Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's inside the QR code menu at this cafe?

peabee.substack.com

Post reply on HN
Print view View original

171–180 of 328 posts

Re: What's inside the QR code menu at this cafe?

#171

Post by komali2 »

mpeg wrote: post #161
krsdcbl wrote: post #153

Earlier quoted context omitted.

Fully agree with you! The API being unauthd is clearly a core design choice, and finding out any customer or service data is openly accessible with consecutive numbers through that API is not a zero day or something. There is no "responsible disclosure" to be made here, going to the company and explaining what's the issue with all of this amounts to "handing out free consulting" if anything

Unfortunately that is not how the law works, at least in most countries. As soon as you enumerate ids regardless of whether there is any security in place it is unauthorised access and it's illegal.

Right, I believe they're posting as if the ethical standpoint is normalized, to further highlight the absurdity and injustice of the current legal framework.

Re: What's inside the QR code menu at this cafe?

#172

Post by ffsm8 »

qnleigh wrote: post #83

> I would have thought about privately disclosing these findings to Dotpe. But all the API requests are right there in plain sight... There are pretty common ethical standards about disclosing vulnerabilities privately before disclosing them publicly. I don't see how the obviousness of the vulnerability changes the situation. By warning the company, you give them the opportunity to remedy the problem before announcin…

> 37,529 restaurants use Dotpe for QR codes.

At that scale, it would take years to get fixed without forcing it like this.

It's too small for them to care about the liability of security and too large to move quickly

Re: What's inside the QR code menu at this cafe?

#173

Post by mihaaly »

rapnie wrote: post #13

> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.

Same here. I am even reluctant scanning any QR code and taking me to random web pages connecting my phone - and since phone is an extremely personal device, pratically an ID, so myself - to that place and time. I am not a fan of being traced, surveillanced more than avoidable, especially not fan of triggering it myslef. Giving away additional dat on myself on top of that. No thank you. And this is before considering the system exploiting the vulnerabilities of my device, insted of the other way around shown in the writing. I left a place because of their QR code primary order system. Waiters came around taking order the old fasioned way, but only in the gaps of serving the QR orders. No thank you.

Re: What's inside the QR code menu at this cafe?

#174

Post by aitchnyu »

appendix-rock wrote: post #17
lordgrenville wrote: post #4

Earlier quoted context omitted.

The author says "I refuse to believe they’re unaware of this. This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care." Agree that this is an uncharitable way of looking at it.

Yep. It’s just working backwards from some pre existing very negative worldview.

Its a justifiable worldview. I'm an Indian dev and I've seen obvious backdoors like these added to the backlog as a low priority bug. If somebody spends time on this, that means features are being delayed and you are rewarded less.

I've worked in lambda web editor (not in Git) and my lead considered replacing sql injection with parameterised queries was a distraction/insubordination. Cant wait till audits, data breach insurance and imprisonment becomes the reality.

Re: What's inside the QR code menu at this cafe?

#175

Post by n4r9 »

Freak_NL wrote: post #132
Shywim wrote: post #87

Earlier quoted context omitted.

I think that works out if you are alone, if you are with other people, the waiter will probably interrupt the socialization you are doing with the people you are with, causing stress even for the waiter. Also we should recognize that the waiter is often looked down at, it is not a very nice job, and as a human being, having a poor experience with some customers will probably pass on to other customers, etc... I'd go…

Having a waiter come over for ordering causes stress? The whole point of going out for drinks or food is not having to prepare it yourself and having someone else do the dishes. Depending on the venue getting waited on is a feature, not an inconvenience. If interacting with the people facilitating that is stressful I would recommend finding a bench near a vending machine, having someone else in your party handle the…

The food is still prepared to restaurant standard and brought out by waiters. The dishes are still done by someone else. You just skip the awkward, inefficient, and disruptive step of the waiter coming up to your table (or worse, having to flag them down) to order, order more drinks, ask for the bill, pay for the bill, etc...

Re: What's inside the QR code menu at this cafe?

#176

Post by hnbad »

Looks like the article was deleted and purged from archive.org. I wonder if anyone saved a copy elsewhere?

From the comments it seems likely the author realized they may have accidentally committed a crime or at least done something that could cause real legal consequences for them and quickly destroyed the evidence. That's probably better than leaving it up but I'd wager it wouldn't protect them from any legal consequences publishing the article already made possible.

Re: What's inside the QR code menu at this cafe?

#178

Post by mihaaly »

frereubu wrote: post #118
rapnie wrote: post #13

> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.

My main beef with these menus is that I can't see the entire menu on my phone screen, and end up scrolling up and down multiple times before I can decide what I want to order. With a paper menu my eyes can flick up and down much faster. It's like trying to edit spreadsheets on a phone - technically possible but a real pain in the arse.

At least the screen is only touced by you. My peril are the touch screen ordering places (practically all fast food places nowadays) where based on their outlook hygienically challanged persons swipe their fingers up and down for long before you have a chance following them. There is an icecream place opened nearby I had no chance trying because they only have touchscreen order. Guys at the till only serve icecream and all orders must go through the touch screen. They put the icecream into a cone - if you dared to ordered so - and put into the fingers of the customer who just swiped the same finger over a screen swiped by dozens of unknow people before. Oi!

Re: What's inside the QR code menu at this cafe?

#179

Post by mihaaly »

glandium wrote: post #104
rapnie wrote: post #13

> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.

In Japan, many chains are using tablets for their menu, and you can order through that. That's much better than having to pull whatever from a QR code.

I Japan, with their obsession about cleanliness, I can imagine that those tablets are thorougly wiped between each customer. But not in other countries.

Re: What's inside the QR code menu at this cafe?

#180

Post by peoplefromibiza »

PUSH_AX wrote: post #144
peoplefromibiza wrote: post #134

Earlier quoted context omitted.

> there are clear and concrete metrics that tell the story of large improvements to service Covid is the most disrupting global event of the recent human history I bet it had a quite larger impact than a simple QR code, assuming what you say it's true. > You're hyper focused on the ideal situation Am I? I know that for a diner to serve me at a table it can't take less than 20-30 minutes or I am eating literal dog shi…

> Am I? I mean, yeah.. You've even done it again. Outlining situations with perfect service. That's great, now think about the original problem statement where service becomes a bottle neck, and no "if you want great fast service just go elsewhere" is not an elegant solution, sorry.

> Outlining situations with perfect service

What are you even talking about?

Are you implying that QR code solutions are optimal for shitty services?

> where service becomes a bottle neck

this is a textbook example of false dilemma. If service is the bottleneck making the ordering process faster will make things worse, not better.

If anything if a place is slow to take orders, I know they'll be late on serving it I can anticipate the problem and go somewhere else, if I already placed the order now I'm stuck.

It's the same things happening at McDonalds with ordering booths, your order is very fast, the service is not and you end up wasting a lot of time in line waiting for your number.

As one of the error pages of this website states Please stop hammering. It makes the problem worse.

Thanks, but no thanks.

You're also contradicting yourself here

> where service becomes a bottle neck

> "if you want great fast service just go elsewhere" is not an elegant solution

The "service is the bottleneck but please stay here and wait until we serve you who knows when, after you placed your order" is much worse.

At least with staff taking the orders they can straight tell you "we're full, there's a wait list" or warn you that that day orders are being processed more solwly than normal and you can decide what to do.

QR code machines will place orders no matter what, but, again, people are not machines and quality has its merits, more than speediness, In my opinion.

YMMV

Post reply on HN