Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Doorman's Fallacy in action

rozumem.xyz

Post reply on HN
Print view View original

121–130 of 326 posts

Re: The Doorman's Fallacy in action

#121

Post by sublinear »

darth_avocado wrote: post #118
sublinear wrote: post #109

Earlier quoted context omitted.

> equating ocasional inconveniences to what the entire experience was This was highly dependent on the neighborhood you lived in. It still is to some extent. Full service is still around, but I wouldn't expect that in "the bad parts of town". You do not want those people doing those jobs, but now we're really heading somewhere politically incorrect and touching on systemic inequality.

> those people I had assumed you have certain views about people in the service industry. This sounds a whole lot worse.

What's the point of discussing this if you're going to insist on reading everything in bad faith? You know very well I'm speaking from experience. Go ask anyone else who lived in that kind of place at that time. It's where the run down Walmart and McDonald's still are. That's where self-checkout was born.

You are trying to advocate for the disadvantaged who might work those kinds of jobs longer term, yet you don't understand those people. You do not understand the valid concerns of the shoppers at those stores either who had little alternative. You're complaining about self-checkout, but it's the same machines they worked with for at or near minimum wage. The way you get angry is the way they'd get angry too after a full day of that every day. As I said, you do not want those people doing that job.

I don't regret any of what I said, but I regret adding to yet more of this noise on HN. I tried to have productive conflict by sharing my perspective, but there's no substance left here.

Re: The Doorman's Fallacy in action

#122

Post by f17428d27584 »

alex43578 wrote: post #97
EvanAnderson wrote: post #65

Aside re: restaurant technology: In a restaurant a year ago with "pay via your phone" service. Server gave us a receipt w/ a QR code. I scanned the code, copied the URL to my clipboard, and looked it over. There was a base64 blob on the URL. I decoded it (because Termux and I'm a nerd) and saw obvious parameters I could fuzz. I changed the check ID (incremented it), left the store ID alone, re-encoded it, and found I…

That’s such a benign vulnerability that it doesn’t even feel like one. Per your description, the worst thing an attacker can do is see the food ordered to a check number (in a public restaurant) and pay a bill that isn’t their own? On the flip side, some services go absolutely overboard trying to secure low-blast-radius things, or don’t properly scale security to the risk of an activity. I have a service provider tha…

Enumeration vulns are very serious, it’s just luck that this one appeared to be low risk.

Re: The Doorman's Fallacy in action

#123

Post by swader999 »

f17428d27584 wrote: post #122
alex43578 wrote: post #97

Earlier quoted context omitted.

That’s such a benign vulnerability that it doesn’t even feel like one. Per your description, the worst thing an attacker can do is see the food ordered to a check number (in a public restaurant) and pay a bill that isn’t their own? On the flip side, some services go absolutely overboard trying to secure low-blast-radius things, or don’t properly scale security to the risk of an activity. I have a service provider tha…

Enumeration vulns are very serious, it’s just luck that this one appeared to be low risk.

A competitor of the restaurant could see everything that was ordered that night. Pretty serious imo.

Re: The Doorman's Fallacy in action

#124

Post by zmgsabst »

swader999 wrote: post #123
f17428d27584 wrote: post #122

Earlier quoted context omitted.

Enumeration vulns are very serious, it’s just luck that this one appeared to be low risk.

A competitor of the restaurant could see everything that was ordered that night. Pretty serious imo.

Or profile the customers of every business, by changing both IDs.

Re: The Doorman's Fallacy in action

#125

Post by whateveracct »

devindotcom wrote: post #3

My favorite version of this is robotic and drone-based package delivery. In many ways it could be useful and add efficiency to a congested system. But then you find out just what it is that delivery people actually do, the variety of security systems, steps and walkways, exceptions to rules, and so on and realize that what drones and robots automate is not really "the job" at all. The last mile, in logistics, hospita…

last mile in software is real too!

