anything less shouldn't cut it anymore.

Move fast and break things all you want if you have such an amazing safety net. But at that point you’re not breaking anything, you’re just letting the real world fill in the gaps in your test suite with an insignificant impact.

Still, not good enough if you’re dealing with money, medical stuff, vehicles, etc. You’re getting into life or death territory there.

The monetary value of a particular person of interest's guest record may be more than that, but those people are few and far between.

If you disagree, please let me know who I can get in touch with, who will pay me $4/guest record. I'll quit my day job, and set up camp outside a hotel lobby, recording guests and license plates.

A few people have done some very interesting things. For them, those numbers are substantially higher than zero.

You haven't disproven my point. The quantifiable, median damage is zero. This is relevant, because this sub-thread tries to quantify the harm by taking the fine, divides it by the number of records, produces $3, and posits that the leak has done more than that amount of harm. Because, obviously, if any harm comes, the harm is over three dollars.

Well, yes. It is. If you can measure the harm, of course it's more than three dollars.

For most people, though, the harm is immeasurable. Pointing out that the median harm is zero exposes the absurdity of the original argument.

There's also a problem we haven't brought up in this thread, which is that the main damage from privacy invasion is not to people individually, but to human society as a whole. Increasing the price of doing anything particularly interesting can condemn an entire society to domination by mediocrity.

I'm saying we have no idea, and we're not going to get there, by doing arithmetic. But, if you ask me, I do believe (based on nothing more then a worthless napkin calculation) that it's more likely to be between $0.3 and $3, than it is to be between $3 and $30. Remember, the recipient of this data is incredibly unlikely to cause maximum possible worst-case damage to even the interesting people on the list. Most likely, they just want to steal credit card numbers.

> There's also a problem we haven't brought up in this thread, which is that the main damage from privacy invasion is not to people individually, but to human society as a whole. Increasing the price of doing anything particularly interesting can condemn an entire society to domination by mediocrity.

The nice thing about the GDPR is that even if it doesn't address the damage of a particular leak, it's a swift kick in the ass of the IT departments other companies, who are really keen to not end up on the receiving end of the next fine.

That motivational quote should never have made it out into corporate communication. It was embraced by everyone[1] because it seemed edgy and hey that company is successful in spite of itself.

That should never have been embraced by anyone especially outside specific contexts.

[1]Just about everyone embraced it because it was a kind of punk attitude in the face of stodgy enterprise development schedules. Everyone wanted to seem cool, so they went whole hog.

>that company is successful in spite of itself

That's a pretty strong opinion. Some would argue that FB is successful because of stuff like that.

A bit of a sidenote, but after all, I remember how badly Zuck was clowned everywhere (including by FB shareholders and people here on HN) immediately after the purchase of Instagram and WhatsApp. People were saying that FB is dying and Zuck is trying to buy companies that are hyped but irrelevant to the core business out of desperation. These days, it is a pretty universal sentiment that those acquisitions were some of the smartest purchase decisions he could have made at the time.

Most of HN didn't have some insider information which Facebook did. This information was acquired by surreptitious data logging of a VPN "security" app [0]. This is the same app which was controversially packaged as a "research" app and then forced to take down from the App store [1].

[0] https://www.wsj.com/articles/facebooks-onavo-gives-social-me...

[1] https://www.theverge.com/2018/8/22/17771298/facebook-onavo-p...

But even in the US, medical equipment breaks down. Just not at near as high a rate.

I made medical imaging software for diagnosis and analysis. We would get a regulatory proctology exam every release. These guys would find arithmetic errors in papers referenced to support algorithms used in the software, and ask us about them. (Incidentally, that's where I learned never to trust "peer reviewed" papers or dissertations in computer science. Always check it, in detail, yourself. CS guys have to be some of the worst mathematicians I've seen during my time in scientific research.)

But yeah, the FDA were that anal in our case. If they were not that anal for you, I'm not sure why that is? Maybe the radiation? We were putting out software that potentially dealt with, essentially, irradiating humans. Software that controlled radioactive devices. Etc. No one wants the equivalent of a dirty bomb going off in some small town somewhere. So I don't blame the FDA for the whole "every i dotted, every t crossed" treatment. It was actually reassuring. At least in our case.

I think it's 10,000% more likely to be due to so much post-2008 ZIRP money floating around, so why give a shit about quality or consequences? As long as advertising and copyright industries are able to establish themselves as the fundamental arbiters of all content, anything else that happens to us or the companies are broken eggs for the proverbial omelet.

The people embracing MFaBT exhibit nothing resembling "punk attitude."

Good.

Yes, the cutting edge can cut both ways. But alas is kinda needed in IT security. So easy for a security update to come out, yet the process in some companies rightly dictates that it is tested so that the update does not break anything else. So you get a delay. So even then, that small window could see that security issue exploited and the powers that be will see you didn't apply the update instantly and you're lambasted - even for following best practices and going by the book of testing. After all, any update could have an impact upon the applications and infrastructure in ways above and beyond the issue the update is addressing. We have all encountered such issues as well.

So the phrase "move fast and break things" has a younger brother now "move slow and be broken".

Be nice if the powers that be (Governments) proactively audited companies IT security proactively instead of being event driven - after the horse has always bolted. I would love to see companies fined for security issues before such security issues are exploited and abused. After all, the customer always pays. Until that happens, the same mentalities in how security is treated as a priority will carry on playing out. But the other old IT saying of "if it works, don't touch it" whilst true, equally is the source of so many security issues that it just can not carry on being leaned upon.

This motivation is asinine. Record leaks don't do anything to harm the original records and it's not like Marriott's secret sauce is a list of customer records. Companies don't protect assets from things that don't cause the assets harm.

Personal data does not have value to the company in that regard. It's a liability more than an asset.

Hopefully that will stop them hoarding personal data.

GDRP is working as intended :)

Move fast and break things used to be the way that bridges were designed (i.e., build it, test it, see if it breaks, improve it if it does). I don't think anyone would tolerate that as a way to conduct other fields of engineering anymore.

That's the point. "A major shift in mentality for a large portion of the industry" is basically GDPR's success criteria.

> It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016

Starwood was well beyond the "move fast and break things" phase of companies. Many companies aren't, and if you're trying to say all startups have to comply with GDPR on day 1, you are wrong.

> U.S. based businesses may actually be exempt based upon some interpretation of Article 3.2(a):

This is a very different situation from your original statements based on size and maturity of a company - but I'll concede that the EU reach clearly only applies to EU interests .

https://www.internetlegalattorney.com/are-there-gdpr-exempti...

It's not a blanket immunity, but it's not universal as you say.

Yes, it's probably a drafting defect, but I think one would be very brave indeed to try to rely on it, especially given that establishing an art 30 record is, practically speaking, a prerequisite for being in a position to comply with the rest of GDPR.

Unfortunately, this is a good demonstration of two criticisms made of the GDPR right from the start: the costs of creating new paperwork in the approved format even if it makes no material difference to any actual data processing, and ambiguity about what is required or permitted even in quite fundamental respects.