Hacker News Reader

Comment by skim_milk | Hacker News Reader

I work in the travel industry as a programmer (god only knows for how much longer) - I can tell you that Sabre and other GDS's are only used if you go through a travel agent or use some online reservation systems. If you book through the airline's systems or on online reservation systems they likely use the airline's systems to track travel instead of GDS since the GDS wants to take a big cut of every ticket sale. And obviously only legacy travel companies like Hertz and Mariott integrate with GDS's, new travel companies Uber and Airbnb likely don't have any relationship with Sabre.

You're only likely to be in a Sabre system if you've been booked by your company through a travel agent and rent using legacy car/hotel companies also through your company's travel agent.

View on HN

I used to work for Sabre, they do a lot more than just bookings, they provide all the software to run an airline basically. I worked in the area for scheduling air crew. But also crossed over into all the flight tracking. Their systems hold a lot of data, though the airlines own and host that data in secure facilities.

Fun Facts, when I worked there, you could fly for free on American Airlines ( the company got split out from AA ). They claimed to employ the most PhDs at one time ( lots of operations research). Also claimed to invent database transactions for the problem of people trying to book the same seat on airplanes at the same time (early 60s I believe)

The industry is moving to a being able to purchase products instead of complete PSS/GDS solutions. As an airline you'll be able to buy an inventory management system from Amadeus, a pricing system from Sabre, a support system from TravelSky, and a website from Travelport.

The best example I can think of is American. They have Amadeus running their international website. Their ticketing system is internal. And all their inventory is managed in Sabre.

Southwest was similar, for a while Amadeus ran their international site while Southwest ran an outdated internal system for domestic travel that didnt support flights leaving and arriving on different days. They eventually had Amadeus move into running their domestic stuff a few years ago and now they have red-eyes.

Delta runs all their own stuff on a mainframe and from the outside it looked like a slow moving disaster. I know Amadeus sees all their inventory and looks at each passenger.

> They eventually had Amadeus move into running their domestic stuff a few years ago and now they have red-eyes.

Heh. I remember thinking years back that it was odd that Southwest never had any overnight flights, especially transcontinental. Just assumed it was the way they did business and some sort of cost cutting measure. Didn't think it'd be due to a software limitation!

Same thing for free bags, it’s because their system couldn’t handle chargeable bags

really!? They've done a helluva' job making this into a great marketing campaign, but this seems too far fetched to be true.

Can anyone else comment/confirm?

Not true. They upsell things like "early bird", since 2009 for example. And they charged for bicycle boxes as long ago as the early 90's. Charging for bags would use the same setup.

They do have some notable historical challenges though. Like foreign currency. They still cannot do that, despite flying to Costa Rica, Mexico, etc.

Bags aren’t managed in the same way as other ancillaries, because the prices are not linear. Indeed they allowed some special bags , but agents would have to manually check the aircraft was not over subscribed and organise handovers...

Regarding foreign currency, it’s a strategy choice on their behalf, they don’t want to own sales offices outside the USA

Trust me, I know a lot about this particular topic :)

They already "handle bags" in the sense that they are tracked to the PNR, issue tags, etc. They just don't charge for them. My examples show that they can charge for ancillaries. In fact, they charge for a 3rd bag or overweight today. It's not a technical limitation.

> due to a software limitation

This _is_ a cost cutting measure. They decided not to pay for their software to support red eyes.

In case someone is as confused as me wth the discussion is about (never heard that jargon):

> In commercial aviation, a red-eye flight is a flight scheduled to depart at night and arrive the next morning.

https://en.m.wikipedia.org/wiki/Red-eye_flight

Well, it was due to cost cutting! The point of using an in-house solution was that it was cheaper than buying a reservation system.

Also a travel industry programmer. Same feelings about for how much longer, heh.

> If you book through the airline's systems or on online reservation systems they likely use the airline's systems to track travel instead of GDS since the GDS wants to take a big cut of every ticket sale.

But in my experience, the airline backend and pricing is usually outsourced to Sabre or Amadeus. Frontier and Southwest are the only big players I know of that handle that sort of thing themselves, and Frontier has a teeny-tiny routelist compared to the others.

