Hacker News Reader

Comment by notwedtm | Hacker News Reader

I guess I'm the odd one out on this, but why not send your competitor an email and let him know what he's doing is risky and dangerous. Perhaps he doesn't know? Perhaps he had a developer who told him everything was fine, and a friendly, across-the-aisle approach could help things.

As you said, you'd probably put him out of business, and regardless if that's your competitor or not, it's still a human being with a life that will be ruined.

As icebraining mentioned earlier, it's not illegal to not be in PCI compliance, just really, really dumb.

View on HN

This is the most interesting answer. On one hand business is business and if a competitor is truly doing something that is risking the livelihood of it's customers, that's not good and they should have a right to know and subscribe to a better service. On the other hand, he is human and might have had a developer that was clueless, etc.

His reply would be key to determining which is true. If he purposefully did it to save costs, not caring, etc. then you have good reason to publicly call him out on it. If he truly was clueless and this is a big oh shit moment to him then you have a couple options you didn't otherwise have. If he doesn't have a big dev team (and if he does they seem incompetent) he might be willing to sell instead of spend the money to fix everything. There might also be some other creative solutions that would be beneficial for you rather than attacking it head on publicly.

On the other hand, if someone doesn't follow such an obvious practice, isn't there a good probability that they've fucked up in many other less visible ways? What's more likely - that the business owner will have a flash of realization and order a full security analysis of his software, or simply patch this problem (by hiding the CC) and leave the others unfixed (e.g. keep the numbers unencrypted)?

And in any case, would a report really be likely to put him out of businesses for just this mistake? That doesn't seem in the interest of the people doing the analysis.

The former customer and her/his bank have an honest interest in ensuring PCI compliance. Have the customer tell her/his bank/CC company, and have the customer optionally contact the business. In my experience, when I reported my landlord's management company for clear text passwords, my bank (BofA) followed up and the company rolled out PCI-compliant passwords in a couple months.

This might be the nice thing to do, but anything that points back to him being the source of the complaint may not be best for him in the long run.

Why not? If the competitor decides not to take his advice, and he then reports him for violating PCI, he can say, "Hey look, i reached out via email to him and tried to help, he blew me off/didn't fix anything, so I then took steps to protect his customers, since he wasn't."

It's about retaliation and legal issues. The guy could easily retaliate with a smear campaign or even take legal action saying he was "hacking" or doing "espionage".

Whistleblowing often has negative consequences for the whistleblower.

This is what I'd do for an even more subtle reason. Wrecking his business this way could poison your own well of prospects. The customers of his that you could win just by being better might abandon your whole market segment with a "they're all crooks and incompetents... we only buy from IBM from now on" type attitude once they learn of a bungle this big.

Why would it put him out of business? Is there no way to clean everything up and get back into compliance? There have got to be PCI compliance strike team consulting companies that you can hire to come in and rapidly fix the problem.

Anonymously! Don't make yourself a target!

This is the most important take-away here. Possibly communicate via a lawyer, whether you are giving a friendly heads-up or otherwise. This type of thing could be construed into conspiracy.

Giga-up-vote. It's too easy to slip up on security hygiene and either lose a jobs, customers, investors, reputation &| be sued. There's just too many liabilities and it's hard to pull off without being (legally) interpreted as a threat.

It is laudable to Do The Right Thing(TM), but the personal cost is likely nonzero sum.

Be aware, tread carefully, CYA.

Reply on news.ycombinator.com