This one's still fresh in my mind: "A Missouri newspaper told the state about a security risk. Now it faces prosecution"[1]

[1] https://www.npr.org/2021/10/14/1046124278/missouri-newspaper...

I noticed I could see a family member's blood test results when clicking their forwarded email when I was logged into _my_ account. Sent an email. No response, but IIRC they fixed it a few weeks later.

Just an anecdote to counterbalance the apathy the OP might instill in people. Do good, regardless of the system.

That says a lot more about the legal system than the airline

>Tells you a lot about the attitude of many cooperations about these vulnerabilities.

If you were a faceless sociopathic entity that had a zero cost easy button to make problems go away you'd press it too.

It’s easy to criticise large legacy orgs having bad security, but what should you actually do as a C suite leader to fix it in these orgs?

It’s easy to list the various code scanning and monitoring solutions, but what do you do if teams continue to fail to fix issues on time? And realistically there’s a shadow IT of shell scripts and macros you don’t have much visibility on.

You can’t fire everyone, so I think it’d be better to link compensation of engineers (especially leads/managers) to scan reports, incidents, and audits, even if these are imperfect. But even then you’ll have business complaints about taking away engineering capacity from feature delivery.

Jaguar-LandRover had a cyber attack which shut them down for months and nearly caused them to go bankrupt

https://en.wikipedia.org/wiki/Jaguar_Land_Rover_cyberattack

Of course they then blame "state sponsored" attackers.

https://www.techdigest.tv/2026/10/former-minister-confirms-j...

I agree for data loss and ransomware where the ransom is paid, ie economically driven attacks. I wouldn’t agree when the hack is designed to kill the business destructively and no economic gain is sought or intended.

The difference in attack methodology is trivial, from a threat actor perspective, imho.

I’ve been increasingly going with Delta regardless of price because of their tech being at least somewhat usable. I might even be inclined to switch to another carrier if they were to make entirely api-based (personal) access available for flight management and searching/booking (probably via MCP given the current climate, but I’ll take what I can get).

Sure a run-of-the-mill data leak might not do much besides ruffle customer's feathers. But disruptions to a companies' operations can become very costly, very quickly in today's tech-dependent world.

Eg. recent Albert Heijn (Dutch supermarket chain) "cyber incident" must have cost them 10s of millions of Euros.

That's real gain for any competitor NOT having such issue. See eg. Darwinian evolution on how even small (dis)advantages can lead to species being outcompeted & disappearing.

Safety alignment feels like an absolute farce and the completely wrong approach too. These things are guns, or attack dogs. We've never succeeded at reigning in software with this approach in the past, besides maybe DRM, which is itself laughable under many circumstances. This has the unprecedented ability to entertain the base desires of most juvenile threat actors, which is to get a big payout with minimal effort (let alone the pre-existing sophisticated attackers, who are now basically gods). Now we have a turn-key tool that can leverage and chain the most minute vulnerabilities up the ladder to full compromise or discover zero days with unyielding dedication. It feels like it almost makes CVE level classification moot.

There's been some modifications to that image for the AI era. I don't know where the original source is to properly credit the creator, but one example is here: https://www.linkedin.com/posts/darshan-j-baligeri_all-modern...

Engineers aren't a help if they have poor inuition and insight into security concerns themselves, which is true for almost all of them.

Filling departments with inexperienced people based on how well they can recall a classic algorithm on a whiteboard was never the set up for a secure software or IT ecosystem. Peers watching in shock and dismay as supply chain risk escalated year over year for the last decade, among other horrifying practices, have been crying over this all along.

They might be able to follow an AI lead better than someone even less technical, but it's unclear that doing without true expertise as an oversight and check would cut it.

Having walked ourselves into it long before AI appeared, We're set up for a dark time with few easy outs.

I did AppSec for a couple of years just for a change of pace. The friend who worked there said they wanted to strengthen their infosec program in general, which is why they wanted to hire an SWE for AppSec instead of using cyber boot camp grads like they had been. Turned out 90% of infosec is about creating all of the necessary paperwork to protect to company from liability if there's a breach. Actual security issues were ignored most of the time if there wasn't a compliance framework that addressed the vuln directly. We could have tripled the number of people in the department and it wouldn't have made any difference in terms of actual security. Maybe the compliance paperwork would have been submitted a bit sooner.

Hiring them is only the start.

Keeping them, and having them around, to be responsible for cleaning up their mess, is the trick.

Modern (US) tech companies are spectacularly bad at keeping talent.

Really, really bad.

The same engineers who built the vulnerable systems?

Came here to point that out. Several airlines, mostly from Asia, have sent notice of data breaches related to Amadeus software. Frontier appears to contract with Amadeus.

https://amadeus.com/en/newsroom/press-releases/frontier-airl...

What replaces Reddit? For the last years the only reliable way to get useful information on search was to add "Reddit" at the end.

you already have to log in if you want to use good(old) reddit.

Lot's of people don't like them. But, I flew Frontier a decent bit when I just wanted to go "get away" and had flexibility to do so. It was fine enough, because my expectations were appropriately set and I travel light.

But, their website has always given me tons of problems. My ability to successfully purchase a ticket often felt totally random.

TIL… thank you!!!

Those people are contract workers. Spirit had the same issue: Excellent plane operations (No crashes in their history, history of excellence in maintenance, pretty well paid and well benefited employees(supposedly),modern planes). With their low cost model, the money had to come from somewhere: contracted front staff that don't care/can't do anything and fees for everything including the water.

The stories about their lack of customer service empowerment following the man who was ingested by an engine while running across the runway validate this. It was truly maddening to read about how the company handled getting people’s luggage back to them.