5 ms·

The posts from these guys are pure BLACKMAIL. I work at one of the companies who's product they "reviewed" and many of us got unsolicited emails basically sayi

The posts from these guys are pure BLACKMAIL. I work at one of the companies who's product they "reviewed" and many of us got unsolicited emails basically saying, we found all these bugs using our code analyzer. Buy a license from us to fix them or we will post a negative review of your code. It's a horrible business practice and they do that with many open source products. This behavior shouldn't be praised.

naikrovek 8y ago
That's Russia for you. That's ANY shady son of a bitch for you, really.
- coldtea 8y ago
  >That's Russia for you. Yes, it could not happen elsewhere, e.g: https://www.xdesk.com/wirecutter-standing-desk-review-pay-to-play-model https://www.xdesk.com/wirecutter-standing-desk-review-pay-to... (And from a NYT backed website, nonetheless) >That's ANY shady son of a bitch for you, really. Better.
  - wmeredith 8y ago
    REALLY disappointed to read this about The Wirecutter.
    - coldtea 8y ago
      Yeah, me too. Thought they were a legit site, and always checked them for 3-4 things I've bought they cover. Now I see them as any other site, to be read with a grain of salt.
    - neurobashing 8y ago
      From context, Lams use of “kickbacks” in the email refers to Amazon affiliate payments. It’s a freakishly poor choice of words but hardly scandalous.
      - detaro 8y ago
        It clearly does not apply to Amazon affiliate payments only, but is asking for a specific affiliate program with the manufacturer being set up - if it were Amazon affiliates, there'd be no need for them to be involved. The optics of asking for that and after being denied changing the recommendation (presumably to something where they do get affiliate payouts) are quite bad. That's a problem for the Wirecutter with products not available on Amazon: their (IMHO reasonable) argument has been that since they get the payout from a Amazon and not the individual vendors, they have no incentive to recommend a product that's not the best, since they get paid for whatever they recommend. This only works as long as everything tested is on Amazon. As soon as they start creating individual agreements with manufacturers, it becomes a lot less obvious that they can be trusted to not optimize for the most profitable affiliate terms. (Maybe there'd be something about having a policy that all agreements have to be the same, but that's tricky)
executesorder66 8y ago
Just tell them you'll use sonarqube[0] from now on. I mean, what is the point of using proprietary software when the opensource alternative is better? [0]https://www.sonarqube.org/ https://www.sonarqube.org/
DoofusOfDeath 8y ago
I'm not a lawyer, so I don't know if calling it blackmail is hyperbole. If it really is blackmail, have you contacted a law-enforcement agency?
Traubenfuchs 8y ago
You are saying you and your company do not want to fix your buggy code but at the same time you do not want your customers/users to know that your product contains buggy code. Interesting.
- agameengineer 8y ago
  Not what I said. Will gladly fix bugs someone discovers. You can also freely point them out, you can even publish them if you want to bring it to our attention. You can even use it to sell your code analysis tool. That's cool with me. But don't email me asking for money and threatening to write a bad review if I don't do as you say.
vkazanov 8y ago
Judging by the errors they describe the code in question really wants some static analyzer love. Even the free/OSS ones can handle 'em. x==x, true || true, etc... Blackmail or not, this is stupid.
kingofhdds 8y ago
I understand why you feel bad about them, and certainly I would feel the same in the same situation, but it's hard not to admit that revealing bugs to the public is very often the only way to make coders pay attention. So even if their intention is only to squeeze money out of targeted companies, at the end of the day they force devs to eliminate bugs this way, or another. Which is good for users, I suppose.
deng 8y ago
No, that's not blackmail. You can only blackmail through exclusive knowledge. If they tested your code, then I'll assume your code is out there in the open, so anyone can run your code through a static analyzer and write a blog post about it. Yes, these posts are advertisements for PVS-Studio, and since they frequently land on HN, they obviously work for them. Besides, you don't even have to buy PVS-Studio, since the Demo already will show you the complete analyzer output, you just won't be able to directly jump to the source.
yorwba 8y ago
Maybe something got lost in translation? "Fix the bugs or we will publish" seems to be standard operating procedure for security researchers who randomly find a vulnerability. Maybe they just wanted to tell you that you'd be able to use their tool to fix those bugs more easily.
- tgb 8y ago
  The difference to me is whether they list all the bugs (while suggesting that their product would help) to the developer before publishing or not. If the only way to satisfy them is to pay, then it's incredibly scummy and moreover is a big disincentive for companies to open their source code. After all, every code base has bugs and I'm sure their developers were working on fixing bugs already, but only open source projects can be extorted over their bugs.
  - git_son 8y ago
    Developers of the project can write in support and ask for a full log for free.
    - zenexer 8y ago
      In this case, they shouldn’t have to ask. If you’re going to provide a vulnerability report, provide a vulnerability report. Don’t dance around it to see if you can make money first.
      - git_son 8y ago
        Vulnerability is always a Bug. Weakness is always a Bug. Weakness is sometimes a Vulnerability. Bug is sometimes a Weakness and a Vulnerability. Vulnerability != Weakness!