Southwest is Amadeus too now :)

"But in my experience, the airline backend and pricing is usually outsourced to Sabre or Amadeus"

True, but that doesn't make the reservations visible in the GDS. If Sabre or Amadeus is running your "CRS (Central Res System)", they aren't allowed to do anything with the data that you haven't asked them to.

You think US intelligence doesn't have access to other major airlines' back end databases, or things like major hotels' reward programs, airbnb, uber, lyft?

As someone who has worked on security for said systems, and who is somewhat familiar with the types of requests that are serviced to LEAs and TLAs, I do think that they don’t have access to back end databases.

What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please? Or do you think they hack us?

If you work for a useful target yes they probably have hacked you. They've certainly hacked google in the past for example - see below. These agencies are lawless and motivated. I imagine knowing where targets stay/travel in advance could be very useful.

https://www.google.com/amp/s/amp.theguardian.com/technology/...

There has never been a documented case through leaks or otherwise that they do domestic hacking, including in all the links you are providing.

"Reports that NSA taps into Google and Yahoo data hubs infuriate tech giants"

Files obtained from Edward Snowden suggest NSA can collect information sent by fibre optic cable between Google and Yahoo data hubs 'at will'...

Citing documents obtained from former NSA contractor Edward Snowden and interviews with officials, the Washington Post claimed the agency could collect information "at will" from among hundreds of millions of user accounts.

The documents suggest that the NSA, in partnership with its British counterpart GCHQ, is copying large amounts of data as it flows across fiber-optic cables that carry information between the worldwide data centers of the Silicon Valley giants. The intelligence activities of the NSA outside the US are subject to fewer legal constraints than its domestic actions.

31 October 2013

https://www.theguardian.com/technology/2013/oct/30/google-re...

What is domestic and what is not? Is a company with assets abroad domestic or fair game abroad? You are aware these agencies share most data across borders aren't you?

Tempora is domestic hacking, Stellar Wind is domestic hacking (sweeping up data from all Americans), and these agencies share data extensively, so domestic vs foreign has very little meaning to them at least.

No, interception and wiretapping (especially with permission of the service provider) are not the same thing as hacking a company to maintain persistent access and surreptitiously using their assets to exfiltrate data. These are very different things and the distinction matters.

I’m familiar with what kinds of things they do, and I don’t agree that they should be doing a lot of what they do. It’s just that rooting american assets isn’t one of those.

Also, you have the wrong country for Tempora.

The agencies extensively share data and routinely break domestic laws. They even use sharing as a way of getting around domestic restrictions.

If only the Snowden docs included all the nasty domestic spying that the agencies do, I'm sure we would have substantial proof.

There are leaked government slides about how they were monitoring Wikipedia traffic (illegally).

Like, why go through the effort to hack domestic companies when you can just subpoena them?

A reasonable question. There are many answers. My first one would be for leverage. E.g. To solve a crime, they want information from someone who is not under formal investigation. That someone may not voluntarily cooperate, so they use information for leverage. E.g. threaten to leak information about a pending business deal to others in the transaction. It's not very effective for Joe Sixpack, but it is for organized crime of all kinds.

>They've certainly hacked google in the past for example - see below.

You've referenced proof they couldn't hack Google and instead they had to use alternative measures.

>Google is understood to be working on "forward encryption" for its private network so that communications even over its private leased lines would be unintelligible to anyone without the "keys" to decrypt it.

That's basically the reason it was even possible. Such surveillance is not a hack.

>These agencies are lawless

Citation needed

Here you go:

Stellar Wind, Tempora, Prism.

https://www.nytimes.com/video/opinion/100000001733041/the-pr...

This is a particularly interesting profile of Binney, who worked on stellar wind.

https://www.forbes.com/sites/emmawoollacott/2018/09/13/uk-ma...

https://www.bbc.co.uk/news/world-us-canada-23123964

Of course they claimed after being exposed that these programs are legal, but I think lawless is apt as these agencies don't consider the law as a boundary they need to respect.

