Hacker News Reader

Comment by spamizbad | Hacker News Reader

At my company we had a competitor scrape our API for various businesses. One of the fields was an bson ObjectId that represented when the customer entered our system. This unique identifier encodes a timestamp of its creation.

Our competitor was able to ascertain, based on that timestamp, when our customers contract was up and was (briefly) able to poach some customers by underbidding us until we corrected this.

View on HN

Wow. I'm amazed by stories like.

I'm so naively the "take the high road" kind of guy, that I just assume everyone (or every company) should just do the right thing. Stealing customers in this way from a competitor, I have no ability to rationalize such an action.

And this kind of makes me scared, like if I were to ever own a business, I just know I'm swimming with sharks with no ability to defend.

I believe your story, but it's just crazy to me. Go earn a customer's business in a legit way, not be stealing data from a competitor.

Uhh ... that's entirely what business is about. Some shady methods maybe, but also some pretty good customer acquisition methods

Businesses do not have to act unethically. Doing so limits who you can hire and collaborate with.

Honestly I didn't even think of it when I first wrote the endpoint. Our founder asked me "Is there anything we're sending over the API that might clue someone in when someone signs up? Are we sending a createdAt field or something?" and I said "No, but we do have a timestamp in one of the IDs..." -- well, we removed the field and this behavior stopped soon after.

Anyway, the arc of the universe bends toward justice: this (former) competitor got sold for parts a few years later.

Giving someone an offer when their existing contract is running out isn't that shady. Lots of companies ask for that. It shouldn't be hard to rationalize!

Isn't the real issue here that your competitors had the authorization to see the contracts you had with other customers?

They didn't. We had something like:

    "locationId": "53c24146ef0b601b77974fcd"

They took the first four bytes (53c24146) which is a timestamp that represents 1405239622 seconds since Unix epoch. Our website clearly stated we work off annual contracts (a norm for our industry) - it wasn't secret information. So from this timestamp they could ballpark when a customer's contract was up.

How did you find out that they did?

Reply on news.ycombinator.com