Ask HN: Should I report my main competitor for PCI Violations?

Re:Ask HN: Should I report my main competitor for PCI Violat... by jacquesm on Thursday January 01, 2015 @04:08PM (#8824322)

Your underlying assumption is that they are doing this to save costs or that there is malice involved. I see no evidence of that, merely either incompetence or a company struggling to get with the times or built at a time when this stuff wasn't so much on the radar as it is today.

That happens a lot and there are ways to deal with it, ratting out your competitors to authorities with silent hopes of crippling them and taking their business in the name of protecting the consumer is bad form at best and will come back to bite you hard at worst.

[ Parent | on HN ]

Re:Ask HN: Should I report my main competitor for PCI Violat... by tzs on Thursday January 01, 2015 @05:00PM (#8824497)

I don't think I made such an assumption. He's saving money, regardless of whether ignoring credit card security was an intentional money saving move, or merely a happy side effect of ignorance or incompetent.

The person I was responding to was taking the position that you should not take against against someone if they are not harming you. That money saving, regardless of how it came about, harms OP's business, and so justifies action.

Note I didn't say the action should be calling authorities. Contacting the competitor and letting him know there is a problem would be action, too.

[ Parent | on HN ]

Re:Ask HN: Should I report my main competitor for PCI Violat... by mst on Thursday January 01, 2015 @04:49PM (#8824469)

I concur. I once wrote code (happily long since retired) that stored credit card numbers unencrypted.

It wasn't about cost cutting. It was about me being young and foolish (and, looking back, I'm not sure it's even the stupidest mistake I've deployed to production in my career, but I'm not sure I want to admit to the other candidates just now :).

[ Parent | on HN ]