Ask HN: What do you do when competition signs up for your service?

176 points by nyellin ↗ HN
I'm founder of robusta.dev which automates day 2 operations and monitoring on kubernetes. In recent months we've seen a close competitor sign up for our SaaS service (using email addresses and names that clearly identify who they are) and experiment with the platform. This is a similar sized startup in the exact same market as us, competing over the exact same customers.

Is there anything we should or even can do about this? Or is this form of competitive research simply unavoidable?

We also have an open source offering which obviously everyone can try and even reuse. We're ok with that, of course

170 comments

[ 3.2 ms ] story [ 215 ms ] thread
I would say it is unavoidable; you can kick them off but then they will sign back on with something you cannot identify. I myself always try to communicate with them and see if there is room for cooperation. You would be surprised how much we got from that. Notably companies we thought were far more advanced (size, sale or feature wise) than we are and finding out they are not. And in one occasion we ended up buying them because they were incompletely over their heads and were trying our system to see if we had the same issue (we did not).
At least they're being honest. Product people at a company I used to work for about 8 years ago would make calls to competitors pretending to be an interested client, and gather details about their offerings from their sales people.
Pretend you never saw it, and take it as a compliment. If you ack that you know thh hh is, you may be tempted to peek into customer information that you have no right to mine for competitive intel. Worse, they might be somehow leading you on about which features they use, etc, as part of a deception campaign.
C'est la vie. Focus on building your product.
Be glad you were able to identify them. I would’ve used a personal email with fake info.
Using personal email for investigation of competitors is illegal. I am not sure in what situations but that’s what we were trained when I was working in US company.
It may be in violation of corporate policies, or perhaps the other company's ToS, but I very much doubt it is illegal in the criminal sense. If you have a link to prove otherwise, I'd love to see it.

At a previous startup, both the founders and various employees would often sign up for competitors using our personal, "spare" emails. We were doing competitive research.

Certainly in the USA violating a website's ToS is a criminal offense. e.g. using a fake name to sign up with a site is at least a misdemeanor and sometimes a felony carrying several years in prison.
Not sure where you heard that, but ToS violations are absolutely not a criminal offense. See https://www.eff.org/deeplinks/2010/07/court-violating-terms-... and https://www.eff.org/deeplinks/2018/01/ninth-circuit-doubles-...

At best, they are a civil violation. This means the company is going to have to initiate a lawsuit, which is very expensive. Assuming that happens, which is extremely unlikely for a fake name, you certainly will not be going to prison.

Sadly, you are wrong. This same statute exists in many states.

(720 ILCS 5/17-51) (was 720 ILCS 5/16D-3) Sec. 17-51. Computer tampering. (a) A person commits computer tampering when he or she knowingly and without the authorization of a computer's owner or in excess of the authority granted to him or her: (1) Accesses or causes to be accessed a computer or any part thereof, a computer network, or a program or data; (2) Accesses or causes to be accessed a computer or any part thereof, a computer network, or a program or data, and obtains data or services;

[...]

    (a-10) For purposes of subsection (a), accessing a computer network is deemed to be with the authorization of a computer's owner if:
        (1) the owner authorizes patrons, customers, or guests to access the computer network and the person accessing the computer network is an authorized patron, customer, or guest and complies with all terms or conditions for use of the computer network that are imposed by the owner;
[...]

    (b) Sentence.
        (1) A person who commits computer tampering as set forth in subdivision (a)(1) or (a)(5) or subsection (a-5) of this Section is guilty of a Class B misdemeanor.
        (2) A person who commits computer tampering as set forth in subdivision (a)(2) of this Section is guilty of a Class A misdemeanor and a Class 4 felony for the second or subsequent offense.
[Class A misdemeanor is one year in a county jail. Class 4 felony is 3 years in prison.]
Sorry, I’ll trust the EFF. TOS violations aren’t “tampering.” The fake account was created through authorized means, etc.
Those "..." that you put in to replace some of the content means we cannot really follow this post.

Statutes are laid out with heaps of criteria, and often complex and/or logic. Cherry picking a few sentences to share here shows that you might have some truth to your claims... but we'd need to read the full statutes and know which jurisdictions you are talking about to really get into it.

