I'm the lead developer of a startup that deals with deliveries and pickups for various companies. One of these partner companies has had a website and API built for them, and with 10 years of development experience I can say that the quality is far, far below par. They sent over the API details and one of the first things I noticed was that the API doesn't use
HTTPS, which is an obvious no-no. Having raised it with the "CEO and project manager" of the development firm, I got the following response:
No, right now it's transferring via HTTP not HTTPS. You can hit these URL's via cURL. It will be more secure and fast.
Now, not everyone here will know that this response is ridiculous, but it is, and also outright wrong and dangerous. This is literally the equivalent of your bank telling you that you don't need the green padlock in your browser. We'll be sending our customer details to this API and vice-versa, so this is a massive security hole. Amongst other things that are clearly wrong with their implementation, I have serious concerns about their attitude towards security, the overall storage of the data and how they will maintain and back up this information.
So, what do I do? Our partner who has commissioned this website is valuable to our company, so we don't want to upset them or rock the boat, but on the other hand, their data (and ours!) is being handled improperly and they're not getting a good quality product. My instinct is to contact our partner and expose all the issues that is wrong with the implementation of their new and fancy API and to insist that they get resolved. Is it right for me to get involved in this?
I've discussed this with my boss and he agrees that although we should tread carefully, it is a good opportunity to strengthen our ties with this partner and help them out of what could potentially be a tight spot in the near future when their data goes bye-bye.
Is it right to bring up the bad practices of fellow professionals in your industry to a third-party like this?