Ask HN: What do you do when competition signs up for your service?
I'm founder of robusta.dev which automates day 2 operations and monitoring on kubernetes. In recent months we've seen a close competitor sign up for our SaaS service (using email addresses and names that clearly identify who they are) and experiment with the platform. This is a similar sized startup in the exact same market as us, competing over the exact same customers.
Is there anything we should or even can do about this? Or is this form of competitive research simply unavoidable?
We also have an open source offering which obviously everyone can try and even reuse. We're ok with that, of course
170 comments
[ 3.2 ms ] story [ 215 ms ] threadAt a previous startup, both the founders and various employees would often sign up for competitors using our personal, "spare" emails. We were doing competitive research.
At best, they are a civil violation. This means the company is going to have to initiate a lawsuit, which is very expensive. Assuming that happens, which is extremely unlikely for a fake name, you certainly will not be going to prison.
(720 ILCS 5/17-51) (was 720 ILCS 5/16D-3) Sec. 17-51. Computer tampering. (a) A person commits computer tampering when he or she knowingly and without the authorization of a computer's owner or in excess of the authority granted to him or her: (1) Accesses or causes to be accessed a computer or any part thereof, a computer network, or a program or data; (2) Accesses or causes to be accessed a computer or any part thereof, a computer network, or a program or data, and obtains data or services;
[...]
[...] [Class A misdemeanor is one year in a county jail. Class 4 felony is 3 years in prison.]Statutes are laid out with heaps of criteria, and often complex and/or logic. Cherry picking a few sentences to share here shows that you might have some truth to your claims... but we'd need to read the full statutes and know which jurisdictions you are talking about to really get into it.
I do concur that the fact that ToS is mentioned here makes it worth doing the research and not just saying automatically that it is a civil case, but we'd need much more info do give anything other than the #1 answer from law school for all questions: "It depends."
At the same time, I doubt there are many DAs who would prosecute a criminal case over the email a competitor used to sign up for a service.
https://www.ilga.gov/legislation/ilcs/fulltext.asp?DocName=0...
This is a good time to think about security. Can they find competitive information in your urls (you use sequential customer ids?)? Are there areas not locked down?
Remember their IP addresses and cookies, and do a scan of your logs in a month.
Still, it's not worth the trouble of kicking them out. Fake emails are a dime-a-dozen.
That sounds wonderful; hand the evidence to Legal and go tear them to shreds in court!
Another time, when one of our competitors was creating a bunch of spam accounts on our app, we just had our VC call their VC. They blamed it on an intern and stopped.
I was at a drinking event at a conference 3 years after an acquisition talk fell through, and an employee of the acquirer told me that they got our customer list from a specific endpoint manipulation, and that caused them to lose interest.
Everyone tries querystring and url manipulation. It's too tempting not to poke around.
In the real world, you can't prosecute any of this.
- Never use monotonically increasing IDs as the keys for GET endpoints of single entities. These can be enumerated. Only use tokens composed of random entropy for externally facing keys.
- Carefully consider what your list endpoints reveal. Scope them down to the minimum possible result set. As a bonus, encrypt your cursoring API so it doesn't leak information about your scale. This isn't hard to do. Send down an opaque encoding of pagination state that is server side encrypted and that the client code never needs to unpack. The client just sends the direction, sort key, and encoded token.
If you have competitors that aren't giving you that courtesy you should submit a complaint to law enforcement.
Usually a competitor would disguise themselves but in any case, you're a publicly accessible service, if you're doing something right you should assume competitors are going to take a peek.
Maybe you too should take a look at what they are doing, but otherwise keep "keeping on".
I'm 15 and building an edtech product with my friends, and we noticed 2 employees from a very big edtech company (direct competitor) signed up (with company email addresses) and tested some features out. I don't know if my site will ever be anything more than a hobby project, but the fact that two employees of the site that inspired my own signed up makes me feel like we might be doing something right! I just wonder how they found it.
Understanding the market landscape and competition is a top priority for any startup. That doesn’t mean you should be mimicking your competitors or trying to clone what others are doing, but you must be aware what others are doing in your space.
Kidding. Just look at it as a sign that you've made it. You're now on the radar. Get back to work and stay ahead.
Once the world recognizes that you have made it, it kind of turns on you. But hey, what does not kill you only makes you stronger.
I have even seen non-Saas competitors sign up under false pretense, names, new emails- and get private demos, special trials, and so on.
Here, their honesty is a positive point.
If I were you, I would even reach out to them for direct feedback. They are paying customers, and you are the provider, and you are within your rights to reach out to them.
It will be a show of good sportsmanship.
Every touch is an opportunity.
Keep an eye on features that they find interesting. There may be a reason.
As far as reacting to their presence on your service, the golden rule is a great place to start.
1) You should be doing the same thing. If you're not on top of the competition, they will chew you up, especially if they're better funded.