I do concur that the fact that ToS is mentioned here makes it worth doing the research and not just saying automatically that it is a civil case, but we'd need much more info do give anything other than the #1 answer from law school for all questions: "It depends."

At the same time, I doubt there are many DAs who would prosecute a criminal case over the email a competitor used to sign up for a service.

I am pretty sure that it is safe in 99% cases, but it is up to you to risk that 1% ;-)
What law would this possibly break? You think a Netflix employee can't sign up for Disney Plus on their personal account?
For personal use that's fine. For investigation of competitor that might be illegal.
It might, it also might not be. Either way 1) odds of it being discovered are very low 2) odds of any law enforcement action being taken, even if it is illegal, is also low. 3) even if any action is taken, what do you think the punishment is going to be? a slap on the wrist or a talking to? a waste of tax payers money, either way.
Every competitor that has signed up for any service I've been involved with has tried to hack us. Whether it's something relatively benign like some querystring manipulation, or something interesting like an elasticsearch zero-day, they all try.

This is a good time to think about security. Can they find competitive information in your urls (you use sequential customer ids?)? Are there areas not locked down?

Remember their IP addresses and cookies, and do a scan of your logs in a month.

Still, it's not worth the trouble of kicking them out. Fake emails are a dime-a-dozen.

> Every competitor that has signed up for any service I've been involved with has tried to hack us.

That sounds wonderful; hand the evidence to Legal and go tear them to shreds in court!

There's only been one time that did real damage. Talked with a security firm, got an audit, and the bad guy did a good enough job of covering their tracks (did the recon with their account, actual attack over TOR) to make it hard to prosecute.

Another time, when one of our competitors was creating a bunch of spam accounts on our app, we just had our VC call their VC. They blamed it on an intern and stopped.

I was at a drinking event at a conference 3 years after an acquisition talk fell through, and an employee of the acquirer told me that they got our customer list from a specific endpoint manipulation, and that caused them to lose interest.

Everyone tries querystring and url manipulation. It's too tempting not to poke around.

In the real world, you can't prosecute any of this.

> they got our customer list from a specific endpoint manipulation

- Never use monotonically increasing IDs as the keys for GET endpoints of single entities. These can be enumerated. Only use tokens composed of random entropy for externally facing keys.

- Carefully consider what your list endpoints reveal. Scope them down to the minimum possible result set. As a bonus, encrypt your cursoring API so it doesn't leak information about your scale. This isn't hard to do. Send down an opaque encoding of pagination state that is server side encrypted and that the client code never needs to unpack. The client just sends the direction, sort key, and encoded token.

Perhaps this is true in the hyper-competitive world of silicon valley startups where it's better to ask for forgiveness (from a judge) than permission, but outside of sv I have never, ever experienced a startup actively exploiting a competitor's systems -- I can't think of a single example. Signing up to a competitor to understand what they're doing, and sometimes cribbing ideas, sure, all the time, but hacking?
Curious what space are you in?
Many years ago found a data disclosure issue with a competitor's API. I immediately disclosed it to them and they fixed it.

If you have competitors that aren't giving you that courtesy you should submit a complaint to law enforcement.

I don't quite understand. You have a public product that anyone can sign up for, and it turns out some people signed up for it. You don't get to pick and choose your customers.
Businesses definitely have the ability to choose customers, barring violations of the Civil Rights act of 1964.
You make it sound like you aren't checking out what your competitors are doing. Why not? They probably have some good ideas that you can try to implement better than they have.
This should be considered perfectly normal :)

Usually a competitor would disguise themselves but in any case, you're a publicly accessible service, if you're doing something right you should assume competitors are going to take a peek.

Maybe you too should take a look at what they are doing, but otherwise keep "keeping on".

This is actually really motivating.

I'm 15 and building an edtech product with my friends, and we noticed 2 employees from a very big edtech company (direct competitor) signed up (with company email addresses) and tested some features out. I don't know if my site will ever be anything more than a hobby project, but the fact that two employees of the site that inspired my own signed up makes me feel like we might be doing something right! I just wonder how they found it.

Honestly, if a company isn’t signing up for competing services and trying them out, it’s approaching negligence.

