121–130 of 328 posts
I am confused, they didn't contact the company at all and just disclose this publicly? Very immature handling of a vulnerability finding.
is it really a vulnerability if the entire thing is open by design?
> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.
My main beef with these menus is that I can't see the entire menu on my phone screen, and end up scrolling up and down multiple times before I can decide what I want to order. With a paper menu my eyes can flick up and down much faster. It's like trying to edit spreadsheets on a phone - technically possible but a real pain in the arse.
> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.
In Japan, many chains are using tablets for their menu, and you can order through that. That's much better than having to pull whatever from a QR code.
From technical standpoint, I find the details interesting. However, this irresponsible disclosure of vulnerability troubles me. I am guessing that last year, Indian government has passed the bill of PDPA ( https://www.meity.gov.in/writereaddata/files/Digital%20Perso... ) if I am not mistaken. Even though irresponsible disclosure of vulnerability is not explicitly mentioned in this Act, but I am pretty sure that such…
> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.
In Japan, many chains are using tablets for their menu, and you can order through that. That's much better than having to pull whatever from a QR code.
At least once you start decoding the drink section (much more consistent) then you can go back and try to interpret the rest.
Not to be a party pooper, but posting detailed financial analysis of the exact sales data of a multi-million dollar business using numbers obtained through an obviously overlooked backdoor seems like a very bad idea. Haven't people have gone to jail for less? (iirc "but it was an insecure API" has not held up in court in the past) On a more positive note, I've used a QR menu recently and it really is a game changer.…
This is the front door. It's not even open, it's taken off the hinges.
Scratch that, there never was a door in the first place, just a gaping hole right to the street.
Not to be a party pooper, but posting detailed financial analysis of the exact sales data of a multi-million dollar business using numbers obtained through an obviously overlooked backdoor seems like a very bad idea. Haven't people have gone to jail for less? (iirc "but it was an insecure API" has not held up in court in the past) On a more positive note, I've used a QR menu recently and it really is a game changer.…
Earlier quoted context omitted.
In Japan, many chains are using tablets for their menu, and you can order through that. That's much better than having to pull whatever from a QR code.
A nice middle ground yet that tablets can be costly for restaurants to implement and maintain
Of course, all the downsides are the very reason restaurants are switching to digital menus in the first place, which is something people need to be reminded of. In cases of "I can't believe they replaced a perfectly good X with inferior but 'modern tech' Y", the surprise is usually the person not realizing the vendor is adversarial, and Y is giving some extra benefit to them at the expense of the customer.
Earlier quoted context omitted.
Is it a vulnerability when it is obvious the company do not care about security?
Yes. Because who at the "company" does even know about this? Maybe just some coder who wrote it. But the legally liable CEO? Maybe not.
> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.
In Japan, many chains are using tablets for their menu, and you can order through that. That's much better than having to pull whatever from a QR code.
- staff can keep the menu up to date, basically realtime (they have to do it tho)
- orders can directly land in the kitchen instead of through the waiting staff, which may or may not be coming
- payment can also be done thst way
Of course there are more advantages for the restaurants that may or may not go counter to the interests (or rights!) of their customers. E.g. the ability to easily build profiles and sell that data to the highest bidder.
There are downsides too:
- digital menus can fail more easily than paper menus
- congrats you are a waiter, and now IT-support as well
- customers without phones, no/sucky internet or devices that fail to display the menu are out of luck, so you have to provide offline alternatives/own devices that need their own maintenance
- options that are not in the menu and fields that are not offered cannot be filled, e.g. can be a problem if you are allergic rtc.
- unpersonal. Most people prefer not having to jump through hoops.
Using a tablet that is provided by the restaurant can aleviate many (but not all) of these issues.