Hacker News Reader

Comment by hackernewds | Hacker News Reader

Which company should be held accountable? Snowflake or Ticketmaster? It's not as straightforward as expected

Customers have no direct relation with Snowflake, so they should go after Ticketmaster. Ticketmaster can then decide to reclaim their losses from Snowflake or some kind insurance they may have, but that's not their customers' problem.

I’m trying to imagine the size and complexity of the indemnity clause in Ticketmaster’s contract with Snowflake, and the number of hours and redlines and delays, .. all the lawyers. All the delays for the analytics org, all the pain, all the suffering and now … it’s game time.

This is how you shut down people from starting a business unless they are super rich. Liability first thinking is gumming up the gears of society.

Yes, those pesky regulations. Now you have to have a several exit doors if you want to open a nightclub. It keep it for the rich people.

Unnecessarily cynical reading. If the nightclub was certified to have sufficient egress by the relevant qualified authorities, then that should be enough for the business owner to not have to worry about being liable for it.

Similarly, if a food truck uses a point of sale service, the food truck owner should not also have to be knowledgeable about evaluating the point of sale’s database security. Their job is to make food.

If the government wants to protect people’s data, then it should set the standards or certifications for the vendors (and/or go after the people who misuse the data), not lay that liability on the vendor’s customers.

Sure. But this still has to be decided by a court of law - did the defendant follow all the regulations? That is what most of these cases come down to anyway - did the defendant do a reasonable job of following established norms (and regulations) to prevent harm? Are we saying that the courts should not decide this and it should be left to the government to just certify and that should be sufficient to throw the plaintiff’s cases out in all scenarios?

That seems a bit of a stretch. There is a lot of room for debate around the details but if someone harms someone else then they should be liable. Otherwise there isn't effective legal feedback to stop people from harming each other. The principle is sound.

EDIT Sorry, misread the comment. I removed the part of my response related to my confusion.

The only thing you can lose is what you've invested in snowflake.

It's not like we're turning up to the house of the CEO to burn it down.

We make the laws and can choose how liability works.

If a company knowingly keeps data about users, they should be liable. You're right that this data liability might discourage companies from hoarding lots of data about users; mission accomplished, I want companies to be discouraged from keeping lots of data about me.

It would be fine if the business of Ticketmaster just didn’t exist.

People bought tickets to things in the 90’s. It isn’t very difficult. The only thing Ticketmaster does is make that more convenient by keeping track of everybody’s payment info. If they can’t do that safely, they don’t even satisfy their reason for being, they don’t need to exist.

i bought tickets to things in the 90s. from ticketmaster. and in the 80s. the first time i listened to a pearl jam album it came with a diatribe railing against ticketmaster.

for better or worse, the industry as we know it today could not exist without ticketmaster and companies like it.

It would exist just fine. Because the leeches have been there since you and I were buying from them in the 80s doesn't make them necessary. That's just lazy thinking.

oh yes, it’s definitely outside the realm of possibility that there could have been fundamental shifts in the economy and consumer expectations that make it impossible to roll back the clock to a time when eventgoers just showed up and hoped there was seating available. how silly of me.

> The only thing Ticketmaster does is make that more convenient by keeping track of everybody’s payment info.

And charge exorbitant service and "delivery" fees.

So it's OK for companies to collect users' data, but they don't need to take any responsibility for protecting it?

SEC now requires all companies must report their breaches on their filings. Maybe that should reflect also a way to hold companies accountable via some kind of fine based on a threshold of the damages done.

Private companies do not have an SEC reporting obligation.

In the US only 1% of all companies are public.

What % if by revenue?

Or by breaches, but then of course that will be hard to gather.

Is this number even known? How would all private revenues be calculated?

Reply on news.ycombinator.com