Understanding the market landscape and competition is a top priority for any startup. That doesn’t mean you should be mimicking your competitors or trying to clone what others are doing, but you must be aware what others are doing in your space.

Be happy! You have gotten big enough for someone to care enough about you to include your company in their competitor analysis. I reckon most founders don't get that far.
Post about it on HN, free publicity to a relevant audience that won't feel like advertising.

Kidding. Just look at it as a sign that you've made it. You're now on the radar. Get back to work and stay ahead.

This is so true.

Once the world recognizes that you have made it, it kind of turns on you. But hey, what does not kill you only makes you stronger.

Yes, this is normal.

I have even seen non-Saas competitors sign up under false pretense, names, new emails- and get private demos, special trials, and so on.

Here, their honesty is a positive point.

If I were you, I would even reach out to them for direct feedback. They are paying customers, and you are the provider, and you are within your rights to reach out to them.

It will be a show of good sportsmanship.

Good point. They have already shown good sportsmanship by signing up under real identities, so it's quite possible they'll even extend that to providing useful feedback.
You might even be able to recruit them at some point in the future.

Every touch is an opportunity.

I'd go so far as to see competition doing research as a compliment.

Keep an eye on features that they find interesting. There may be a reason.

As far as reacting to their presence on your service, the golden rule is a great place to start.

Great point. Reaching out to them is an opportunity to understand their use-case and motivations. Perhaps they are interested in some sort of merger/partnership?
A partnership like agreeing on prices for the same kind of service? I skipped my last mandatory compliance training, but something tells me that this might not be a good idea.
A partnership where you send each other customers that are a better fit for the other's product, is the standard level-1 truce here. If a customer calls you ticked off that you don't have some feature, and you know the competitor has it and you're not going to build it, fire the customer at your competition!
There are plenty of ways that companies in the same space can cooperate and compete at the same time without doing anything shady. Most of our partners at autotempest are also technically competitors. But in almost any business there's nothing at all unusual about having a friendly chat with a competitor in the same space. You probably understand each other pretty well! You won't completely open up to them of course, but there might be some info each side is willing to share for mutual benefit.
And you can remind them your TOS that they accepted does not allow reverse engineering.
... but they can download your open source, it's easier anyway
(comment deleted)
Five minutes spent thinking about this question is five minutes you could have been talking to customers instead.
If you have not done this to them, then consider this your first opportunity to learn from a competitor.
Others have commented here that this is normal, but since you're surprised about this, here's some actionable advice (as someone that's worked in very competitive spaces):

1) You should be doing the same thing. If you're not on top of the competition, they will chew you up, especially if they're better funded.

2) When you're doing your own competitive research, watch out for EULAs and ToS -- they're typically not enforceable (or very expensive to enforce), but many of them explicitly disallow this kind of thing. Use fake addresses.

3) Make sure your EULAs and ToS have similar provisions. Again, these are very difficult to enforce, but consider them as very cheap defence-in-depth.

4) Restrict your most innovative features (while they're in beta) to whitelisted user accounts. Again, not a perfect solution, but defence-in-depth.

Being a founder in a competitive space requires wartime thinking. As shitty as it is, your competitors are breaking rules and violating laws all over the place.

I think all that is a waste of startup founder’s time. Focus on your product, make sure your customers love it, and more new customers get to know about it. If you do that, competition does not matter; if you don’t do that, you lose regardless of competition.
Focusing on your product presumably involves improving that product.

Improving the product presumably involves understanding the end user.

Understanding the end user presumably involves understanding their alternatives.

Not GP, but I think it's the last point that isn't necessarily.. necessary.

It's one tool for sure, but not one I think you absolutely have to use - unless you have some indication people are increasingly picking the competitor over you, or especially and more simply leaving you in favour of the competitor.

> unless you have some indication people are increasingly picking the competitor over you, or especially and more simply leaving you in favour of the competitor.

If this happens, you've already lost. Software development has long lead-times. By the time there is significant customer attrition, bending the curve will be immensely difficult.

Good engineering strategy requires over-reacting to the right signals, and trends in the broader ecosystem are a wonderful source of signals. Large tech companies know this, and there's a reason why they'll quickly throw billion-dollar budgets behind exploratory efforts in response to competitors.

