Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reversing Safeway's private APIs to automate coupon collection

blog.jonlu.ca

Post reply on HN
Print view View original

121–130 of 148 posts

Re: Reversing Safeway's private APIs to automate coupon collection

#121

Post by rlucas »

nyquist wrote: post #80
kelnos wrote: post #49

Earlier quoted context omitted.

> presumably that agency designed permitting system with the assumption that people with limited time and attention would be vying for the permits by having to visit the site themselves to get one. That's quite a very large assumption that I don't think we can accept as fact. > that those who register early, or are very motivated, or simply those with a lot of free time to refresh the site, will get permits. Perhaps…

I'll bite. I think you're right the agency probably didn't sit down, write down definition of fairness, then design a permitting system around it. They probably implemented the cheapest/easiest digital analog they could find to a traditional fax-in/walk-up first-come/first-served permitting system. However, the intentionality of the implementers was not central to my argument. The system was created by (probably) non…

If you want to see a world governed by a non-human understanding of fairness and one in which a highly technical cohort was entrusted to make these sorts of judgment calls, look no further than the domain industry in the early 2000s.

Specifically, consider Snapnames -- a company born out of the notion that snapping up a domain name coming up for renewal was something that was legitimately fairly awarded to the automated process that was fastest.

Re: Reversing Safeway's private APIs to automate coupon collection

#122

Post by gitgud »

withinrafael wrote: post #29

I did something similar with Safeway's API back in the day. But rather than chew up their API with unsupported usage--CFAA case territory--I now just log into Safeway's website and issue a one-liner on the coupon page: $(".grid-coupon-clip-button button").click();

This is what I was thinking the whole time reading and looking at the site images... why script all that, when you could simply click the buttons in the browser...

Rube Goldberg Machine's are not good in software projects...

Re: Reversing Safeway's private APIs to automate coupon collection

#123

Post by jmull3n »

atonse wrote: post #2

This is the kind of stuff where I tell people that coding can be a real practical skill (that gives you an unfair advantage these days). I did something similar (read-only) for Home Depot Truck Rentals. To check if the truck was available at my local store, each time, you had to put in your zip code, and click a couple of times. Once I found that was an API, I rebuilt the call in Postman and kept hitting that endpoin…

I did something similar to check if tickets are available on Resident Advisor. https://github.com/jmcmullen/ra-resell-check/blob/master/src...

Re: Reversing Safeway's private APIs to automate coupon collection

#124

Post by nucleardog »

huangc10 wrote: post #21

On a slightly unrelated note, I was trying to figure out why this guy is using a .ca domain when I realized, his name is Jon Luca. At first I thought his name was Jon Lu (and therefore asian). Good use of domain name.

Not really a good use since the .ca TLD is supposed to be reserved for Canadian entities (individuals and businesses) and the site would seem to break policy.

If it's indeed the case that he has no residency, he's one report to CIRA away from the domain cancelled.

Re: Reversing Safeway's private APIs to automate coupon collection

#125

Post by fingerlocks »

rovr138 wrote: post #77
billh wrote: post #73

Earlier quoted context omitted.

Correct me if I'm wrong, but if you're using a credit card the bank is only getting a receipt that shows the sum total of the transaction and not an itemized receipt. The club cards are consuming and tracking the data of the entire transaction.

The club card acts as unique id to track you. The credit swiped at the machine has a unique id that they can use to track you. The club card works across multiple credit cards and cash. That’s the main difference. And you might possibly track 2 people who control the household (wife gets one, husband gets one)

Using Apple Pay would circumvent the CC tracking because it only transmits a one-use number.

