141–150 of 326 posts
Earlier quoted context omitted.
Enumeration vulns are very serious, it’s just luck that this one appeared to be low risk.
But that’s my point: not all risks are the same. A cache issue that serves you someone else’s crossword puzzle is an inconvenience, but a cache issue that serves you someone’s credit report is way worse.
Aside re: restaurant technology: In a restaurant a year ago with "pay via your phone" service. Server gave us a receipt w/ a QR code. I scanned the code, copied the URL to my clipboard, and looked it over. There was a base64 blob on the URL. I decoded it (because Termux and I'm a nerd) and saw obvious parameters I could fuzz. I changed the check ID (incremented it), left the store ID alone, re-encoded it, and found I…
That’s such a benign vulnerability that it doesn’t even feel like one. Per your description, the worst thing an attacker can do is see the food ordered to a check number (in a public restaurant) and pay a bill that isn’t their own? On the flip side, some services go absolutely overboard trying to secure low-blast-radius things, or don’t properly scale security to the risk of an activity. I have a service provider tha…
You could farm the data to see how the shop is doing.
Earlier quoted context omitted.
And usually they have a dedicated checkout aisle so you don’t have to wait for the Boomers in front of you to pay in pennies or whatever it is they do to snarl a queue up.
Eh. This "Boomer" uses his Apple Watch, usually. I tend to blow through in about five seconds. I usually have the stuff paid for, before the cashier stops ringing them up. I deliberately use the manned checkout, because I'm human, and I believe in helping out other humans. That seems to be a "quaint anachronism," these days, but it's the way this old fogey was raised. I know that someday, I won't have a choice (Home…
Just hit the 'I need help' button on the self-checkout and an employee will show up and you can ask them to ring up your items.
1) Impromptu yoga class brunch. No one says "oh, who needs to top up their parking since we'll be an extra hour"; so it's technology at fault that they got a notification half way through, not the people involved? The consequence was no one got ticketed?
2) 6 people with 6 phones, some of them the "latest iPhones" scanned a QR code once each, after struggling; chose their meals, didn't pay via the app, and it created a shared bill with complete loss of who ordered what.
I have never used a QR code ordering system this bad. The only way this makes sense is if they all told a staff member what they were having from reading an online menu. Paper menus would not have changed this. A restaurant wouldn't typically use a solution so bad, it'd be gone in a few weeks if they have any kind of autonomy.
How did these people live through COVID and never encounter a QR code they had to scan with a phone? Is this elderly yoga? Or ultra rich kids with butlers their entire lives? It doesn't make sense that they are so technologically illiterate any other way.
3) They all paid, but the only information they could see was the remaining amount unpaid. At the end, the last person paid; and the staff told them there was 24Dh outstanding - and this was a surprise. The last person just left without mentioning this, or their eyes don't work? How is having the only piece of information visible to you the bit that causes the surprise?
None of this makes sense to me as internally consistent. Yes, the writing style doesn't look ChatGPT flavoured, there are mistakes in it to appear more human; but the cognitive model of how things work seems to be utterly inhuman.
If anything the prompt from your phone that your meter is expiring is a huge plus against forgetting about it and getting dinged with an outrageous parking ticket. I'd much rather go through the brief stress of that reminder than a ticket any day. A parking ticket will put me in a sour mood for the rest of the day easily.
Earlier quoted context omitted.
> Like all the other versions of this, the savings are absorbed by the company, not passed on to the consumer. Grocery stores (at least here in the UK) are notoriously low margin and have been for a long time. I think this is the one sector where savings are indeed passed on to the customer.
Tesco (largest U.K. supermarket chain) has a razor-thin 2.23% profit margin.
[0] https://www.tescoplc.com/investors/reports-results-and-prese...
Earlier quoted context omitted.
And usually they have a dedicated checkout aisle so you don’t have to wait for the Boomers in front of you to pay in pennies or whatever it is they do to snarl a queue up.
Eh. This "Boomer" uses his Apple Watch, usually. I tend to blow through in about five seconds. I usually have the stuff paid for, before the cashier stops ringing them up. I deliberately use the manned checkout, because I'm human, and I believe in helping out other humans. That seems to be a "quaint anachronism," these days, but it's the way this old fogey was raised. I know that someday, I won't have a choice (Home…
Drives me crazy watching people ahead of me try to do this. If the transaction hasn't been completed what precisely do they or indeed you think you are paying for again like handing the store an electronic blank check? I agree to pay...whatever the total ends up being!
Earlier quoted context omitted.
Eh. This "Boomer" uses his Apple Watch, usually. I tend to blow through in about five seconds. I usually have the stuff paid for, before the cashier stops ringing them up. I deliberately use the manned checkout, because I'm human, and I believe in helping out other humans. That seems to be a "quaint anachronism," these days, but it's the way this old fogey was raised. I know that someday, I won't have a choice (Home…
> I know that someday, I won't have a choice (Home Depot only has cashiers for contractors, nowadays, so I'm forced to use the auto-checkout), but, where one is given, I take the human. Just hit the 'I need help' button on the self-checkout and an employee will show up and you can ask them to ring up your items.
I don't understand why people do this.
I’d not heard of this fallacy* but it makes perfect sense. Well executed human greeting is such a killer asset if you get it right. There’s a few million years of genetic programming inside us all that responds unreasonably positively to hospitality. If someone enters my home and is not drinking their desired beverage in under four minutes, I have brought shame on me and my family! I think we are all programmed to re…
I also hadn't heard of it, but I feel like it's kind of a corollary of the whole, "what's measured is managed" idea or maybe the Streetlight effect ( https://en.wikipedia.org/wiki/Streetlight_effect ). It's easy to measure a doorman's cost, but hard to measure their impact. Few, if any, guest are likely to mention the impact of a doorman on their stay except in the exceptional case. That means when budgets start to g…
People have now clung on to doorman's fallacy as a way to justify keeping outdated jobs around. There should be a new fallacy named for this phenomenon otherwise we would have people justifying having travel agents jobs and translator jobs being protected.
Have you ever used a travel agent?