Re: The Doorman's Fallacy in action

#126

Post by zenpe »

EvanAnderson wrote: post #65

Aside re: restaurant technology: In a restaurant a year ago with "pay via your phone" service. Server gave us a receipt w/ a QR code. I scanned the code, copied the URL to my clipboard, and looked it over. There was a base64 blob on the URL. I decoded it (because Termux and I'm a nerd) and saw obvious parameters I could fuzz. I changed the check ID (incremented it), left the store ID alone, re-encoded it, and found I…

This reminds me of how often "digital transformation" in hospitality introduces naive security architectures. ID enumeration vulnerabilities on restaurant QR codes are surprisingly common because these systems are often rushed to market by low-cost agencies.

While some might argue it's a "low-blast-radius" bug because an attacker can only view orders or pay someone else's bill, the data privacy implications are massive. Scraping that endpoint allows anyone to profile the restaurant's entire customer base, revenue flow, or busy hours. It's the classic side effect of replacing a robust human process with a poorly audited software layer.

Re: The Doorman's Fallacy in action

#127

Post by __jf__ »

Gay Talese starts "The Kidnapping of Joe Bonanno" (Esquire, August 1971) with this:

Knowing that it is possible to see too much, most doormen in New York have developed an extraordinary sense of selective vision: they know what to see and what to ignore, when to be curious and when to be indolent—they are most often standing indoors, unaware, when there are accidents or arguments in front of their buildings, and they are usually in the street seeking taxicabs when burglars are escaping through the lobby. Although a doorman may disapprove of bribery and adultery, his back is invariably turned when the superintendent is handing money to the fire inspector or when a tenant whose wife is away escorts a young woman into the elevator—which is not to accuse the doorman of hypocrisy or cowardice but merely to suggest that his instinct for uninvolvement is very strong, and to speculate that doormen have perhaps learned through experience that nothing is to be gained by serving as a material witness to life’s unseemly sights or to the madness of the city. This being so, it was not surprising that on the night when the reputed Mafia chief, Joseph Bonanno, was grabbed by two gunmen in front of a luxury apartment house on Park Avenue near Thirty-sixth Street, shortly after midnight on a rainy Tuesday in October, the doorman was standing in the lobby talking to the elevator man and saw nothing.

Re: The Doorman's Fallacy in action

#128

Post by makeitdouble »

> But when 6 people simultaneously tried to pay their share of the bill, chaos ensued.

Hasn't that been a fact of life ?

If anything, apps made it barely made easier through splitting either the whole bill equally or offer a bit by bit checking interface.

Otherwise on the role of QR codes and online menu, it actually helps a lot for allergies as everyone can check their for each individual item and adjust accordingly.

Of course one can ask the waiters, but many aren't just competent (ask for wallnut allergy, and they'll come back explaining there's no peanuts). And doing the back and forth on which menu has what allergy is also a PITA, with all the other guests just waiting for it to end.

Re: The Doorman's Fallacy in action

#129

Post by el_io »

rmunn wrote: post #115
alex43578 wrote: post #97

Earlier quoted context omitted.

That’s such a benign vulnerability that it doesn’t even feel like one. Per your description, the worst thing an attacker can do is see the food ordered to a check number (in a public restaurant) and pay a bill that isn’t their own? On the flip side, some services go absolutely overboard trying to secure low-blast-radius things, or don’t properly scale security to the risk of an activity. I have a service provider tha…

Eh, there could be privacy implications. E.g. you see someone in the restaurant whom you know, and you know he is not supposed to be drinking alcohol (for whatever reason: maybe his religion forbids it, maybe there's a medical reason for it such as a prescription drug he's on that really should not be mixed with alcohol, the reason doesn't really matter in this example). You see that he was served a pork chop with a…

I mean I cloud just go over there and see it.

Normally I've not seen any bill that includes the identity of the customer, so it can't be even used as proof.

Re: The Doorman's Fallacy in action

#130

Post by recursivecaveat »

If you remember that hotel chain Sonder which went bankrupt last year, they had a zero-local-employees model: no front-desk, outsourced maintenance and housekeeping. I think they made the same mistake. Your typical interaction with the hotel receptionist is extremely formulaic. Many other hotels have replaced the sign-in process at least with a machine. That's most prominent in your mind, so its easy to assume that's where most of the value comes from.
Post reply on HN