14 ms·
Quora engineers accused of vandalizing a clone’s website
- nbpoole 16y agoThe full quote from Rick Ross is "I am grateful that Ben Newman and Albert Sheu of Quora have identified a (now fixed) XSS vulnerability in our test site, but I am surprised that Quora policy permits developers to engage so openly in vandalizing other people's websites." which is slightly nicer than that article makes it sound. Personally, I think the Quora engineers involved made some poor decisions. Anyone who looks for security vulnerabilities on websites they don't own or control is on shaky legal footing (there are exceptions: Google, Mozilla, Facebook, and a few other companies provide systems for the responsible disclosure of vulnerabilities). However, publicly disclosing vulnerabilities on a competitor's website (and making your proof of concept mildly malicious) is never going to work out well for anyone: it makes your company look like a bully and exposes you to potential legal ramifications.
- rokhayakebe 16y agoOr exposes you to a group of individuals who will want to make you regret showing off.
- dacort 16y agoAs a former web application security guy, and now developer, identifying and disclosing vulnerabilities on websites is still very much a troubled area. Most companies don't have proper security@ email addresses set up or monitored, and still don't take kindly to vulns being reported. That said, publicly disclosing a flaw in addition to defacing the website, even temporarily, is certainly not a classy way to go about it.
- shalmanese 16y agoOriginal Quora thread: http://www.quora.com/Is-Qato-a-Quora-clone-attempt-or-a-similar-looking-Q-A-site/all_comments/Ben-Newman http://www.quora.com/Is-Qato-a-Quora-clone-attempt-or-a-simi...
- phlux 16y agoI've had a couple of my comments on Quora vandalized by engineers there as well, marking a few of them "unhelpful" even! :P
- mgrouchy 16y agoI certainly don't think the Quora Engineers were right to vandalize the clones website in this case. I'm all about people making Q/A websites and releasing products that are clones of other products. Ideally this kind of competition can make the original product better. That being said, I find making a clone of someones product and then releasing said product at least in this sense, distasteful. Seeing that it has such similarity to the original that if you weren't familiar with the original you probably couldn't tell the difference.
- joshu 16y agoDesign clones are super lame.
- hackinthebochs 16y agoWhy? What separates design clone vs functionality clone, making one legitimate and the other distasteful?
- BenSchaechter 16y agoFrom the comment thread: "So Qato was caught plagiarizing and now they're complaining about supposed "vandalism"? Reminds of those newspaper headlines where the robber hurts himself breaking into a home and tries to sue the family." I have to agree. This is basic javascript injection. Can you say, "blown out of proportion"?
- strebel 16y agoDon't condone it, but understand their motivation. Knockoff's are kinda out of hand of late.
- bravura 16y ago[edit: Troll answers have been deleted, but you can still read the trolling comment thread: http://www.quora.com/Is-Qato-a-serious-Quora-clone-attempt/all_comments/Ben-Newman http://www.quora.com/Is-Qato-a-serious-Quora-clone-attempt/a... and http://www.quora.com/Is-Qato-a-serious-Quora-clone-attempt/all_comments/Samuel-Codsaw http://www.quora.com/Is-Qato-a-serious-Quora-clone-attempt/a... ] On the Quora thread, http://www.quora.com/Is-Qato-a-Quora-clone-attempt-or-a-similar-looking-Q-A-site http://www.quora.com/Is-Qato-a-Quora-clone-attempt-or-a-simi... there are some answers by trolls pretending to represent Qato. "Sameul Codsaw" writes: 'Also, we are using Ruby on Rails, so we expect to have less trouble scaling and finding devs than Quora has.' Rick Ross, president of DZone (developers of OSQA and Qato), replies in the comments: 'This imposter has no connection with Qato and does a disservice to both Quora and DZone by posting this nonsense.' "Kevin McDougal" answers and comments, also trying to make DZone look bad. ("Rick, our plan to sabotage the Quora community is working. Did Hernani create the 100 fake Quora accounts yet?" ... "Hold on. Was that message private or public?") It's pretty juvenile and makes me question the quality of the Quora moderation system. Why are there all these sock puppet accounts (http://www.quora.com/Kevin-McDougal http://www.quora.com/Kevin-McDougal and http://www.quora.com/Samuel-Codsaw http://www.quora.com/Samuel-Codsaw) popping up and pretending to represent Qato? They have only one answer on the entire site, and its on this thread. Are Quora engineers behind these trolls, or who? Regardless of who is behind it, the trolling reflects poorly on Quora, not Qato. The comments by Ben Newman (Quora dev) honestly are quite juvenile, and do a disservice to Quora, regardless of any ethical considerations on the part of Quora or Qato. I would prefer to see him take the moral high road.