naikrovek 8y ago

That's Russia for you. That's ANY shady son of a bitch for you, really.

coldtea 8y ago
>That's Russia for you. Yes, it could not happen elsewhere, e.g: https://www.xdesk.com/wirecutter-standing-desk-review-pay-to-play-model https://www.xdesk.com/wirecutter-standing-desk-review-pay-to... (And from a NYT backed website, nonetheless) >That's ANY shady son of a bitch for you, really. Better.
- wmeredith 8y ago
  REALLY disappointed to read this about The Wirecutter.
  - coldtea 8y ago
    Yeah, me too. Thought they were a legit site, and always checked them for 3-4 things I've bought they cover. Now I see them as any other site, to be read with a grain of salt.
  - neurobashing 8y ago
    From context, Lams use of “kickbacks” in the email refers to Amazon affiliate payments. It’s a freakishly poor choice of words but hardly scandalous.
    - detaro 8y ago
      It clearly does not apply to Amazon affiliate payments only, but is asking for a specific affiliate program with the manufacturer being set up - if it were Amazon affiliates, there'd be no need for them to be involved. The optics of asking for that and after being denied changing the recommendation (presumably to something where they do get affiliate payouts) are quite bad. That's a problem for the Wirecutter with products not available on Amazon: their (IMHO reasonable) argument has been that since they get the payout from a Amazon and not the individual vendors, they have no incentive to recommend a product that's not the best, since they get paid for whatever they recommend. This only works as long as everything tested is on Amazon. As soon as they start creating individual agreements with manufacturers, it becomes a lot less obvious that they can be trusted to not optimize for the most profitable affiliate terms. (Maybe there'd be something about having a policy that all agreements have to be the same, but that's tricky)

executesorder66 8y ago

Just tell them you'll use sonarqube[0] from now on. I mean, what is the point of using proprietary software when the opensource alternative is better? [0]https://www.sonarqube.org/ https://www.sonarqube.org/

DoofusOfDeath 8y ago

I'm not a lawyer, so I don't know if calling it blackmail is hyperbole. If it really is blackmail, have you contacted a law-enforcement agency?

Traubenfuchs 8y ago

You are saying you and your company do not want to fix your buggy code but at the same time you do not want your customers/users to know that your product contains buggy code. Interesting.

agameengineer 8y ago
Not what I said. Will gladly fix bugs someone discovers. You can also freely point them out, you can even publish them if you want to bring it to our attention. You can even use it to sell your code analysis tool. That's cool with me. But don't email me asking for money and threatening to write a bad review if I don't do as you say.

vkazanov 8y ago

Judging by the errors they describe the code in question really wants some static analyzer love. Even the free/OSS ones can handle 'em. x==x, true || true, etc... Blackmail or not, this is stupid.

kingofhdds 8y ago

I understand why you feel bad about them, and certainly I would feel the same in the same situation, but it's hard not to admit that revealing bugs to the public is very often the only way to make coders pay attention. So even if their intention is only to squeeze money out of targeted companies, at the end of the day they force devs to eliminate bugs this way, or another. Which is good for users, I suppose.

deng 8y ago

No, that's not blackmail. You can only blackmail through exclusive knowledge. If they tested your code, then I'll assume your code is out there in the open, so anyone can run your code through a static analyzer and write a blog post about it. Yes, these posts are advertisements for PVS-Studio, and since they frequently land on HN, they obviously work for them. Besides, you don't even have to buy PVS-Studio, since the Demo already will show you the complete analyzer output, you just won't be able to directly jump to the source.

yorwba 8y ago

Maybe something got lost in translation? "Fix the bugs or we will publish" seems to be standard operating procedure for security researchers who randomly find a vulnerability. Maybe they just wanted to tell you that you'd be able to use their tool to fix those bugs more easily.

tgb 8y ago
The difference to me is whether they list all the bugs (while suggesting that their product would help) to the developer before publishing or not. If the only way to satisfy them is to pay, then it's incredibly scummy and moreover is a big disincentive for companies to open their source code. After all, every code base has bugs and I'm sure their developers were working on fixing bugs already, but only open source projects can be extorted over their bugs.
- git_son 8y ago
  Developers of the project can write in support and ask for a full log for free.
  - zenexer 8y ago
    In this case, they shouldn’t have to ask. If you’re going to provide a vulnerability report, provide a vulnerability report. Don’t dance around it to see if you can make money first.
    - git_son 8y ago
      Vulnerability is always a Bug. Weakness is always a Bug. Weakness is sometimes a Vulnerability. Bug is sometimes a Weakness and a Vulnerability. Vulnerability != Weakness!