O tempora, o mores

Excellent long form piece that covers several of these topics as well.

https://www.newyorker.com/magazine/2011/05/23/the-secret-sha...

Prism requires a warrant for US targets. Sounds far from lawless to me.

[https://en.wikipedia.org/wiki/James_Clapper#Testimony_to_Con...]

This doesn’t relate to the topic in question.

I was asked for an example of the organization being lawless, I gave a concrete example of the organization failing the most basic of accountability measures: Being asked under oath about their processes. The leader of the organization lied. I think that's a decent indictment of the organization.

https://en.wikipedia.org/wiki/Global_surveillance_disclosure...

There's precedent for all the things you described.

>What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please?

https://cdn.vox-cdn.com/uploads/chorus_asset/file/12801415/p...

>Or do you think they hack us?

https://i.stack.imgur.com/jWW5v.jpg

What are you trying to say with the second picture? Getting access to a GFE gets you access to what's going through it? What does that have to do with the FBI hacking into the backend of a airline company?

The FBI (and NSA for that matter) are a lot more constrained by the law than HN seems to think, they can't just shell anyone they want especially if the target is a third party that has done nothing wrong.

> What are you trying to say with the second picture? Getting access to a GFE gets you access to what's going through it?

https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program...

Pretty much that, and also tapping any traffic that's in their internal networks, since that's not encrypted either.

> What does that have to do with the FBI hacking into the backend of a airline company?

That's one possible attack that the FBI could be carrying out. ie. sabre doesn't encrypt its communications in their internal network, and that's being tapped similar to how the NSA tapped google's internal networks.

> they can't just shell anyone they want especially if the target is a third party that has done nothing wrong.

The reality is not that clear. A lot of what governs what these agencies can and can't do comes from executive branch policies. There is a lot of gray around what is "legal" and congress likes it that way because it keeps responsibility for allowing to much or not enough surveillance far away from them.

What's more, you cannot adjudicate what you don't know about and a lot of the secrecy in programs like this is just as much about keeping away civil libertarian attorneys as it is about confounding "the enemy". There's a reason the FISA court rules nearly 100% of the time with the state. Responding attorneys are rarely involved and when they are they are often hamstrung due to a lack of knowledge that prevents them from filing any kind of useful motion or raising serious opposition.

Your first link doesn't support your quote. The queries are sent to the data holder who send back the data, the agency does not have direct access

>the agency does not have direct access

Sure, NSA can't directly query against whatever database gmail uses to store your email, but they still have all your emails, photos, and login history. As far as your privacy is concerned, there isn't really any meaningful difference.

Do you mind explaining precisely what you mean by "NSA has all my emails"?

Suppose I sent an email yesterday from my Gmail to a friend's Gmail, are you saying the text of this email is stored on an NSA machine?

>Suppose I sent an email yesterday from my Gmail to a friend's Gmail, are you saying the text of this email is stored on an NSA machine?

Maybe not today, but during its heyday must certainly.

>Internal NSA presentation slides included in the various media disclosures show that the NSA could unilaterally access data and perform "extensive, in-depth surveillance on live communications and stored information" with examples including email, video and voice chat, videos, photos, voice-over-IP chats (such as Skype), file transfers, and social networking details.[2] Snowden summarized that "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want."

>[Glenn Greenwald] added that the NSA databank, with its years of collected communications, allows analysts to search that database and listen "to the calls or read the emails of everything that the NSA has stored, or look at the browsing histories or Google search terms that you've entered, and it also alerts them to any further activity that people connected to that email address or that IP address do in the future."[44] Greenwald was referring in the context of the foregoing quotes to the NSA program X-Keyscore.[45]

https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#E...

But let's suppose they don't have your emails stored in their datacenters. Instead, it's still stored on google's servers but they can access your emails via automated requests to google, via search terms or by providing your user handle. Is that a meaningful difference, in terms of privacy?

So essentially, no, they do not have "all my emails".

> "Instead, it's still stored on google's servers but they can access your emails via automated requests to google, via search terms or by providing your user handle"

You just said previously the exact opposite! That they can't query Google, but they have the data themselves.

> "Is that a meaningful difference, in terms of privacy?"

