Quora engineers accused of vandalizing a clone’s website
greyreview.com
greyreview.com
Personally, I think the Quora engineers involved made some poor decisions. Anyone who looks for security vulnerabilities on websites they don't own or control is on shaky legal footing (there are exceptions: Google, Mozilla, Facebook, and a few other companies provide systems for the responsible disclosure of vulnerabilities). However, publicly disclosing vulnerabilities on a competitor's website (and making your proof of concept mildly malicious) is never going to work out well for anyone: it makes your company look like a bully and exposes you to potential legal ramifications.
That said, publicly disclosing a flaw in addition to defacing the website, even temporarily, is certainly not a classy way to go about it.
On the Quora thread, http://www.quora.com/Is-Qato-a-Quora-clone-attempt-or-a-simi... there are some answers by trolls pretending to represent Qato.
"Sameul Codsaw" writes: 'Also, we are using Ruby on Rails, so we expect to have less trouble scaling and finding devs than Quora has.'
Rick Ross, president of DZone (developers of OSQA and Qato), replies in the comments: 'This imposter has no connection with Qato and does a disservice to both Quora and DZone by posting this nonsense.'
"Kevin McDougal" answers and comments, also trying to make DZone look bad. ("Rick, our plan to sabotage the Quora community is working. Did Hernani create the 100 fake Quora accounts yet?" ... "Hold on. Was that message private or public?") It's pretty juvenile and makes me question the quality of the Quora moderation system.
Why are there all these sock puppet accounts (http://www.quora.com/Kevin-McDougal and http://www.quora.com/Samuel-Codsaw) popping up and pretending to represent Qato? They have only one answer on the entire site, and its on this thread.
Are Quora engineers behind these trolls, or who? Regardless of who is behind it, the trolling reflects poorly on Quora, not Qato.
The comments by Ben Newman (Quora dev) honestly are quite juvenile, and do a disservice to Quora, regardless of any ethical considerations on the part of Quora or Qato. I would prefer to see him take the moral high road.
"Quora has a lot of trolls" FTFY
with that kind of comment. Impersonation is crap and childish behavio(u)r and not about being "passionate" about a site or a technology.
I don't think Quora guys are to blame, but
- These comments should be moderated/removed/shouldn't have been allowed in the first place
- Calling idiots that do things like that "passionate users" does both the service and the internet in general a disservice. They are idiots. Period. That's not funny, that's not cool or helpful. Your reply seems kind of supportive and I don't get why.
You seem very angry.
The site in question was just an unpromoted testing prototype which barely has any content and happened to have the Quora-like skin on at that moment. It probably shouldn't even have been publicly accessible.
Another Qato site on the same server is http://robofaqs.com, which is sporting our OSQA clone theme. It doesn't look anything like Quora at all, but is powered by literally the same server instance. That's what we're trying to say - Qato is the general purpose Q&A engine under the skin, and these various skins just modulate the way a Qato site looks.
I shouldn't be hearing "Oh, the Quora skin is just a prototype", I should be hearing something like "the dev site the Quora prototype skin was being developed on was running a 6 month old branch of our engine software, check out out github history to see all the security changes made in the "production ready" branch since November".
(see my other comment downthread for clarification)
This is called experimentation. If you're in chemistry class and you mess up a lab, you're not accused of vandalizing apparatus... it's simply what happens when you are trying something out. Similarly, when you have a text box on a test website, someone is going to type something in, and if that causes the page to disappear, well... fix the bug and move on.
Maybe a better example would be going into your neighbor's backyard and testing how readily his shrubbery lights on fire. Oops, it's burning! Tell him to "fix the bug" and move on.
No, a better example is going into your backyard, shining a flashlight onto your neighbor's shrubbery, and then having the neighbor complain to you about changing the shrubbery's color from black to green.
The protocol for a shrub is: you shine light on it, it reflects light back. The protocol for a public web service is: you send it an HTTP request, it sends an HTTP response. If you don't want your neighbors to see your shrubbery, build a fence. If you don't want your website to contain arbitrary scripts, don't let users submit arbitrary scripts.
If we're doing silly analogies, it's the equivalent of Starbucks sending their staff round to your new cafe with Groupons leaving no coffee or seats for the real customers and then publicly mocking your staff's incompetence in handling the situation. Sure, it's your fault for running the promotion and not buying enough coffee, but you might still consider BigCorp's behaviour a little underhand.