2) When you're doing your own competitive research, watch out for EULAs and ToS -- they're typically not enforceable (or very expensive to enforce), but many of them explicitly disallow this kind of thing. Use fake addresses.
3) Make sure your EULAs and ToS have similar provisions. Again, these are very difficult to enforce, but consider them as very cheap defence-in-depth.
4) Restrict your most innovative features (while they're in beta) to whitelisted user accounts. Again, not a perfect solution, but defence-in-depth.
Being a founder in a competitive space requires wartime thinking. As shitty as it is, your competitors are breaking rules and violating laws all over the place.
Improving the product presumably involves understanding the end user.
Understanding the end user presumably involves understanding their alternatives.
It's one tool for sure, but not one I think you absolutely have to use - unless you have some indication people are increasingly picking the competitor over you, or especially and more simply leaving you in favour of the competitor.
If this happens, you've already lost. Software development has long lead-times. By the time there is significant customer attrition, bending the curve will be immensely difficult.
Good engineering strategy requires over-reacting to the right signals, and trends in the broader ecosystem are a wonderful source of signals. Large tech companies know this, and there's a reason why they'll quickly throw billion-dollar budgets behind exploratory efforts in response to competitors.
That said, it certainly depends on the industry. Some sectors are more fast-paced and competitive than others.
Ugh. I think these types of platitudes really trivialize the immensely difficult job of being a founder.
Which includes creating EULA and ToS. How much time does one “waste” by adding a couple of extra paragraphs that can probably lifted from some standard copypasta boilerplate?
If you intend to use this adversarially, or if there's a chance it'll get tested in court - don't cheap out. Hire a lawyer to do this.
And if not, why have it at all?
What's most important, in this context, is to have a founding team approaching the dynamics from different viewpoints, who can rein each other in if the instinct to monitor one's competition ever exceeds the strategic value, and share the burden of understanding the landscape of what customers need and what they think they can get elsewhere. IMO, having a great team is just about the only "startup rule" that is true without exception.
Interesting.
That said, it is the nature of the game. If you want to preserve your ethical stance sometimes the only winning move is not to play.
On the other hand, remember that its perfectly legal for your competitors to gather publicly available information about your service. Good thing is other party is not hiding themselves so maybe they are playing fair. Btw your neighbor visited your home so be polite and visit them too :)
Not a lawyer, but wouldn't that approach the domain of misrepresentation?
What do you do now? What do you show them? There's many win conditions.
Sign up for their service in return, tell them, may the best man win. Think also that winning is for the benefit of your customers, and for each competitor to be the best possible.
As long as you're not competing directly against yourself ie. stolen IP, it'll be fine. On that note, you ought to conceal some amount of your source in some way.
Don't be completely open source, have some small thing that can't be copied. The intent of being open source counts. One good way to do this is to have a more efficient algorithm than what's available publicly (talk to me) and then your open source offering has the regular algorithm, but your closed source advantage is a much more efficient algorithm that represents a competitive advantage. Like say multiplication, simple example, suppose you're working with crypto and want fast multiplication, if you can do it faster with some hot algo, you aren't forced to share that, users copying your source can use the run-of-the-mill algorithm. It's the same thing, exact same thing, same input same output, just that you happen to have a faster algo you keep to yourself. You don't even have to tell people! Still open source! Anybody can run all the code!
Because it's strictly necessary to have IP, or tech if you want to call it tech, that can't be copied directly and trivially. Mark Lemley at Stanford says so in his IP law class: "Suppose there's two competitors, one does all the work of creating or inventing something new. The other just copies it. Costs nothing, it's a sure thing. I'd love to be that guy!" It's not as unreasonable as the internet makes it seem.
So you just have to know the system because there are gotchas, like with any law that tries to be fair. So for one, for USPTO, deadlines are deadlines. Death. You missed the deadline? You cannot ask forgiveness for your mistake, they're completely unsympathetic (and it's because people try to hack them so hard). So actually becoming familiar with IP law, and then routing your business in the direction of what you can protect.
Analog is another form of protection, that's very common in high-precision manufacturing in Germany, basically you have an industrial Excalibur in your factory that your competitors don't have.
And what I would do is, sign up to your competitor's service in return, and try it out. Also: try to differentiate somehow. I created a theorematic pricing algorithm and the idea was you just can't charge the same price as a bunch of other people, you have to be different, undercut or mark up, whatever it takes to be alone in the price curve. And when you do go up or down, adjust your product accordingly and according to the specific needs of customers who want to pay that price for it.
That algo is also for sale.
The first company controls the market the second responds. The second is always later to market. Without those development costs company 2 has more money but they need to use it to reduce prices to get others to try their product and they need to spend it on marketing.
If company 2 has another advantage like unlimited money or relationships.. they can kill company 1.
It's good to have cofounders, but...relationships, yeah, I don't know, I don't believe in allies, don't believe in the concept. How would ally and I decide who takes charge? In chess allies are worth nothing.
The enemy of my enemy is Daniel Cussen. That ought to be enough.