Yes, because it means Google are aware of what data they are being requested, and what they are sending in return.

The transparency reports for these companies show that the total number of requests is in the region of 10k/year - a lot in some senses, but nowhere near the level of surveillance many people seem to believe.

No, they in fact cannot query my emails via automated requests to Google. I actually do know how that process works, and there is a human involved, so please stop making things up.

We can discuss the problems with it, but only if we start from a point of truth.

Even with a human involved, the process can be subverted by the human basically approving all requests.

Oh make no mistake, I am very familiar with those slides.

PRISM is not a VPN with a SQL client, or anything close to it.

The second one does not refer to domestic hacking. They don’t do that.

> The second one does not refer to domestic hacking. They don’t do that.

What do you believe is happening in that second image?

One could argue semantics as to whether a fiber tap is "hacking" or not, or whether tapping a domestic company's network from an international transit link counts as "domestic hacking"... but there is ample evidence that US intelligence agencies do target domestic companies and their networks.

See also, the rest of the docs on MUSCULAR: https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program...

There's also ample evidence that various companies choose to cooperate with the intelligence community for a variety of reasons. AT&T has made a healthy living off .gov, but I'm not sure Western Union was ever compensated for giving CIA decades' worth of international telegrams, and it appears their recent cooperation with the Agency regarding international money transfers was spurred by patriotism.

Since the links are likely compromised, ubiquitous encryption is your friend.

I don't imagine they have raw sql access but you probably have an API that takes a name or social or other identifier and returns relevant results. This access may have been granted to an account that is not described as "FBI" it's probably another sub-contractor or analytics provider.

You are incorrect. None of the companies we are talking about would build this backdoor interface and grant access like that to a shell company or contractor. If they wouldn’t do it for the TLAs directly, why on earth would they do it for a third party?

> why on earth would they do it for a third party

- Legally: They get served a NSL with a gag order forcing them to add the backdoor without telling you, on penalty of prison time

- Extra-legally: They get blackmailed by a TLA do add access and cover it up, or else.

("They" is not necessarily the company's CEO/CTO, but a sufficiently senior DBA/network admin.)

I once had a rep at an airline email me PDF's containing full instructions on how to connect to their developer VPN, connect to their dev and prod databases, a Java code sample, and full credentials for all. It was meant for a new developer but got sent to me (contractor working outside the company).

I haven't ever tried connecting to it, but I'll tell you when I alerted their security team there was no urgency about it, and the password was so simple I bet you could guess it within 10 tries.

Is that data encrypted in transit? If so, what encryption was used? The ones "suggested" that NSA knows how to decrypt? Also, do you know what agreements have been made that are "above your pay grade"? Do you know what every piece of equipment in your data center does? What about what equipment is installed at the ISP level?

Don't be so quick to say "you" are not actively having data taken. "You" just might not be aware of it.

Don’t be so quick to assume you have any idea how these things actually work, and what is or isn’t possible. None of the examples that you are running through would facilitate this type of thing.

Subpoena? You wouldn't even be allowed to disclose that you had received a subpoena.

Some companies establish subpoena canaries for that specific reason.

Sabre would include a lot of companies that are outside the borders of a US subpoena.

In some ways that actually makes it a lot easier for the NSA doing its role as sigint agency against anything "foreign", which doesn't have any US legal protection related to the 4th amendment.

> Or do you think they hack us?

Would that surprise anyone? Governments are known to stockpile and exploit vulnerabilities in targeted computers in order to obtain access. The US government even came up with an euphemism for this malware: network investigative techniques.

Are you saying you think that if the government asked your company to turn over some information that my be useful they would deny the request?

I feel that I was pretty clear as to what I was and was not saying.

If you’d like to ask a different question, feel free, but I am not interested playing the “are you saying...” game.

The person you're replying to very specifically said they don't provide access to backend systems.

No entity is going to ignore subpoenas or warrants. They may challenge them for reasons that are applicable to the business.

What about airlines that only operate in said government's jurisdiction, but is not based there?