That said, it certainly depends on the industry. Some sectors are more fast-paced and competitive than others.

> Focus on your product, make sure your customers love it, and more new customers get to know about it. If you do that, competition does not matter; if you don’t do that, you lose regardless of competition.

Ugh. I think these types of platitudes really trivialize the immensely difficult job of being a founder.

> Ugh. I think these types of platitudes really trivialize the immensely difficult job of being a founder.

Which includes creating EULA and ToS. How much time does one “waste” by adding a couple of extra paragraphs that can probably lifted from some standard copypasta boilerplate?

> Which includes creating EULA and ToS. How much time does one “waste” by adding a couple of extra paragraphs that can probably lifted from some standard copypasta boilerplate?

If you intend to use this adversarially, or if there's a chance it'll get tested in court - don't cheap out. Hire a lawyer to do this.

>If you intend to use this adversarially, or if there's a chance it'll get tested in court

And if not, why have it at all?

Agreed. Competitors can come in all shapes and sizes. Some can be real bullies or suck oxygen out of the room, some will be actively pulling away from your niche giving you tremendous opportunity to position your product as they misstep, and it's important to keep tabs on product changes and understand what kind of love (or ideally hate) your would-be customers are feeling from the incumbents.

What's most important, in this context, is to have a founding team approaching the dynamics from different viewpoints, who can rein each other in if the instinct to monitor one's competition ever exceeds the strategic value, and share the burden of understanding the landscape of what customers need and what they think they can get elsewhere. IMO, having a great team is just about the only "startup rule" that is true without exception.

"This is war" is a platitude/power/martyrdom fantasy that is far more likely to get you into legal, reputational and other workplace trouble than "build something people want".
It’s just market validation for features for a product. You think it is inefficient to search in competitors’ feature space for prospective features? Like the only real source of features is ex nihilo followed by customer research?

Interesting.

This is not good advice. In order to understand your market you need to understand your competition.
History has shown us that the best product doesn't always win e.g. LaserDisc
That's a bit simplistic. Do you really think that there aren't at least a couple of things that your competitor has done better than you? Don't you want to know about them? You don't have to copy them slavishly but maybe you can be inspired by them for one of your own upcoming features.
This. Also focus on your culture, your staff, and and other things that cannot be seen in functionality, like performance or running costs. If the competitor does copy your feature, will be built as efficiently, as scaleably, as flexibly, as cost-effectively as your implementation? These are attributes that the competitor cannot steal and the sum-total of these, plus your feature, will ultimately see you win out.
If you focus on your product you also must understand the medium it is in. Competitors can be a significant part of that medium.
Or, reach out to your competitor and explore whether there is an opportunity to merge and grow together.
How is he breaking rules and violating laws? They used real email addresses that easily identified who they were.
The flip side of OP’s point is that successful competitors will use this rationalization to give themselves some ethical standing when they are actually the first-mover bad actor. Whether or not the competition is doing it, the belief that they could drives the Machiavellian preemption described here.

That said, it is the nature of the game. If you want to preserve your ethical stance sometimes the only winning move is not to play.

+1 to update your EULA and ToS. Specifically mention that one cannot use the service with the intent to reverse engineer it or build competing services. Both these are standard in most online services like Google APIs etc. Google for example, asks that if someone publishes metrics comparing Google API performance with others then they must share information about the performance testing with Google (test data, test methodology etc.).

On the other hand, remember that its perfectly legal for your competitors to gather publicly available information about your service. Good thing is other party is not hiding themselves so maybe they are playing fair. Btw your neighbor visited your home so be polite and visit them too :)

> Use fake addresses.

