Live data from Hacker News

What's inside the QR code menu at this cafe?

peabee.substack.com

221–230 of 328 posts

Re: What's inside the QR code menu at this cafe?

#221

This is offline now. Can anyone do a recap of what was revealed without, without actually revealing whatever bad things were revealed.

Yes. It was an article from someone who went into a café which had a QR code based ordering system. After ordering through the system they decide to open their laptop and inspect/look at the API of the system (a system apparently used across India).

They realize that the whole API does not use authentication or authorization and start reverse engineering it/trying out various endpoints. They can then do things like ordering stuff for other tables, calculate earnings of restaurants, etc.

They probably took it down because they disclosed it publicly directly instead of contacting that QR code based ordering service provider (which I won't mention the name of).

Given that this is a substack which has a newsletter, this article has probably reached many people before being taken offline.

Re: What's inside the QR code menu at this cafe?

#222

Earlier quoted context omitted.

At least the screen is only touced by you. My peril are the touch screen ordering places (practically all fast food places nowadays) where based on their outlook hygienically challanged persons swipe their fingers up and down for long before you have a chance following them. There is an icecream place opened nearby I had no chance trying because they only have touchscreen order. Guys at the till only serve icecream a…

Do you get a freshly-printed paper menu every time? From the hygiene standpoint, remote-ordering from your phone is the best, screens are worse (but at least you can wipe them before use) and paper menus are the worst, since it may be harder to disinfect them.

The people before you have also touched the seat and table, the door handle, breathed the air your breathing, etc.

Re: What's inside the QR code menu at this cafe?

#226
post #13

> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.

Completely agree. I'll tolerate PDF menus if it's a really good restaurant, chances are I already know what I want anyway. If they ask me to install apps on my phone I walk out.

Re: What's inside the QR code menu at this cafe?

#227

Earlier quoted context omitted.

Adding to this, in some countries he is already past the gray-area to what constitutes as computer fraud. Pissing off the company, whose systems you accessed without authorization, is one way of getting to experience the full force of the justice system.

Curious. How is this, specifically, fraud?

By the sensible definition, it isn’t.

By the definition that killed Aaron Swartz, it probably is.

Re: What's inside the QR code menu at this cafe?

#228
post #172
post #83

> I would have thought about privately disclosing these findings to Dotpe. But all the API requests are right there in plain sight... There are pretty common ethical standards about disclosing vulnerabilities privately before disclosing them publicly. I don't see how the obviousness of the vulnerability changes the situation. By warning the company, you give them the opportunity to remedy the problem before announcin…

> 37,529 restaurants use Dotpe for QR codes. At that scale, it would take years to get fixed without forcing it like this. It's too small for them to care about the liability of security and too large to move quickly

Maybe, maybe not.

But in responsible disclosure you usually give a 90 day notice period before publicly disclosing and "forcing" them.

Re: What's inside the QR code menu at this cafe?

#229
post #187
post #90

Earlier quoted context omitted.

> where everyone arrives at different times and wants their order to come shortly after they do Good god man! At a social meal, we eat together; children included as this is how they learn to socialise. One would be a little concerned and puzzled if arriving for a meal, one finds others have already eaten.

>children included as this is how they learn to socialise Ummm... When was the last time you were out in public? I hate to break it to you but this doesn't happen, ever; if I see a kid in a restaurant they are pretty much always watching iPads. If they aren't watching an iPad they certainly aren't learning to socialize, because iPad-less kids in restaurants are almost always allowed to misbehave and be disruptive or…

Spoken clearly by someone who lacks experience with having children.

Look, it works pretty simple. Witching hour is right before dinner time. Kids are grumpy / hangry (hungry + angry). On top of that, young children have a short attention span and patience. Children certainly can socialize (after toddler age), but while sitting still at a restaurant table? Not for long. A tablet or smartphone is a tool to keep them distracted during waiting. Heck, playing is learning too, so it is IMO a learning tool.

That said, I can recommend a family restaurant.

For example, on vacation to Texel we went to this one [1]. I have not even seen the indoor playground (only outdoor) as the two times we were here the weather was great. Tons of children playing, the picture you see of the outdoor playground is not even 20% of the whole playground. It is quite large, with a special area for toddlers.

Moreover, we went to a family friendly bungalow park with activities for children, and the restaurant on the park (we didn't go to it this year but previous year) has an adjacent playground. If you're on a more tight budget, the same exists for camping.

Do children socialize on playgrounds? Toddlers kind of don't. They're still in their own world, at best they play 'parallel'. After toddler age? Absolutely. They form new bonds, become friends, they play together. They also get into conflict with each other, which forces them to learn conflict solving skills. They practice motor skills and build muscles. But I couldn't leave them completely alone, so I stayed in the vicinity. Hence, I did not socialize (which, as autistic as I am, I do not mind :P).

On top of that, I remember going to McDonald's as kid in the late 80s (it was one of the first McD's in my country) and they had a playground with balls in it. Also great fun. For the record: I did have a Nintendo game watch and Game Boy back then. But in the McD's such wasn't necessary.

And finally, to all those people who claim they want to socialize with strangers they visually meet. Yeah, that is why people sat on banks reading newspapers, why walkman and discman existed long ago already, why the hairdresser has magazines, why trains have a silent area where you can read a book, etc. Let's face it: not everyone is an extrovert.

[1] https://www.catharinahoeve-texel.nl/kids

Re: What's inside the QR code menu at this cafe?

#230

A guy went to prison for doing this with AT&Ts public subscriber data. The media didn't do him a favor by calling it a hack.

I almost got into big trouble at school for "hacking a teachers email". I guessed their email address (they were systematically generated) and sent an email. It's true you can get into trouble for this, but we need to all take it upon ourselves to make sure this doesn't happen. If this guy got into trouble I would hope every software engineer would be up in arms defending them.

Nah I better err on the side of caution with this - plenty of examples in history where life’s were utterly destroyed even though every sensible person was ok their side - snowden is just one extreme example but there are many others.
Post reply on HN