What's inside the QR code menu at this cafe? • Hacker News Board

Re: What's inside the QR code menu at this cafe?

#211

Post by astura » Mon, Sep 23, 2024, 10:52 AM UTC

GJim wrote: post #108

AStonesThrow wrote: post #72

Earlier quoted context omitted.

A good server is an emissary from the kitchen, who knows the menu, and helps you find the best dishes. A great server establishes rapport with the regulars, anticipates their needs, makes them feel welcome and comfortable. Unfortunately "server" is not considered a respectable career but something you put up with before your film career takes off, or how you pay your college tuition for that juicy psychiatric nurse d…

> "server" is not considered a respectable career In the USA maybe. I can assure you, being a waiter is taken quite seriously by much of the civilised world. A good waiter is an important part of the dining experience.

Only in fine dining establishments, certainly not in casual/family restaurants, which are most restaurants.

Re: What's inside the QR code menu at this cafe?

#212

Post by austinjp » Mon, Sep 23, 2024, 10:55 AM UTC

mavhc wrote: post #191

austinjp wrote: post #109

Earlier quoted context omitted.

There are plenty of comments disagreeing with you, but I'm fully in agreement. As for the arguments that QR codes are somehow a time-saver, they can be a real time waster . Find phone (not glued to my eyeballs), scan QR, swerve option to install app, wait for enormously bloated website to render badly, get frustrated trying to find what I want, get up to find a staff member to order something but with X instead of Y…

You can always go to an expensive eating establishment. It's easier to choose from an online system because it's up to date with what's in stock

This highlights a problem: you need to be wealthy to have any privacy.

Why has privacy become something that is only available to a dwindling few? What price convenience?

Re: What's inside the QR code menu at this cafe?

#213

Post by jonplackett » Mon, Sep 23, 2024, 10:56 AM UTC

> This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care.

Having a complete lack of any authentication and sequential IDs does seem like a design decision.

Re: What's inside the QR code menu at this cafe?

#214

Post by oefrha » Mon, Sep 23, 2024, 10:56 AM UTC

IshKebab wrote: post #145

eleveriven wrote: post #119

Earlier quoted context omitted.

I'm with you on that. There's something special about a personal interaction with a waiter and a paper menu

People will find a way to be nostalgic about anything I guess. "There's something special about having a wire attached to your phone." "There's something special about greeting a lift operator." "There's something special about hand-washing clothes."

There’s indeed something special about a waiter pretending to be my best friend — the discomfort is quite special.

Re: What's inside the QR code menu at this cafe?

#215

Post by austinjp » Mon, Sep 23, 2024, 10:59 AM UTC

consp wrote: post #45

digitalengineer wrote: post #38

Earlier quoted context omitted.

inefficiency? It's part of the experience. I'm not in a restaurant or café to drink as fast as possible. I'm there to socialize as well. Waiting a bit is not a bottleneck, but a feature. (If I wanted speed, I'd take the drive-through).

Might be nice to have but its also expensive in a low margin business. Maybe waiters get paid like crap enough for it to not matter in the US but other parts of the world have labour laws to abide to making it the biggest expenditure (and thus the one to save on by cutting out staff and replacing it with an app)

This highlights the underpinning problem: wages are so low that people cannot afford to live. Restaurant margins are so low they cannot afford staff.

Why contribute to that system?

Re: What's inside the QR code menu at this cafe?

#216

Post by n4r9 » Mon, Sep 23, 2024, 10:59 AM UTC

carlosjobim wrote: post #201

n4r9 wrote: post #55

Earlier quoted context omitted.

Have to disagree with this. At a group meet-up where everyone arrives at different times and wants their order to come shortly after they do, a digital system is so much better. These type of meetups are quite common as a parent.

Here's a hint: Eating at a restaurant is not like eating in a school canteen. And it's not about stilling your hunger. You can eat in any order and pace that you prefer. So if people arrive at different times, you can share some starters while waiting for the other people to arrive. Then jump into some main courses when everybody is ready. You're not supposed to arrive hungry to a restaurant, then you are doing it wr…

> you can share some starters while waiting for the other people to arrive. Then jump into some main courses when everybody is ready

True, and that does sometimes happen, depending on the situation. But still, this is much easier to do when you don't have to flag down the waiter everytime you want to order.