This is largely a moot point. All names of departures and international arrivals are sent to the Department of Homeland Security via the Secure Flight/APIS data pipeline. This returns to the airline authorization to board, select for additional screening (SSSS on boarding pass), or inhibit boarding (unless overridden by a TSA call center), as well as, for international flights, authorization for who can even overfly the country.

Intelligence agencies are also highly interested in things that don't involve the DHS or have a flight involving a destination in the USA. Such as obtaining PNRs for people who buy flights from Dubai to Mogadishu.

They have PNRs

https://arstechnica.com/tech-policy/2014/05/ask-ars-can-i-se...

Of course it's laughable to think you could get away with doing anything on a plane in a post-9/11 USA - they're obviously going to have data on every citizen's and foreigner's flights. Beyond that I wouldn't know.

All I can say is you're very likely not a point in Sabre's private data mining set.

Definitely depends on the airline. The big US carriers all have their own systems, but the vast majority of foreign carriers use a GDS on their backend. It's just not worth building in-house unless you're at very large scale.

Old non-US airlines definitely have their own systems. I know Scandinavian Airlines have their own, and it looks like Lufthansa and KLM-Air France do too.[0]

I would be surprised if say British Airways didn't.

[0] https://www.emirates247.com/business/corporate/buying-ticket...

Nope, they all use Amadeus, except for Scandinavian Airlines. Actually Lufthansa and Air France CREATED Amadeus to consolidate their GDS operations. They're now pissed because Amadeus takes a piece of the cake and plays weird pricing shenanigans, but they're still there.

Source: worked at Amadeus.

This creation is also visible through the split between France (R&D in South of France) and Germany (datacenters and operations)

These guys do use Amadeus on the backend to manage their ticket inventory. Specifically Amadeus Altea - though you are correct that they try very hard to avoid paying GDS distribution fees for selling tickets through the GDS third party sales channels (which is what that article is discussing).

not true. BA,LH,LX,OS,AF,KL,... all run on AMA AA runs on Sabre

Its actually the other way around, some airlines have their own system, but most use some sort of GDS.

i.e. even when you make a booking directly with one of the airlines above mentioned, the entire PNR is still created and used in a GDS.

Even when you use Farelogix (for LH NDC bookings for example) the entire PNR also gets created in AMA. When you want to make changes in the LH PNR that FLX does not support yet, you still have to make the changes in the AMA PNR.

When you mean travel agent, do you also include the likes of expedia, opodo, etc?

Both of them also have GDS integrations. I don't know exactly how much but I'd assume it's the bulk of their traffic.

As a general rule the large majority of anything you don't book directly with the airline/hotel (and for all I know, some of what you do) is very likely to be in a GDS somewhere.

Yes, they are called OTAs - Online Travel Agencies.

Or Orbitz?

They don't use a GDS on the front end, but doesn't all that data feed into a GDS somewhere on the backend? I don't know much about Sabre but I know Amadeus reaches pretty far across everything.

Travel agencies still like to use the frontend even though they're even less user friendly than VIM. This isn't the right time for it but once upon a time you could research what travel agencies use what GDS by the job requirements these agencies put out - usually you need like 5 years experience with Sabre/Apollo/whatever for any job here.

Once your travel details are in the GDS then the airline clerks, car rental sales person, hotel clerks, and your travel agent can check out or update your travel info for you just based on the PNR number on your airline ticket for convenience if you're just not into that weird smartphone thing. You can change a bunch of things during the trip like what car you drive and hotel amenities during your stay so after the trip ends we download your trip from Sabre and build reports for your boss or whatever.

> I can tell you that Sabre and other GDS's are only used if you go through a travel agent or use some online reservation systems.

It doesn't change the fact that a state will get the PNR from the airline.

Many tickets I've bough in Europe via the airline's website were using amadeus (spanish?).

Is there a way to know if you've gone through sabre?

If you’re an EU resident, I’m guessing you could force their hand using GDPR?

I'm going to say that's probably a hard no. If you're not cleared then certain documents will just not exist or would come back saying that some information has been redacted for national security reasons. You can see some examples of such requests here if you search hard enough https://www.muckrock.com

Looking at their website they have GDPR forms for employees and for clients, but they don't have anything for Joe Public, not sure if this is because they don't 'own' the data themselves?