Not a lawyer, but wouldn't that approach the domain of misrepresentation?

yeah no kidding -- "avoid the legal hassle of EULA and ToS by just lying on the contract yourself!" seems like pretty terrible advice without being accompanied by a huge disclaimer.
Sorry, are you saying that signing up for a service using e.g. temporaryaccount123@gmail.com is illegal? I doubt there is any contractual language that could mandate you to use a personally-identifiable email address.
It wont look good if it goes to discovery or otherwise ends up before a jury, it's a big flashing sign that says mens rhea if you're violating legally enforceable TOS/EULA terms. Dilligent competitors will still sniff you out by other means (office IP address, or if you're working from home, your work VPN)
Thanks. Assuming we have a ToS which forbids this, is there anything even worth doing when it's violated?
I hate that "put unenforceable restrictive clauses in your ToS" is likely good advice.
(comment deleted)
At least you can snoop on what they are trying out. If they had used some disguised email, you wouldn't have this information.
Years ago I found a niche on creative editing, checked all editors and found these lacked a good visual tool. After several months of work released the first no-code tool in this niche. About a year later competitors arrived, one from Asia and another from Brazil. They made simpler copies of my tool, but got something right that I didn't understand previously: users wanted pre-designed assets and scenes. They also had communities already created to support with installs and ratings. Didn't get annoyed at this, I could still build a better tool and copy their ideas. I would be annoyed if a large company was the one smashing my app. In some way they contributed to my way of thought teaching me something valuable on user needs and promotion.
I'm signed up for all of my competitor products. It's pretty normal I assume.
They’re being transparent, I think that’s really respectful.
It's a game of chess, not poker.

What do you do now? What do you show them? There's many win conditions.

Sign up for their service in return, tell them, may the best man win. Think also that winning is for the benefit of your customers, and for each competitor to be the best possible.

As long as you're not competing directly against yourself ie. stolen IP, it'll be fine. On that note, you ought to conceal some amount of your source in some way.

Don't be completely open source, have some small thing that can't be copied. The intent of being open source counts. One good way to do this is to have a more efficient algorithm than what's available publicly (talk to me) and then your open source offering has the regular algorithm, but your closed source advantage is a much more efficient algorithm that represents a competitive advantage. Like say multiplication, simple example, suppose you're working with crypto and want fast multiplication, if you can do it faster with some hot algo, you aren't forced to share that, users copying your source can use the run-of-the-mill algorithm. It's the same thing, exact same thing, same input same output, just that you happen to have a faster algo you keep to yourself. You don't even have to tell people! Still open source! Anybody can run all the code!

Because it's strictly necessary to have IP, or tech if you want to call it tech, that can't be copied directly and trivially. Mark Lemley at Stanford says so in his IP law class: "Suppose there's two competitors, one does all the work of creating or inventing something new. The other just copies it. Costs nothing, it's a sure thing. I'd love to be that guy!" It's not as unreasonable as the internet makes it seem.

So you just have to know the system because there are gotchas, like with any law that tries to be fair. So for one, for USPTO, deadlines are deadlines. Death. You missed the deadline? You cannot ask forgiveness for your mistake, they're completely unsympathetic (and it's because people try to hack them so hard). So actually becoming familiar with IP law, and then routing your business in the direction of what you can protect.

Analog is another form of protection, that's very common in high-precision manufacturing in Germany, basically you have an industrial Excalibur in your factory that your competitors don't have.

And what I would do is, sign up to your competitor's service in return, and try it out. Also: try to differentiate somehow. I created a theorematic pricing algorithm and the idea was you just can't charge the same price as a bunch of other people, you have to be different, undercut or mark up, whatever it takes to be alone in the price curve. And when you do go up or down, adjust your product accordingly and according to the specific needs of customers who want to pay that price for it.

That algo is also for sale.

"Suppose there's two competitors, one does all the work of creating or inventing something new. The other just copies it. Costs nothing, it's a sure thing. I'd love to be that guy"

The first company controls the market the second responds. The second is always later to market. Without those development costs company 2 has more money but they need to use it to reduce prices to get others to try their product and they need to spend it on marketing.

If company 2 has another advantage like unlimited money or relationships.. they can kill company 1.

Everybody who knows what they're doing and has a sound business has unlimited money right now.

It's good to have cofounders, but...relationships, yeah, I don't know, I don't believe in allies, don't believe in the concept. How would ally and I decide who takes charge? In chess allies are worth nothing.

The enemy of my enemy is Daniel Cussen. That ought to be enough.

(comment deleted)
I’ve seen this before with a startup I started years ago. in a few years we were acquired by that competitor :)
Don’t let them live rent free in your head. Innovation comes from a calm and quiet place. Focus on your customers and invent new ways to use your team’s unique superpowers to delight them.