upvote
It should be noted that the NY library system (NYPL, QPL, BPL) are some of the most well funded libraries in the world, and they still have issues like this. Smaller libraries have no chance.
reply
I'm unconvinced this is true.

Most of what libraries do technologically is now outsourced to SAAS companies that specialize in the library space (there are at least 2 major one in the US, and I think at least 3 or 4). (encore and bibliocommons are the 2 major ones that I remembered and am pretty sure I've seen at least 2 others).

If everything you are doing is in the cloud, I'd argue that recovering from a ransomware attack is more of a question of if the SAAS company did its job right (which it should be more capable of handling). Of course, that's a reasonable question if they did (similarly why I prefer paying with paypal or google or even (as not so common) amazon third party payment systems than a retailers own internal payment system, yeah they might screw up too, but they invest a lot more into not screwing it up).

reply
The data is probably is somewhat safe in the cloud. I expect what’s infected is a bunch of PC clients locally. The logical thing that could have happened is someone with an admin level of access on the Windows domain opened an attachment or got phished, and that allowed the ransomware to deploy to all the on-prem systems. Unless they have customized the ransomware to do anything special for this particular library software, it may be not all that bad in terms of data at risk. Though it’s possible the human attackers received cloud software credentials, and could have used that to exported patron data to threaten to leak.
reply
There's a good list illustrating the market at https://librarytechnology.org//products/

I've noticed Spydus seems to have a big marketshare in the UK.

reply
What if the budget is cut so harshly that there is no budget for someone who might potentially notice the problem (and fix it before it is exploited, or make the “we have to stop” decision) at all? The problem becomes undetectable until exploited, so you can't proactively shut things down.

Your assumption that enough people would change their vote (or non-vote if they didn't turn out previously) based on this to make a difference, I think is unlikely to be correct. People complain a lot about public services when they don't work well, but seldom consider (or do but seldom prioritise them) them at the ballot box.

reply
And they would risk being completely shut down, I assume. Is that a better option? I'm not even talking about the livelihood of the librarians, but about the loss of the public service.
reply
Winging it and making do with what you can is still probably a great deal for the public. Assuming that something shouldn't be done if it can't be done very well is an interesting position to take.
reply
Was it really so bad the last time you visited a Queens Public Library?
reply
Typical developer response: if you can’t do X 100% properly you shouldn’t be doing it.

Sure, let’s close down all libraries and all public services for that matter. Let the public feel the pain. They will understand and vote better next time, right?

You think it is lack of information that got people to vote for this nonsense?

reply
Closing things down is the argument taken to a logical extreme. Could they function without collecting that much PII though? If you can't do it right, don't do it, is far more reasonable when limited to just the collection of PII or other potentially sensitive information. Some identifying data might be absolutely required of course, but the great many cases like this show that collecting the absolute minimum must become the default choice.
reply
deleted
reply
If you leave your car unlocked and police detects that, they can confiscate your keys and probably even fine you after you collected them. The same principle applies to everything. To a certain extend, it is your duty to secure things. Just putting a sign there "please dont fuck with me" isn't enough these days.
reply
That's the yardstick we use for corporations who put profit before safety, and you want use it with government services. Good luck with that.
reply