- joshu 16y agoQuora has a lot of passionate users.
- Stormbringer 16y agoI'm curious why, does anybody know? After looking at Stackoverflow I considered technical Q&A a solved problem, and it seems to translate well to other topics.
- jrockway 16y agoVandalism is a stupid word to use. I imagine the process went something like this: "I wonder what happens if I add <script>$.fadeOut() as the text of the question" "Oh crap, it worked". This is called experimentation. If you're in chemistry class and you mess up a lab, you're not accused of vandalizing apparatus... it's simply what happens when you are trying something out. Similarly, when you have a text box on a test website, someone is going to type something in, and if that causes the page to disappear, well... fix the bug and move on.
- pak 16y agoYour chemistry class example is nonsensical. In class, if there is an opportunity to explore a few things and a mess is made, maybe you would not be blamed. That's usually not how labs are run--you follow a procedure and mixing chemicals with no forethought is a huge safety hazard to everybody in the lab. Neither the "real world" nor the Internet is a place with a mutual agreement between all participants to experiment with each other's property. Maybe a better example would be going into your neighbor's backyard and testing how readily his shrubbery lights on fire. Oops, it's burning! Tell him to "fix the bug" and move on.
- jrockway 16y agoMaybe a better example would be going into your neighbor's backyard and testing how readily his shrubbery lights on fire. Oops, it's burning! Tell him to "fix the bug" and move on. No, a better example is going into your backyard, shining a flashlight onto your neighbor's shrubbery, and then having the neighbor complain to you about changing the shrubbery's color from black to green. The protocol for a shrub is: you shine light on it, it reflects light back. The protocol for a public web service is: you send it an HTTP request, it sends an HTTP response. If you don't want your neighbors to see your shrubbery, build a fence. If you don't want your website to contain arbitrary scripts, don't let users submit arbitrary scripts.
- notahacker 16y agoLet's not forget the Quora engineers are working for what is (in the very loosest sense of the word) a competitor. If we're doing silly analogies, it's the equivalent of Starbucks sending their staff round to your new cafe with Groupons leaving no coffee or seats for the real customers and then publicly mocking your staff's incompetence in handling the situation. Sure, it's your fault for running the promotion and not buying enough coffee, but you might still consider BigCorp's behaviour a little underhand.
- joshu 16y agoI just left the following comment: -- It's pretty lame to copy the design and trade dress of another product. It does not bode well for your skill or ability. Backstory: A long time ago I wrote Delicious. We had hundreds of copycats and competitors. The ones that weren't direct copies were the ones that did better. I'm sure this doesn't apply to you for whatever reason.
- deleted 16y ago[deleted]
- rudiger 16y agoIf Qato is going to copy someone's design, can't they find something better than Quora? I mean, Quora's design isn't going to win them any awards; it looks like Quora didn't even use Photoshop, just straight-up CSS.
- joshu 16y agoBecause they are unoriginal followers. If they had any sense of direction they'd be able to build something of their own.
- joshu 16y agoOk. I know it's against the rules, but why is this getting voted down? This comment comes from my experience (see above) rather than mere negative opinion.
- rhizome 16y agoOriginality is overrated. Various sites with CSS-only layouts and minimal interfaces are best described as an emergent aesthetic. Expect more like this. There are simply too many people drawing from the historical experiences and examples laid by e.g. Metafilter, Digg, image boards, etc. for it to consititute individual acts of copying. That there are so many whitelabel apps & plugins ready for the implementing only accelerates this evolution.
- 16y ago
- famousactress 16y agoEveryone's right that it was an ill-advised thing to do, but stepping back ignoring the law (I know..) and just asking yourself the gut question: What's worse? injecting a relatively harmless script into the product (that frankly caused them to fix an issue that could have been very painful for them if someone more devious had found it first), or Qato's ripoff of Quora in the first place?
- nbpoole 16y agoPutting the legal issues aside? It doesn't matter either way: security vulnerabilities trump copycats (in my opinion). Publicly releasing details of an XSS vulnerability on a third party's site has much bigger ramifications than a copycat site. Plenty of websites deal with copycats all the time: they're frustrating, but they're not necessarily overly threatening. On the other hand, a 0 day could compromise the security of user information. In certain fields, that could completely destroy your business.
