6 ms·

At my company we had a competitor scrape our API for various businesses. One of the fields was an bson ObjectId that represented when the customer entered our s

At my company we had a competitor scrape our API for various businesses. One of the fields was an bson ObjectId that represented when the customer entered our system. This unique identifier encodes a timestamp of its creation. Our competitor was able to ascertain, based on that timestamp, when our customers contract was up and was (briefly) able to poach some customers by underbidding us until we corrected this.

taftster 3y ago
Wow. I'm amazed by stories like. I'm so naively the "take the high road" kind of guy, that I just assume everyone (or every company) should just do the right thing. Stealing customers in this way from a competitor, I have no ability to rationalize such an action. And this kind of makes me scared, like if I were to ever own a business, I just know I'm swimming with sharks with no ability to defend. I believe your story, but it's just crazy to me. Go earn a customer's business in a legit way, not be stealing data from a competitor.
- oluwie 3y ago
  Uhh ... that's entirely what business is about. Some shady methods maybe, but also some pretty good customer acquisition methods
  - gorjusborg 3y ago
    Businesses do not have to act unethically. Doing so limits who you can hire and collaborate with.
- spamizbad 3y ago
  Honestly I didn't even think of it when I first wrote the endpoint. Our founder asked me "Is there anything we're sending over the API that might clue someone in when someone signs up? Are we sending a createdAt field or something?" and I said "No, but we do have a timestamp in one of the IDs..." -- well, we removed the field and this behavior stopped soon after. Anyway, the arc of the universe bends toward justice: this (former) competitor got sold for parts a few years later.
- Dylan16807 3y ago
  Giving someone an offer when their existing contract is running out isn't that shady. Lots of companies ask for that. It shouldn't be hard to rationalize!
698969 3y ago
Isn't the real issue here that your competitors had the authorization to see the contracts you had with other customers?
- spamizbad 3y ago
  They didn't. We had something like: "locationId": "53c24146ef0b601b77974fcd" They took the first four bytes (53c24146) which is a timestamp that represents 1405239622 seconds since Unix epoch. Our website clearly stated we work off annual contracts (a norm for our industry) - it wasn't secret information. So from this timestamp they could ballpark when a customer's contract was up.
Too 3y ago
How did you find out that they did?

taftster 3y ago

Wow. I'm amazed by stories like. I'm so naively the "take the high road" kind of guy, that I just assume everyone (or every company) should just do the right thing. Stealing customers in this way from a competitor, I have no ability to rationalize such an action. And this kind of makes me scared, like if I were to ever own a business, I just know I'm swimming with sharks with no ability to defend. I believe your story, but it's just crazy to me. Go earn a customer's business in a legit way, not be stealing data from a competitor.

oluwie 3y ago
Uhh ... that's entirely what business is about. Some shady methods maybe, but also some pretty good customer acquisition methods
- gorjusborg 3y ago
  Businesses do not have to act unethically. Doing so limits who you can hire and collaborate with.
spamizbad 3y ago
Honestly I didn't even think of it when I first wrote the endpoint. Our founder asked me "Is there anything we're sending over the API that might clue someone in when someone signs up? Are we sending a createdAt field or something?" and I said "No, but we do have a timestamp in one of the IDs..." -- well, we removed the field and this behavior stopped soon after. Anyway, the arc of the universe bends toward justice: this (former) competitor got sold for parts a few years later.
Dylan16807 3y ago
Giving someone an offer when their existing contract is running out isn't that shady. Lots of companies ask for that. It shouldn't be hard to rationalize!

698969 3y ago

Isn't the real issue here that your competitors had the authorization to see the contracts you had with other customers?

spamizbad 3y ago
They didn't. We had something like: "locationId": "53c24146ef0b601b77974fcd" They took the first four bytes (53c24146) which is a timestamp that represents 1405239622 seconds since Unix epoch. Our website clearly stated we work off annual contracts (a norm for our industry) - it wasn't secret information. So from this timestamp they could ballpark when a customer's contract was up.

Too 3y ago

How did you find out that they did?