Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reversing Safeway's private APIs to automate coupon collection

blog.jonlu.ca

Post reply on HN
Print view View original

141–148 of 148 posts

Re: Reversing Safeway's private APIs to automate coupon collection

#141

Post by chrisacky »

cjslep wrote: post #101

This reminds me of a very similar case a decade ago I never figured out. Anyone remember Coupon Guy from 4chan in the 2009/2010 timeframe? You could make your own "Buy 1 Get 1 Free" or variant (for both N, "buy 1 get 10", or for kind of coupon, like "buy 1 get half off") Tv, Xbox 360, near anything etc. For Walmart, Best Buy, other chains etc. The tools were passed around stegonographically in the instruction images.…

If I had to guess it would be something such as concatenating a bar code.

In UK, we have items which when reduced all they do is add the new price to the end of the bar code.

ie. If some product is barcode of 3035555074225 and it's then reduced in price, the reduction including some checksum is added.

So, if the new price of 3035555074225 is 50p, the code becomes 303555507422500502 (Where we add 0050 for the price, and 2 is the checksum).

Next time you are in the supermarket just look at the barcode and you'll spot the pattern.

So for your example, maybe there was some EPOS system that the guy had inside understanding of how barcodes worked on coupons and could easily pair them.

Re: Reversing Safeway's private APIs to automate coupon collection

#142

Post by Larrikin »

pravda wrote: post #104
bredren wrote: post #10

Another tip: (area code) 867-5309 works for Safeway club card discounts in most area codes while piping tracking of your purchases to essentially null. Yes, Jenny’s number.

Whenever I give that number to the cashier, I half expect them to say "hey, wait...." I thought that number was drilled into everyone's brain, but I guess you have to be a certain age. According to my last receipt, my YTD "savings" has been $959.68 So I am not the only Jenny out there!

I've never heard of it. I think the most famous phone number from a song currently is 281-330-8004

Re: Reversing Safeway's private APIs to automate coupon collection

#143

Post by punnerud »

lucasverra wrote: post #128
punnerud wrote: post #66

Earlier quoted context omitted.

In EU you are allowed to automate everything you legally can do manually, even if they have a large sign on their page saying that automation is not allowed. The only thing that is limiting you from selling is copyright, but by-products from ordinary business is always legal.

any reliable legal source for that ? thanks

This is the best summery from the “horse racing case”: https://eur-lex.europa.eu/legal-content/GA/TXT/?uri=CELEX:62...

There was also a review of the database directive last year that summarize all the precedence on this: http://data.consilium.europa.eu/doc/document/ST-8466-2018-IN...

Re: Reversing Safeway's private APIs to automate coupon collection

#144

Post by journalctl »

taurath wrote: post #65
lozaning wrote: post #30

Earlier quoted context omitted.

At risk of ya'll taking "my" safeway gas rewards, this is almost always good for whatever the maximum discount off per gallon is at any safeway that also has a gas station.

Its amazing to me the degree to which people will go to save 3% or less on gas once a month. If you fill up 4 times a month you're saving about $4, and all it costs is a profile of everything you buy attached to your phone number.

Some people don’t, in fact, live in the Bay or make telephone number salaries hacking React all day.

Re: Reversing Safeway's private APIs to automate coupon collection

#145

Post by penagwin »

Scoundreller wrote: post #110
penagwin wrote: post #72

Earlier quoted context omitted.

I highly recommend not making more then say 5req/s - and preferably do it at like 2am. These projects are fun IMO, but it's best to not hammer anyone's servers if it isn't necessary.

But at 2AM your traffic will create a more noticeable spike... It doesn’t blend in as well...

In my experience, unless they have excellent monitoring and a team looking to ban you they won't notice. It's half courtesy, and the other half is because it's not likely to affect their business operations (by slamming the servers when they're busy) they're less likely to notice or care.

Re: Reversing Safeway's private APIs to automate coupon collection

#146

Post by stirner »

atonse wrote: post #2

This is the kind of stuff where I tell people that coding can be a real practical skill (that gives you an unfair advantage these days). I did something similar (read-only) for Home Depot Truck Rentals. To check if the truck was available at my local store, each time, you had to put in your zip code, and click a couple of times. Once I found that was an API, I rebuilt the call in Postman and kept hitting that endpoin…

When working in a kitchen in California, I had to take the ServSafe Food Handler course online, which consisted of long, patronizing, unskippable videos explaining basic food safety concepts (which I already knew from previous experience) and little "check your knowledge" multiple-choice questions peppered throughout. The only thing that actually affected whether you got the certification was a quiz at the end.

I just poked at the main JS file for a couple of minutes until I found the statement I needed:

    mainController.loadNextScreen()
This turned what would have been a 3+-hour slog into 5 minutes, and I passed the quiz just fine.

Re: Reversing Safeway's private APIs to automate coupon collection

#147

Post by ihattendorf »

withinrafael wrote: post #29

I did something similar with Safeway's API back in the day. But rather than chew up their API with unsupported usage--CFAA case territory--I now just log into Safeway's website and issue a one-liner on the coupon page: $(".grid-coupon-clip-button button").click();

This will click the "Load more" button and also click all the coupons while waiting 500ms per click.

https://www.safeway.com/justforu/coupons-deals.html

for(let i=0;30>i;++i)setTimeout(function(){btn=document.querySelector("#coupon-grid_0 > div.coupon-grid-container > div.load-more-container > button");btn && btn.click()},1e3i);elems=document.querySelectorAll(".grid-coupon-clip-button button");for(let i=0;ii);

Re: Reversing Safeway's private APIs to automate coupon collection

#148

Post by ckrailo »

nyquist wrote: post #80
kelnos wrote: post #49

Earlier quoted context omitted.

> presumably that agency designed permitting system with the assumption that people with limited time and attention would be vying for the permits by having to visit the site themselves to get one. That's quite a very large assumption that I don't think we can accept as fact. > that those who register early, or are very motivated, or simply those with a lot of free time to refresh the site, will get permits. Perhaps…

I'll bite. I think you're right the agency probably didn't sit down, write down definition of fairness, then design a permitting system around it. They probably implemented the cheapest/easiest digital analog they could find to a traditional fax-in/walk-up first-come/first-served permitting system. However, the intentionality of the implementers was not central to my argument. The system was created by (probably) non…

Unfortunately, I found this wholly unconvincing. I sincerely doubt it is a grand ideal, carefully thought-out, or well-funded. Expecting an idealized set of well-crafted axioms for accessing public spaces with demand outstripping supply at an accelerated pace will almost certainly lead to disappointment. "Special knowledge" can be as simple as knowing the right person to befriend to add your name to a list. The example of regressing to ancient non-internet fax instead of even straightforward USPS snail mail tells me they don't have the correct answer either.
Post reply on HN