Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I reverse engineered McDonalds’ internal API

twitter.com

Post reply on HN
Print view View original

41–50 of 454 posts

Re: I reverse engineered McDonalds’ internal API

#41

Post by Nextgrid »

ceejayoz wrote: post #31
RcouF1uZ4gsC wrote: post #19

Earlier quoted context omitted.

> I'm currently placing an order worth $18,752 every minute Agree with you that this seems actively malicious, and because of the dollar amounts involved, is liable to get him in big trouble.

The McDonalds app lets you place an order, but you have to check-in (via the app) when you arrive to pick it up. They don't start preparing anything until you do that; you can cancel, change stores, adjust order, etc. up until the "I'm here" button is hit.

In this case this seems perfectly valid and nobody is being hurt.

Re: I reverse engineered McDonalds’ internal API

#42

Post by dylz »

jawns wrote: post #30

Some details here: https://www.producthunt.com/posts/mcbroken A commenter asks: "How are you funding the $18k per minute this requires?" He replies: "I'm actually not paying for it! just placing an order." I'm not sure how he's placing an order without payment information, or if he is providing payment information, how he's managing to not get charged for successful orders (when the ice cream machine is not broken).…

McD app does not post txn until you arrive at location and tap check in (GPS "enforced"; if you don't send a reasonable location to the backend it will tell you to just show your phone to a cashier and fail it)

that being said - this is probably irrelevant, because you don't actually need to place an order. mcflurries will show up as not available / disabled if the restaurant is not accepting ice cream orders (to disallow you from adding to cart on the official app).

you just poll for snack/side items available at location, nearly a single call. you do not need to place an order, and you do not need to draft an order, or preauth. it's just viewing the menu

Re: I reverse engineered McDonalds’ internal API

#44

Post by eitland »

nsxwolf wrote: post #26
Wingman4l7 wrote: post #13

Earlier quoted context omitted.

No, I think they're referring to the part where Aaron was "made an example of" by an overzealous prosecutor.

Well they did throw in "RIP". Which can be used in a non-literal way, but considering the context here...

The RIP part might point at Aaron.

Re: I reverse engineered McDonalds’ internal API

#45

Post by jawns »

533474 wrote: post #21

He wouldn't have tweeted it if it was malicious -- he could have even kept it secret. What is it with HN? little pranks, reverse engineering, vulnerabilities, free ice-cream. I do not condone crime but let's be honest, he could have made money with his findings online...the person is just letting his curiosity go wild. If Yelp wants to fire him I'd take him in my company any day.

You probably have a different definition of malicious than most of us.

What you're thinking is, "Did he do this to break things at McDonald's or actively hurt them in some way?"

But if he's hitting an internal API and creating a bunch of fake orders for the purpose of gathering data, that's malicious, whether or not it breaks anything on McDonald's side.

Re: I reverse engineered McDonalds’ internal API

#46

Post by Ragnis »

swarnie_ wrote: post #17

The link is already down.... Who has an archive?

It seems that Twitter doesn't always work on Firefox. The Tweet says:

> I reverse engineered mcdonald's internal api and I'm currently placing an order worth $18,752 every minute at every mcdonald's in the US to figure out which locations have a broken ice cream machine

Accompanied by a link to https://mcbroken.com/

Re: I reverse engineered McDonalds’ internal API

#48

Post by jawns »

ceejayoz wrote: post #40
jawns wrote: post #30

Some details here: https://www.producthunt.com/posts/mcbroken A commenter asks: "How are you funding the $18k per minute this requires?" He replies: "I'm actually not paying for it! just placing an order." I'm not sure how he's placing an order without payment information, or if he is providing payment information, how he's managing to not get charged for successful orders (when the ice cream machine is not broken).…

> Perhaps the payment doesn't go through until he arrives to pick up the order? Correct, and the order doesn't start being prepared until you hit the "I'm here" button on the app, either. I once forgot to hit "I'm here" and they were confused because, to the store, it didn't exist, so there's no harm to the stores at all here.

> so there's no harm to the stores at all here

Maybe not in terms of them preparing the food ahead of time and not getting paid for it.

But there's substantial potential for harm if this clogs up the ordering system and affects their ability to fulfill other orders.

Re: I reverse engineered McDonalds’ internal API

#49

Post by wnissen »

Just a note, the machines are not broken, they have shut themselves down for sanitary reasons. Ice cream, as a food that is very close to neutral in pH and without much in the way of preservatives, is a common source of listeria bacteria. To prevent serious health issues, the machine must be sanitized regularly. As I understand it, the process is involved, and any given McDonalds may not have a person with the time and skills to complete it. So the machine shuts itself down rather than produce an unsafe product. This is translated to "broken" when you order ice cream.
Post reply on HN