Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

While working on a project for my company, I needed to build functionality that allows users to import/export data to/from our competitor's site. While doing this, I discovered a very serious security exploit that could, in short, perform any script on the competitor's website.

My natural feeling is to report the issue to them in the spirit of good-will. Exploiting the issue to gain advantage crossed my mind, but I don't want to go down that path.

So my question is, would you report a serious vulnerability to your direct competition, in order to help them? Or would you keep your mouth shut? Is there a better way of going about this, perhaps to gain at least some advantage from the fact that I'm helping them by reporting the issue?

Update (Clarification):

Thanks for all your feedback so far, I appreciate it. Would your answers change if I were to add that the competition in question is a behemoth in the market (hundreds of employees in several continents), and my company only started a few weeks ago (three employees)? It goes without saying, they most definitely will not remember us, and if anything, only realize that their site needs work (which is why we entered this market in the first place).

This might be one of those moral vs. business toss-ups, but I appreciate all the advice.

share|improve this question
4  
Depends on whether you're moral or amoral. –  dietbuddha Feb 17 '11 at 21:53
5  
Report it anonymously from a disposable email address from behind a proxy without any ties to your current workplace. –  Job Feb 17 '11 at 22:59
14  
Why does the size of the company have any bearing on what constitutes ethical behavior? –  JohnFx Feb 17 '11 at 23:32
6  
There's a little anecdote about a guy who tried to sell Pepsi some secrets from Coke...Pepsi called the cops on him. No matter how intense rivalries can be, competition should always be based on fair and ethical business practices. If you guys are better, you'll beat them regardless of how big or entrenched they are. It may not happen over night, but look at the browser wars. Slowly but surely alternatives are taking share away from IE even with IE preinstalled! –  Chris Thompson Feb 18 '11 at 2:00
    
@JohnFx +1: spot on question sir! We could even use the same argument if the situation was reversed: "my company is a well-established and respected behemoth and theirs is only a small company which would likely fail sooner or later anyway." Regardless of the relative size of the companies, the ethics are the same. –  bedwyr Feb 18 '11 at 5:18
show 2 more comments

14 Answers

up vote 57 down vote accepted

Though I'd love to live in a world where it would be perfectly safe to just drop them a note to let them know, I'd suggest involving your legal department first. Realistically, it's entirely possible that however well intentioned your bug report is, someone in the competitor's organization will interpret it as "our competitor just paid one of their employees to hack our site". That perception could create legal or PR issues for both you and your company. Involving your legal department in the notification should help shield everyone from the appearance of impropriety. Of course, that creates the possibility that the legal department concludes that notifying the competitor creates an unacceptable legal risk and tells you just to sit on the information. But that's much better than the alternative that it all blows up in your face.

share|improve this answer
13  
+1 for contacting the legal department first. –  FrustratedWithFormsDesigner Feb 17 '11 at 22:03
    
In all likelihood they'll say to go with it - but they'll know the best approach to go about it without exposing you or your company to unwanted legal backdraft. –  HorusKol Feb 18 '11 at 2:35
    
If legal department says no, I'd go with the anonymous email idea. And if they say yes, make sure your name is in there somewhere! –  Benjol Feb 18 '11 at 8:46
16  
Of course, finding a "legal department" in a company of three is going to be pretty difficult, I imagine :) –  Benjol Feb 18 '11 at 8:49
8  
It pains me to agree with this answer. It's a sad commentary on society when lawyers are needed for a code bug report. –  jdl Feb 18 '11 at 18:07
show 2 more comments

This is going to sound awful (at least compared to most answers here) but, here goes my 2 cents :

Why should you do anything about it?

First thing's first, they already have employees who should be doing that sort of work (finding problems and fixing them).

Secondly, the way you formed your question makes it sound as if this is some kind of a moral dilemma. It's not. You did not do anything to cause that problem in the first place.

Thirdly, you are competing against them. You should be focused on making **YOUR product the best there is, not theirs.

If you're still in doubt, go back to my point no.2 and re-read it.

share|improve this answer
9  
+1 for being realistic. Don't do anything illegal, sure. Immoral? In business, there is no moral or immoral. Company does not have such a thing as concept of morality. –  Davor Ždralo Feb 17 '11 at 23:22
3  
@HorusKol - the +1 isn't going to pay salaries and costs for the company. Offering a better product than your competitor however, might. –  Jas Feb 18 '11 at 13:55
3  
-1. This kind of thinking is a classic example of the Tragedy of the Commons. Security holes are everyone's problem. –  Mason Wheeler Feb 18 '11 at 18:02
5  
@Mason Wheeler: The tragedy of the commons is a dilemma arising from the situation in which multiple individuals, acting independently and rationally consulting their own self-interest, will ultimately deplete a shared limited resource even when it is clear that it is not in anyone's long-term interest for this to happen. I don't see how this is applicable here. –  user17610 Feb 18 '11 at 18:25
3  
Frankly I am shocked that you would suggest not telling your competitor about their security bug. Why not file a bug report in the form of a press release or promotional email. Such bug report should note the absence of said bug in your product and the potential implications for users. –  emory Apr 22 '12 at 7:35
show 11 more comments

There's a thin line between exploring vulnerabilities and industrial espionage, and since you are affiliated with your employer, the competitor can consider it the latter.

If you report it and there's a legal/PR nightmare, you'll be the scapegoat.