So, corporate bigwhig types who don't understand technology?

Corporate bigwig types (whether technical or otherwise) are generally not booking their own travel - that's what executive assistants are for. I'm a technologically literate corporate peon, and still booked >$15k in travel last year through SABRE via our online corporate booking system, and about $10k in bookings executed manually by our travel team.

The online bookings still routed through an internal travel agent for final approval and execution of the booking, but I never actually interacted with anyone. The manual bookings were the only time I ever spoke with an agent, and it was almost always to handle an itinerary that was too complex for the UI of the online booking system to accommodate.

Having travel agents for companies is actually a good idea, having someone work to set up travel for workers saves a crapload of time and money for everyone and better done if its outsourced to someone that knows travel.

Lots of board and CXX whigs book their vacations through their agent on their company's dime as a part of their benefits package which is actually a great deal for them. I'm more of a thrill seeker so I wouldn't use one but the average person who just wants a stable planned-out vacation that they only get once a year it's a really good idea.

At my old SP500 firm, Corp travel agents were always - and I mean ALWAYS - worse than what I could get from the airline directly. Why? Internal accounting. Some part of HR got to count part of the "fee" as revenue, billed against my travel budget. Insane. Once that became common knowledge, my coworkers and I were 'strongky encouraged' by our department head to buy travel with our Corp cards. This led to a strongly worded memo from the head of HR at FY end demanding we stop the process. That led to meetings, committees, more dueling memos. Great use of everyone's time.

I am so glad I don't work there anymore.

Yup, that's pretty common with legacy contracts. Internal accounting bullshit ruins all sorts of things.

I worked at a place where "thou shalt" use some stupid travel agent to buy intercity train tickets. You had to call the company and pick up the paper ticket in some inconvenient place between the hours of 10-3, closed from 12-1. The ticket cost ~$5-10 more than buying it at the train station, split between the travel agent and procurement group, unless you purchased it a month in advance, and could be used for 6 months.

The "hack" was that business units with lots of travel would buy 100 at a time every couple of months, and you'd need to find a secretary with a stash to get a paper ticket. I would ply them with my wife's baking to ensure a steady supply. Not surprisingly, many tickets were wasted unused (in pursuit of saving the $5), or people took unnecessary trips to avoid wasting money on tickets (and wasting 3x more in per diems, etc).

The next innovation was to declare that the trip was an emergency, and then you could buy the ticket from the conductor, in cash. The penance for less hassle is that you had to write a sad tale about why attending a training class met some standard for "emergency" travel.

My company used to be like that, but was acquired last year and the company that acquired us has such a refreshing travel process:

- Booking fees are itemized and stated up front. $3 for bookings handled 100% via the online reservation system, $25 if you ever have to talk to an actual agent.

- The online reservation system shows publicly listed rates as well as negotiated rates, and you're free to choose what you want within policy. The negotiated rates were virtually never the cheapest, but they also tended to come with a lot more flexibility (i.e. no change fees, refundable up to time of departure, 24 hour cancellation of hotel reservations, etc).

Those two aspects, combined with the fact that the travel would ultimately be booked to your card on file anyway (generally a corp card for anyone traveling frequently), pretty much negates any incentive to go outside of the official travel system. Depending on the trip and your travel budget, you can either go with the riskier but cheaper options or go with the more flexible but also more expensive options. The default booking fee is tiny enough to be understandable, and the incremental $22 fee ends up well worth it in the situations you need to call the travel team's 1-800 number to get you out of a bind.

The old system didn't bother me much as I was used to it being The Way Companies Are. But after being spoiled here, I dread the day I end up in another travel-heavy job and have to go back to the more typical Big Corp travel process.

A lot of companies also have special deals with preferred airlines, which gets the company a refund if a certain volume of money is spent. So you would see worse pricing upfront, but the company would spend a lot less after the discount numbers were reached.

I've seen engineers with a three digit hourly rate spend multiple hours trying to achieve double digit savings.

Reply on news.ycombinator.com