Ask HN: Found a major vuln in competitor's software. What now?

https://news.ycombinator.com/item?id=5772056

by badsamaritan • 13 years ago

7 19 13 years ago

news.ycombinator.com

Hi everybody,

Let's assume that I have a web app, and I have a competitor, with very similar product. I found a major vulnerability in their software and I can destroy all of their data.

Usually, if I find something like this in someone's software I would write him an e-mail, because I am a nice person. This is a good thing to do, right?

But in this case I just don't know what to do. I don't want to lower my karma, destroying their business, plus it sound like a real crime. But I don't want to tell them either — they are my competitors.

What would you do?

outericky• 13 years ago

Don't be evil. Tell them or don't. Don't exploit it.

Edit: I would tell them.

shakiba• 13 years ago

Send same email again, but this time to their enemy! [kidding]

jgrahamc• 13 years ago

Tell them; be a mensch; life is long.

Many years ago when the web was young I worked for a company that had accidentally left its intranet open to the web. We didn't know. It was hard to find, but if you knew the URL you could access it (on some weird port).

But on the intranet was a link to a competitor. The competitor found the intranet because it appeared in their referrer logs. One of our employees had clicked through to the competitor and left a trail.

The CEO wrote to us and told us. Looking at our intranet logs we knew that they only looked at that one page.

The CEO of that company became a fairly well known VC. All of us had a great deal of respect for his actions. They could have accessed details of our product plans, revenue and employees.

Ultimately, his company was more successful than we were.

DanBC• 13 years ago

Cautiously: tell them.

You want to protect yourself from retaliation. It's not unknown for people who report vulns to be prosecuted.

Obviously don't use it. That risks not just your business but a prison sentence.

shail• 13 years ago

Write a blog about it. That way you will have told them about it and also your prospective customers. So win-win for both. They get to fix it and you probably get more customers.

Obviously it can happen to you as well so be prepared.

kohanz• 13 years ago

I find these decisions are easier to make if you reverse the roles. If you were in their shoes, what would you want/expect your competitor to do?

HarryHirsch2• 13 years ago

Here are the options: a) keep silent, b) exploit it, c) tell them,

c) is the worst option; there are enough examples of people getting busted for "hacking", double so for hacking a competitor. b) is better. If done with caution you will not get busted, and you will get richer. a) is an acceptable altenative. You will not make money, but you won't get busted either.

It's sad, but we live in a time where honor and fair dealing is not recognized, and we must live with it.

tptacek3• 13 years ago

This is where we're at with HN now? Comments cheerleading people into committing felonies?

HarryHirsch2• 13 years ago

Your sarcastometer needs to be returned to the manufacturer for major overhaul. It has lost calibration. (Actually the last line in my comment should have given it away, it recalls a comment on Seneca the Younger by a French philosopher, can't remember the name. He called him "a man of honour in a time when such did not exist".)

The comment was supposed to make two point: first there is this prevalent opinion here that market forces will invariably guarantee an outcome that is beneficial to society. This would suggest option b) or c) for the OP, dependent on his skills and connections. I dislike both, and so do you.

Also, both of us know that people have gotten into trouble for disclosing vulnerabilities, even when they were disclosed only to the owner/manufacturer. This isn't acceptable, neither to the person who pointed this out, nor to society in general, because it leads to vulnerabilities left unfixed, and unfixed vulnerabilities have a knock-on effect on the wider world.

centdev• 13 years ago

Tell them. If you can't win the market by being better than them, exploiting it to make them fail means you already have.

staunch• 13 years ago

Tell them, very anonymously. You don't want to risk them accusing you of anything. Or, just forget it about it completely, which is probably the safest option.

Do not do anything destructive. It would be highly illegal and you could very possibly end up losing years of your life in prison. It's not worth it.

basdevries• 13 years ago

Just tell them, if you do it correctly, you might get to know your competitor a little better and over time, there might be a way for you guys to focus on different markets with the same products, discussing difficulties you both have and so on. Eventually you want to look yourself in the mirror and be happy with what you've accomplished, and not be ashamed of what you've accomplished.

mgirdley• 13 years ago

This is a no-brainer: tell them. Yes, they're your competitors but when they find out your accountant is stealing from you, wouldn't you rather they told you?

logn• 13 years ago

Forget you knew this and get back to your life. Did we learn nothing from Weev? Do you think your competitor might like seeing you in federal prison? All it takes is one jerk at your competitor's company (or any of their investors) to call in the feds.

tptacek3• 13 years ago

If he actually exploits the vulnerability, calling the police doesn't make them jerks.

orangethirty• 13 years ago

Send an anonymous tip

samfisher83• 13 years ago

If it were bill gates he would probably delete all their stuff.

I am not saying you should do it, but a lot of successful people got to where they are without being too nice.

ankurdhama• 13 years ago

Tell them, becoz the safety of the users is more important then your competition.

Ask HN: Found a major vuln in competitor's software. What now?

Related Stories