> You're not supposed to arrive hungry to a restaurant

Not if it's fine dining and I have low expectations about portion sizes. If I'm going to a "fast casual" restaurant like Nandos then I will arrive ready to eat. I dunno, maybe you're not classing that as a "restaurant" ?

P.S. "you are doing it wrong" is kinda moralistic! I respect that some people still prefer to speak to human beings when getting service, but cultural processes are always changing and adapting to new technology.

Re: What's inside the QR code menu at this cafe?

#217

Post by goldsteinq » Mon, Sep 23, 2024, 11:04 AM UTC

mihaaly wrote: post #178

frereubu wrote: post #118

Earlier quoted context omitted.

My main beef with these menus is that I can't see the entire menu on my phone screen, and end up scrolling up and down multiple times before I can decide what I want to order. With a paper menu my eyes can flick up and down much faster. It's like trying to edit spreadsheets on a phone - technically possible but a real pain in the arse.

At least the screen is only touced by you. My peril are the touch screen ordering places (practically all fast food places nowadays) where based on their outlook hygienically challanged persons swipe their fingers up and down for long before you have a chance following them. There is an icecream place opened nearby I had no chance trying because they only have touchscreen order. Guys at the till only serve icecream a…

Do you get a freshly-printed paper menu every time? From the hygiene standpoint, remote-ordering from your phone is the best, screens are worse (but at least you can wipe them before use) and paper menus are the worst, since it may be harder to disinfect them.

Re: What's inside the QR code menu at this cafe?

#218

Post by pnt12 » Mon, Sep 23, 2024, 11:05 AM UTC

mpeg wrote: post #161

krsdcbl wrote: post #153

Earlier quoted context omitted.

Fully agree with you! The API being unauthd is clearly a core design choice, and finding out any customer or service data is openly accessible with consecutive numbers through that API is not a zero day or something. There is no "responsible disclosure" to be made here, going to the company and explaining what's the issue with all of this amounts to "handing out free consulting" if anything

Unfortunately that is not how the law works, at least in most countries. As soon as you enumerate ids regardless of whether there is any security in place it is unauthorised access and it's illegal.

Seems outlandish. Citation needed? I'm aware of a couple of cases in the US, but not all over the world.

Secondly: can consumers be blamed for gross negligence? It's not reasonable for a bank to post account balances in public billboard and ask people not to look at others. We should contest when private data is available publically, hidden only by small obfuscations, not professional security practices.

Re: What's inside the QR code menu at this cafe?

#219

Post by loktarogar » Mon, Sep 23, 2024, 11:05 AM UTC

ffsm8 wrote: post #172

qnleigh wrote: post #83

> I would have thought about privately disclosing these findings to Dotpe. But all the API requests are right there in plain sight... There are pretty common ethical standards about disclosing vulnerabilities privately before disclosing them publicly. I don't see how the obviousness of the vulnerability changes the situation. By warning the company, you give them the opportunity to remedy the problem before announcin…

> 37,529 restaurants use Dotpe for QR codes. At that scale, it would take years to get fixed without forcing it like this. It's too small for them to care about the liability of security and too large to move quickly

> At that scale, it would take years to get fixed without forcing it like this.

But it also might not take years. The point of responsible disclosure is to give them the opportunity. If they don't take it, fine - that's now on them.

Instead this guy is committing fraud with actual financial damages (wasted food) and then sharing how others can commit the same fraud on a massive scale, potentially causing more damage. This is now on him and Dotpe, not Dotpe alone.

Re: What's inside the QR code menu at this cafe?

#220

Post by nkrisc » Mon, Sep 23, 2024, 11:14 AM UTC

moralestapia wrote: post #158

mainframed wrote: post #135

Earlier quoted context omitted.

Adding to this, in some countries he is already past the gray-area to what constitutes as computer fraud. Pissing off the company, whose systems you accessed without authorization, is one way of getting to experience the full force of the justice system.

Curious. How is this, specifically, fraud?

The gist of some various laws around the world is that simply obtaining credentials does not authorize you to access the system, and accessing it without authorization is the illegal part.