1. There are plenty of proof of concepts you can develop that don't destroy the page.
2. The Quora engineers in question didn't enter stuff into a textbox and leave it alone. They went and publicly disclosed a cross-site scripting vulnerability in a competitor's website.
Edit: Ben deleted his "answer" which disclosed the XSS. However, the comments on the answer are still accessible (for now) if anyone is curious about them: http://www.quora.com/Is-Qato-a-serious-Quora-clone-attempt/a...
Edit 2: Rick Ross posted a comment there I think is worth highlighting.
"In a way, we're grateful to these guys (Ben and Albert) for helping us close a hole. Their method of publicly vandalizing a test site and bragging about it is another matter. A simple email would have sufficed."
1. It's against the law 2. Extremely unprofessional and childish 3. There are better ways to report security vulnerabilities
By way of example, some years ago a story went around about HP support being prohibited from suggesting a user adjust their BIOS. This was back in the day when checking BIOS to see if hard drives, ports and RAM were being detected properly (say, Win98 era), but for HP it was a fireable offense. It may not have resulted in the death of any user's computer in any given instance, but the risk of problems was great enough that they couldn't allow support people to deviate from the troubleshooting matrix in this way.
In this case it seems more a problem of ethics than policy, and no doubt Quora is not very large of a company and does not yet have stringent policies like HP's, but to argue "no harm no foul" is to set a bad precedent at the peak of a slippery slope.
-- It's pretty lame to copy the design and trade dress of another product. It does not bode well for your skill or ability.
Backstory: A long time ago I wrote Delicious. We had hundreds of copycats and competitors. The ones that weren't direct copies were the ones that did better.
I'm sure this doesn't apply to you for whatever reason.
I mean, Quora's design isn't going to win them any awards; it looks like Quora didn't even use Photoshop, just straight-up CSS.
This comment comes from my experience (see above) rather than mere negative opinion.
There are simply too many people drawing from the historical experiences and examples laid by e.g. Metafilter, Digg, image boards, etc. for it to consititute individual acts of copying. That there are so many whitelabel apps & plugins ready for the implementing only accelerates this evolution.
We are discussing wholesale duplication.
They "design in code".
What's worse? injecting a relatively harmless script into the product (that frankly caused them to fix an issue that could have been very painful for them if someone more devious had found it first), or Qato's ripoff of Quora in the first place?
Publicly releasing details of an XSS vulnerability on a third party's site has much bigger ramifications than a copycat site. Plenty of websites deal with copycats all the time: they're frustrating, but they're not necessarily overly threatening. On the other hand, a 0 day could compromise the security of user information. In certain fields, that could completely destroy your business.
...that could completely destroy your business
Yep.
The problem is, their tool has at least one xss vulnerability. I've been there myself, and usually a single xss vulnerability is an indication that the underlying design of the system didn't take xss (and probably web security in general) seriously enough. It's _possible_ this was just a single place where user supplied data sanitisation wasn't done correctly, but I'd bet good money that it's indicative of a development mindset that failed to be paranoid enough. I'll bet there's a bunch of places they're going to find exactly the same error, and won't be at all surprised to find SQL injection vulnerabilities, http header vulnerabilities, and any of a whole bunch of other "common web programming" errors. I'll be amazed if right now there aren't a bunch of people running fuzzers against any site suspected of having the Qato "engine" underneath it. I'll not be at all surprised to hear several of them get compromised before the weekend and start running dick-pill-seo spam...
[Edit: I already feel kind of bad about this comment. I love me some 3$ multi-meters. Still. Analogy stands.]
I'm all about people making Q/A websites and releasing products that are clones of other products. Ideally this kind of competition can make the original product better.
That being said, I find making a clone of someones product and then releasing said product at least in this sense, distasteful. Seeing that it has such similarity to the original that if you weren't familiar with the original you probably couldn't tell the difference.
:P
"So Qato was caught plagiarizing and now they're complaining about supposed "vandalism"? Reminds of those newspaper headlines where the robber hurts himself breaking into a home and tries to sue the family."
I have to agree. This is basic javascript injection. Can you say, "blown out of proportion"?