Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We tried to book a train ticket and ended up with a 245k records data breach

zerforschung.org

Post reply on HN
Print view View original

71–80 of 83 posts

Re: We tried to book a train ticket and ended up with a 245k records data breach

#71

Post by mysterydip »

overboard2 wrote: post #54
mysterydip wrote: post #24

Earlier quoted context omitted.

Worse, there's laws in place (in the name of "cost savings") that need changed before any policy improvement could be made. A group can't just decide "it would be better if we didn't use the lowest bidder." There's legal repercussions and losers can sue (leading to more expense than if they just went with them in the first place). It's truly terrible.

It's supposed to limit corruption by making it harder to give contracts as political favors

I know there's good intentions, but the system has been gamed/exploited for a long time with no real way to defend thanks to the legal implications.

Re: We tried to book a train ticket and ended up with a 245k records data breach

#72

Post by sfn42 »

franga2000 wrote: post #29
afavour wrote: post #22

Earlier quoted context omitted.

It’s not WW2 mobilisation but I’ve always thought the UK’s Government Digital Service is a wonderful example of what government can achieve in tech: https://www.gov.uk/government/organisations/government-digit... As I understand it they’re effectively a central dev shop for other government agencies. It’s worth their time investing in good practises because they’re going to use them over and over again. And from the…

This is something we desperately need more of in other countries. We've found something like a dozen breaches of similar severity in the last 6 years and they all came from systems developed through public tenders by companies that either aggressively under-priced or used other (legal or illegal) dirty tactics to win them. The very few things that were developed in-house have proven to be far more reliable and secure…

As a software "consultant" (meaning i do what everyone else does but get paid more) the consultancy business is fucking bullshit. Just padding resumes and counting billable hours, nobody gives a fuck about quality or maintainability or anything. Just money.

Re: We tried to book a train ticket and ended up with a 245k records data breach

#73

Post by germanier »

Joeri wrote: post #62
2rsf wrote: post #18

> This project was implemented by the same agencies - MCI together with Caracal. I suspect that this is the root cause of this and for many other systems failing. When a project is created by the lowest bidder, as a one time effort with fluffy requirements why would they invest in proper architecture, planning or testing? Why would they invest in securing resources when they are paid anyway?

As this is a government contract, and there are strict public transparency rules on government contracts, I went digging. Here's the call for tenders: https://etendering.ted.europa.eu/cft/cft-display.html?cftId=... And here's the award: https://ted.europa.eu/udl?uri=TED:NOTICE:120998-2022:TEXT:EN... Some interesting things: 1. This is a broad framework contract for marketing, for the eye-watering amount of 300 millio…

The linked tender is mostly not about marketing. They tendered basically a pretty large travel agency. Eurail is surely not just a intermediary here. They are in the business of selling train passes and operate lots of the services tendered for decades (e.g. an online train booking platform)

Re: We tried to book a train ticket and ended up with a 245k records data breach

#74

Post by JohnFen »

comboy wrote: post #66
otherme123 wrote: post #65

Earlier quoted context omitted.

This can't happen more often than not, because the client has no idea what a pentest is. They don't even know what a is XSS means, or even API. These things are negotiated by people that only can see the frontend, and if it looks great, _snappy_, _flashy_, with random animations and following current trends it's OK. The contractors know and can easily detect this, so they focus on frontend and don't waste their time…

Investors have no idea what thickness the wall should be in their building either. Clients not being experts at the job they are getting somebody else to do is not a new pattern. So while some trust is required, it's best if you can get somebody else to verify. I've seen a few smart clients over the years which when faced with some excuses from a software house hired another one to give them opinion about the codebas…

> Clients not being experts at the job they are getting somebody else to do is not a new pattern

In fact, a whole lot of the time, the entire reason someone hires a professional is precisely because they themselves aren't experts.

Re: We tried to book a train ticket and ended up with a 245k records data breach

#75

Post by robocat »

davemp wrote: post #40
boringg wrote: post #36

Earlier quoted context omitted.

Its actually probably more of a situation that a client cant discern quality. Its impossible to tell if the most expensive or least expensive if the best option. How does a non technical/semi technical actually grade this stuff appropriately?