- famousactress 16y agoMixed agreement. ...that could completely destroy your business Yep.
- bigiain 16y agoFor what it's worth, my takeaway on this is not that Qato "ripped off Quora", to me its quite clear they're building an engine for Q&A websites, and they've used Quroa (and Stackoverflow) as examples of what you can build with it. Not so much "ripping off" - I see it more like the sort of Photoshop demo where a guy on stage recreates some well known image to show off Photoshop as a tool. The problem is, their tool has at least one xss vulnerability. I've been there myself, and usually a single xss vulnerability is an indication that the underlying design of the system didn't take xss (and probably web security in general) seriously enough. It's _possible_ this was just a single place where user supplied data sanitisation wasn't done correctly, but I'd bet good money that it's indicative of a development mindset that failed to be paranoid enough. I'll bet there's a bunch of places they're going to find exactly the same error, and won't be at all surprised to find SQL injection vulnerabilities, http header vulnerabilities, and any of a whole bunch of other "common web programming" errors. I'll be amazed if right now there aren't a bunch of people running fuzzers against any site suspected of having the Qato "engine" underneath it. I'll not be at all surprised to hear several of them get compromised before the weekend and start running dick-pill-seo spam...
- fmavituna 16y agoSame thing happened in my friend's company and they fired the engineer who identified and exploited the permanent XSS in their competitor's website. Personally I would do the very same thing. 1. It's against the law 2. Extremely unprofessional and childish 3. There are better ways to report security vulnerabilities
- nbpoole 16y agoI sincerely hope that's not what happens here. I would hate to see someone lose their job over what seems to have been a temporary lapse in judgement.
- desigooner 16y agoSame here. But for developers who've worked at organizations like Mozilla in the past, you'd think they'd be better at handling this the way it should be rather than going script kiddy and juvenile on their own site.
- rhizome 16y agoTemporary lapses in judgement are exactly what "fireable offenses" are designed to prevent. Bright lines for tolerable acts, especially in regards to outside resources, help everybody know how to stay on the good side of management. By way of example, some years ago a story went around about HP support being prohibited from suggesting a user adjust their BIOS. This was back in the day when checking BIOS to see if hard drives, ports and RAM were being detected properly (say, Win98 era), but for HP it was a fireable offense. It may not have resulted in the death of any user's computer in any given instance, but the risk of problems was great enough that they couldn't allow support people to deviate from the troubleshooting matrix in this way. In this case it seems more a problem of ethics than policy, and no doubt Quora is not very large of a company and does not yet have stringent policies like HP's, but to argue "no harm no foul" is to set a bad precedent at the peak of a slippery slope.
- teaspoon 16y agoIt's against the law? Where?
- rickross 16y agoJust for the record, I meant it sincerely when I said that we were grateful that Ben Newman and Albert Sheu showed us an XSS hole in Qato, and that has now been fixed. The site in question was just an unpromoted testing prototype which barely has any content and happened to have the Quora-like skin on at that moment. It probably shouldn't even have been publicly accessible. Another Qato site on the same server is http://robofaqs.com http://robofaqs.com, which is sporting our OSQA clone theme. It doesn't look anything like Quora at all, but is powered by literally the same server instance. That's what we're trying to say - Qato is the general purpose Q&A engine under the skin, and these various skins just modulate the way a Qato site looks.
- jasonkester 16y agoFYI, underlined hyperlinks make it impossible to tell the difference between a "q" and a "g" in a URL. As such, I'd suggest you spend some time finding a better name for that unfortunately named site you linked.
- nbpoole 16y agoSo I take it you're not a fan of http://www.gamefaqs.com http://www.gamefaqs.com ? ;-)
- potatolicious 16y agoGamefaqs has a self-describing name that pertains to their main business (Game. FAQs.) Qato doesn't have the same thing going for it.
- shalmanese 16y agoDid robofaqs have the same vulnerability? If so, that's a way bigger story than this brouhaha.
- bigiain 16y agoJust a quick note - these "assurances" that the Quora-like skin was just a prototype doesn't do anything to allay my suspicions that the xss vulnerability is probably a core issue with the "general purpose Q&A engine" underneath it. If you're relying on the "skin" to enforce xss security, you don't really understand the importance of the various bits of MVC.