Hacker News Reader

Comment by chollida1 | Hacker News Reader

Look, I get just being blindly outraged at a hack and the hate that Ticketmaster seems to generate, but the company wrote this for the regulators and shareholders as much as anything.

They have a legal duty to report hacks and report if it will have any affect on their business. And this is what they are doing here. Being outraged because a company does what they are legally obliged to do just makes you angry for no reason.

They'll address the hack to customers no doubt, in a separate email/communication.

At no point did they say the 600M people "can kindly go and fuck themselves" and contorting things to try and get there will just make you angry. If you want to blindly feel anger, you're welcome to, but the company did what they should here.

View on HN

I see both sides of this, but I think I would side with the original comment. It's not just blind outrage or something like that. The point is that there ought to be impact on Ticketmaster business. The messed up and there should be a cost to the company. They should be paying big fines or compensating their users. It should be entirely possible for a company to go bankrupt in such a situation which would incentivise better internal practices.

So this is an interesting case because by all accounts it was Snowflake that got compromised, not Ticketmaster themselves. So this isn’t them messing up but their vendor. I get the argument that you are responsible for your vendors, but at the same time the whole point of buying a SaaS product is precisely to hire domain experts to run a piece of infrastructure that you have less experience with. Security is very hard even for major companies with a stronger culture of it who spend much more resources on it like Apple and Google. It’s not clear that if Ticketmaster would have done a better job.

I think the view I’m most sympathetic too is that customer information should be viewed and reported on as a toxic asset/liability to discourage gathering of personal information in the first place.

>At no point did they say the 600M people "can kindly go and fuck themselves"

With nary a word this was fully implied way before they even started collecting customer data.

Companies can have this attitude regardlless of whether there is any data at all.

They basically said:

- no expected damage for the leak

   - no cost for any remediation 

   - no cost for any legal issue

 - no expected cost to ensure it does not happen again

If you believe that they should be impacted then it's kind of a Fuck you.

They are not the ones making the law but it certainly looks like they will plainly use the fact that they can continue business as usual with almost no impact.

>> At no point did they say the 600M people "can kindly go and fuck themselves"

That is exactly what they said. Verbatim. That's how my brain received it, anyway.

Then you should see a doctor because you're either hallucinating or don't know what verbatim means. This is a specific communication for a specific audience and there are legal requirements around what is reported.

The problem is that there is no material impact due to these issues. The shareholders should absolutely be impacted and the company on the hook for damages

The more damning part is this though 'Ticketmaster refused to confirm it to reporters or customers and instead notified shareholders late on Friday.'

They cared more about there shareholders than users.

> At no point did they say the 600M people "can kindly go and fuck themselves"

It's TicketMaster, that's their business model. No need to say it again in this message to the SEC.

Reply on news.ycombinator.com