This is a problem traditionally solved by the professional engineering licensing system. Most engineering curriculum in the USA involve an Engineering Ethics course that goes over such issues. We're quite far from implementing such a system for software "engineers".

> solved by the professional engineering licensing system

Good narrative: but certification and guilds do not solve the problem.

Re: We tried to book a train ticket and ended up with a 245k records data breach

#76

Post by robocat »

ctippett wrote: post #37
veltas wrote: post #31

Earlier quoted context omitted.

It's a shame that (from my perspective anyway) a lot of that state capacity seems to have degassed for the NHS. Right now it's impossible to get a doctor's appointment where I live. If you call any local surgery within a split second of 8:00am then you have a very low chance of getting an appointment, every time I've tried the line's busy or I'm number 60 in the queue and after a 40 minute wait all the appointments a…

This mirrors my exact experience with the NHS – the futile 8am phone calls, to relying on NHS 111 for any hope at getting medical attention. Coming from Australia and previously NZ, the healthcare system here seems barbaric.

New Zealand isn’t much better - last time I tried to book a doctor, they said they had n appointment free at the end of the month.

Meanwhile, if you actually need to go to the doctor for anything urgent, it is often best to go direct to A&E.

Re: We tried to book a train ticket and ended up with a 245k records data breach

#77

Post by davemp »

robocat wrote: post #75
davemp wrote: post #40

Earlier quoted context omitted.

This is a problem traditionally solved by the professional engineering licensing system. Most engineering curriculum in the USA involve an Engineering Ethics course that goes over such issues. We're quite far from implementing such a system for software "engineers".

> solved by the professional engineering licensing system Good narrative: but certification and guilds do not solve the problem.

No, but actual liability does.

Re: We tried to book a train ticket and ended up with a 245k records data breach

#78

Post by theironhammer »

js2 wrote: post #53
pedybr2 wrote: post #28

Made me think about this podcast I listened to the other day: https://www.nytimes.com/2023/06/06/opinion/ezra-klein-podcas... In it Jennifer Pahlka, a high ranking US government official who worked on heathcare.gov and other digital government projects, talks about her book that is about why most of these projects go as poorly as they do. Quite illuminating...

Came here to mention that episode. Agree that it was very insightful. Transcript: https://pastebin.com/Lg7zfHd9

Thank you!

Re: We tried to book a train ticket and ended up with a 245k records data breach

#79

Post by robocat »

davemp wrote: post #77
robocat wrote: post #75

Earlier quoted context omitted.

> solved by the professional engineering licensing system Good narrative: but certification and guilds do not solve the problem.

No, but actual liability does.

If that were true, then there would be zero disasters in high liability countries. liability doesn’t prevent disasters from happening.

For example: UK Grenfall towers. https://www.bbc.com/news/uk-61724373

It is a wrong to assume that only engineers can cause deadly mistakes. Also we have penal liabilities that don’t need licensing:

   The [UK] Health and Safety at Work Act 1974 is designed to stop employers putting the public at risk, not just employees in the workplace. Individuals can be prosecuted and a serious breach could attract a two-year prison sentence.
And sometimes some pretty big exceptions:

  the [UK] government can't be prosecuted for corporate manslaughter
Locally to me in Christchurch, New Zealand, there have been no prosecution for the CTV tower collapse: https://www.nzherald.co.nz/nz/fatal-ctv-building-collapse-po... https://www.nzherald.co.nz/business/govt-considering-introdu... The second link is interesting because it looks at changing the law to add liability (not engineers licensing changes )

In both cases, there are multiple layers of failure, and many causes could be asssigned. Especially the CTV building with inspections before collapse and warnings from people working there ignored.

Re: We tried to book a train ticket and ended up with a 245k records data breach

#80

Post by davemp »

robocat wrote: post #79
davemp wrote: post #77

Earlier quoted context omitted.

No, but actual liability does.

If that were true, then there would be zero disasters in high liability countries. liability doesn’t prevent disasters from happening. For example: UK Grenfall towers. https://www.bbc.com/news/uk-61724373 It is a wrong to assume that only engineers can cause deadly mistakes. Also we have penal liabilities that don’t need licensing: The [UK] Health and Safety at Work Act 1974 is designed to stop employers putting the…

If you're looking for a perfect solution to pretty much any problem involving humans, I have bad news for you.
Post reply on HN