Re: Reversing Safeway's private APIs to automate coupon collection

#126

Post by bigwavedave »

samstave wrote: post #85
Someone1234 wrote: post #44

I enjoyed the article and would recommend it. Aside: At the end of the article they have a "Bonus: Speeding things up" section where they automate adding 300~ coupons via 300 HTTP connections in 5 seconds (instead of 60~ seconds). In my opinion if you're going to automate stuff like this, you should do so with the goal of minimizing disruption (and frankly, detection). They run the script automatically at midnight in…

Totally, and plus, it runs at midnight, and people aren’t going to be shopping so early in the morning... so span it over 6 hours. At least.

While I agree with spanning it over six+ hours, you might be surprised at the activity level in shopping centers at midnight. Once upon a time, I worked nightshift at walmart stocking shelves- on my days off, I'd still have to be awake all night to maintain a sleep schedule. To retain my sanity, I'd shop at other grocery stores so it didn't feel like I lived at walmart, and I was pretty surprised by how many shoppers were out and about at 1 and 2 am at stores like Ridley's or Smith's.

Re: Reversing Safeway's private APIs to automate coupon collection

#127

Post by stordoff »

huangc10 wrote: post #21

On a slightly unrelated note, I was trying to figure out why this guy is using a .ca domain when I realized, his name is Jon Luca. At first I thought his name was Jon Lu (and therefore asian). Good use of domain name.

I saw someone use this for their email address a few years back. Say their name was Jane smith (anonymised for obvious reasons), their email address was j@nesmi.th (actually using a .ch domain).

Re: Reversing Safeway's private APIs to automate coupon collection

#128

Post by lucasverra »

punnerud wrote: post #66
dfxm12 wrote: post #17

When I see access to private API's like this, I wonder how judges would interpret these actions as they relate to the CFAA. By accessing "private" API's like this, are you knowingly accessing a computer without authorization? Are you exceeding your authorized access? The fact that Aaron's Law never went through has disturbed me...

In EU you are allowed to automate everything you legally can do manually, even if they have a large sign on their page saying that automation is not allowed. The only thing that is limiting you from selling is copyright, but by-products from ordinary business is always legal.

any reliable legal source for that ? thanks

Re: Reversing Safeway's private APIs to automate coupon collection

#129

Post by Mister_Snuggles »

huangc10 wrote: post #102
Mister_Snuggles wrote: post #92

Earlier quoted context omitted.

I'm in Canada and shop at Sobeys, which owns the Safeway brand up here, thought there might be some relevance to me thanks to the .ca domain name. Unfortunately, there was no relevance but it was still an interesting read. On a side note, Safeway and Sobeys in Canada don't have a loyalty program, instead they piggy back off of Air Miles. All of the special offers available just amount to bonus Air Miles, so they're n…

What a blast from the past. I am actually Canadian but have been living in the Bay Area for over 10 years so I've already forgotten that you can collect Air Miles through Safeway (which was why I clicked on this article in the first place thinking of the .ca) I don't think Air Miles are completely useless. I do remember redeeming air miles at least once in the past for a one-way trip somewhere...

They're not completely useless, but I do find that I don't seem to get much benefit from them.

For example, I needed to rent two cars on a trip last year. The first car I was able to rent through Air Miles, but I had to pay the taxes and any fees beyond the base price myself so it didn't feel like much of a deal. The second car required more Air Miles than I had, so I had to pay for the whole thing myself, I couldn't do part on Air Miles and part cash.

I ended up renting the second car through Costco and felt like I got a better deal overall than I did with the first car.

Maybe rental cars aren't the best way to use them.

Re: Reversing Safeway's private APIs to automate coupon collection

#130

Post by wcip »

stordoff wrote: post #127
huangc10 wrote: post #21

On a slightly unrelated note, I was trying to figure out why this guy is using a .ca domain when I realized, his name is Jon Luca. At first I thought his name was Jon Lu (and therefore asian). Good use of domain name.

I saw someone use this for their email address a few years back. Say their name was Jane smith (anonymised for obvious reasons), their email address was j@nesmi.th (actually using a .ch domain).

I own locutusofb.org a similar idea for any Trek fans.
Post reply on HN