Talk to your legal department and let them handle it as they see fit - there's a reason they make way more than engineers.

share|improve this answer
1  
Beat me by 30 seconds. –  Justin Cave Feb 17 '11 at 21:59
add comment

An alternative mechanism, not yet suggested AFAICS, of getting the information to your competitor with no risk to your own company is to let one of the various vulnerability reporting companies know about the vulnerability - and ask them to report it to your competitor. They (the vulnerability reporting company) would keep your name out of the report - you'd be anonymous to your competitor. One such company is the Zero Day Initiative, ZDI - there are a number of others.

share|improve this answer
add comment

Leak it to the media, anonymously of course, and then offer quick migration to customers of the competitor. This might seem like a low blow, but consider this, there is nothing illegal or unethical about what you are doing, further consider it is a dog eat dog world in SW and as David going against Goliath you are going to need all the leverage. Remember, it's not personal, it's strictly business. They would do the same to you in a heartbeat.

(FWIW I fully expect this answer to be down-voted, but that's OK because what I am saying is the truth albeit a harsh one.)

share|improve this answer
    
Seems good to me: you notify them and make a profit at the same time. However, there's the chance they get ticked off and start fishing for vulnerabilities in your site. –  apoorv020 Feb 18 '11 at 5:43
    
@apoorv It will only mean you have become big enough to worry the Goliath :-). –  Gaurav Feb 18 '11 at 5:48
    
I don't understand why use the words "leak" and "anonymously". The OP did not do anything wrong or immoral –  emory Apr 22 '12 at 7:39
    
@apporv020 u should assume they (and a whole bunch of others) r constantly fishing ur site 4 vulnerabilities. –  emory Apr 22 '12 at 7:39
    
+1, I really like this one. –  Jas Apr 23 '12 at 8:06
show 2 more comments

What would you like them to do if they found a security vulnerability in your software? That should be the first question you ask. If the answer is "I would really appreciate it if they told me", well, then you have your answer!

It doesn't matter that they are a giant company or a three person shop, and it doesn't matter that you are a three person shop or a giant company. As has been said, your reputation is everything, especially in this small community known as software.

share|improve this answer
3  
Isn't doing the opposite of what the competition wants a normal business strategy? –  user17610 Feb 17 '11 at 21:53
    
@user17610 - I guess that depends on the situation... can't make a blanket statement and make all your decisions by that. If your competition wants to make boatloads of money, are you going to do the opposite? –  Jesse McCulloch Feb 17 '11 at 21:58
    
No, then I'll ensure that they don't make boatloads of money ;) –  user17610 Feb 17 '11 at 22:01
2  
+1 for "what would you like them to do if they found the vulnerability in your software?" –  Craige Feb 18 '11 at 0:40
    
-1: I would like them to tell me, because subsequently accusing them of industrial espionage will help corrode their market share! Never assume benevolence in your competitor... –  awashburn Oct 5 '13 at 16:33
show 2 more comments

If you're importing/exporting data between their systems and your own, their security vulnerability could easily become your security vulnerability.

You'll want to cover your butt technologically and legally. Make sure it gets fixed but make sure your legal department has a hand in notifying them.

share|improve this answer
add comment

Obviously, let them know.

If "out of the goodness of your heart" isn't a good enough reason, consider that you are implementing this feature as a benefit for your own customers. You're indirectly protecting their data by reporting this bug.

share|improve this answer
4  
+1 for it's your problem by association. –  Craige Feb 18 '11 at 0:41
add comment

There's only one honorable choice. Tell them.

share|improve this answer
add comment

Personally I would tell them.

Other people have pointed out the possible PR/Legal issues, and if after talking to a layer or PR agent you are advised not to report it, I'D STILL REPORT IT, but anonymously.

It's doing your potential customers a favour, by helping protect their data.

share|improve this answer
    
Yup: anonymous mail to seclists.org/fulldisclosure, he he he... ;) –  Henrik Feb 21 '11 at 0:06
    
@Downvoter, any comments as to why? –  DominicMcDonnell Feb 28 '11 at 20:39
add comment

In principle, I totally agree with what most here say: Step up and report it. There is a professional code of honour like out on sea: If a ship's in trouble, you help, no matter who it belongs to.

Reading your update, however, I'd probably decide against telling them because of the risk that the well-intentioned action might be taken the wrong way (as industrial espionage as @Uri says), and lead to hostilities that are much more dangerous to your three-man shop than they will ever be to them.

Maybe drop an anonymous note; maybe not do anything at all. If you're David, you don't have to tell Goliath that he's got a bee sitting on his back.

share|improve this answer
add comment

Nature, despite its harsh sides, has its kind occasions. And acts them out without thinking twice.

Dog does not eat dog. Rather, bored people pay for illegal dog fights. And Lawyers collect the money. Including from your Boss. More than you want to now. They can happily drain startups without blinking.

Also very possible, someone at "competitor"'s already knows. Bringing the news can mean more responsibilities than being a simple passing messenger. Is that better than talking to walls ?

Security business: Lots of servers with big holes are online. this one server is another one. Full time job for some. Have you checked your own holes ? all of them ?

Watch your step.

Customers data is the important obsession.

share|improve this answer
1  
Okay, I've read this post twice - and I'm still not sure which side of the debate it's supporting... :) –  Cyclops Feb 18 '11 at 16:45
add comment

Tell them. Then send your resume. They might be hiring. :)

share|improve this answer
18  
I'd prefer to not work for people who write such bad code that 15 minutes of inspection leads to the discovery of a serious vulnerability ;) –  user17610 Feb 17 '11 at 22:07
    
@user17610: Okay, an adjusted variant: tell them and see if they fix it. If they don't fix it in reasonable time don't send your resume to them. –  sharptooth Feb 18 '11 at 11:33
add comment

Tell them! It is the right thing to do. Also, what would like them to do if you were in their spot?

You can't place value on the good will that could come out of this.

share|improve this answer
add comment

protected by Yannis Rizos May 11 '13 at 22:21

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.