Why was this blog removed?
Author is afraid they conmitted fraud according to Indian laws
What's inside the QR code menu at this cafe?
231–240 of 328 posts
Re: What's inside the QR code menu at this cafe?
#232Not to be a party pooper, but posting detailed financial analysis of the exact sales data of a multi-million dollar business using numbers obtained through an obviously overlooked backdoor seems like a very bad idea. Haven't people have gone to jail for less? (iirc "but it was an insecure API" has not held up in court in the past) On a more positive note, I've used a QR menu recently and it really is a game changer.…
> Looking forward to seeing it more often, especially in places where you're not looking for stellar service.
I loathe them perhaps even more than I loathe the order-kiosks that McDonald's has rolled out. My phone is smaller than the folded napkin, I would rather not have to scroll to examine a menu.
Regardless, a restaurant should think twice about outsourcing this kind of thing to a 3rd party that now has all of your (and your competitors) financials. Even if the API is better vetted, why would you trust this faceless, profit-motivated site with your data?
"Convenience" seems to be the way they market "getting rid of employees" these days — from self-service gas, self-checkout lanes, etc.
Re: What's inside the QR code menu at this cafe?
#233> This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care. Having a complete lack of any authentication and sequential IDs does seem like a design decision.
Feels like a proof of concept demo app built by an intern.. to which the customer said: perfect! launch this in production tomorrow
Re: What's inside the QR code menu at this cafe?
#234Earlier quoted context omitted.
The author says "I refuse to believe they’re unaware of this. This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care." Agree that this is an uncharitable way of looking at it.
Could be as simple as no auth in debug builds and then deployed it by accident.
I don't mean to pick on your comment, but to respond to a prior comment, you are beginning with a very positive world view and interpreting the events from there.
Lazy API that did not vet a simple backdoor?
Good coders but accidentally pushed the debug version of the API?
I am going to have to say the second option feels less likely (yes, I have been called cynical).
Re: What's inside the QR code menu at this cafe?
#235Earlier quoted context omitted.
I’m not sure if this could be considered “peak”. The ratio of waiting staff to customers is an obvious bottleneck. This inefficiency is simply accepted and not even really thought about, it’s just the way things are. But one thing I can say for this tech is it fixed it and the difference is noticeable.
Life isn't about peak efficiency The experience is as, if not more, important than the result for most things. Leave that for assembly lines (and even that is debatable) If you want peak efficiency order caffeine powder from Amazon and snort it, it's going to be much cheaper and much more efficient than going to a coffee shop
Today on HN : "Coffee Stats – Maximize Caffeine Intake and Get to Bed at Night"
Re: What's inside the QR code menu at this cafe?
#236Earlier quoted context omitted.
few comments - you are ordering food and drinks, speed is not essentials, if you're in a hurry you don't sit down in a diner/restaurant - you assume that everything on the menu is perfectly clear, but what exactly is that thing with the mysterious name? (for example peri peri fries means nothing to me) you can ask to a person, not to a PDF - you really want X but you have food allergies or some other dietary restrict…
> you are ordering food and drinks, speed is not essentials, if you're in a hurry you don't sit down in a diner/restaurant Honestly if I received poor/slow service and management came back with this I'd be pretty upset. Especially given a large number of places have an explicit service charge or there is a cultural expectation that this should be paid extra for. You're either trying to solve the problem of service or…
>> you are ordering food and drinks, speed is not essentials, if you're in a hurry you don't sit down in a diner/restaurant
> Honestly if I received poor/slow service and management came back with this I'd be pretty upset.
Plenty of places will tell you not to expect fast service for certain dishes or drinks. If you order a cocktail at a bar and complain when it arrives after the cola, you'll raise eyebrows.
The confusion between you two in this thread may be partly due to the conflation of 'slow service' with 'poor service', they're not necessarily the same. Sure, if I ordered a cola and was still waiting after the table next to me received their 5 different cocktails, something would have gone wrong.
Here's a fun story. The other day, I was in Belgium. We ordered food at a restaurant. While we were waiting I had a beer, my partner had a negroni. We waited... and waited... and waited. Other diners arrived, ordered food, their food arrived, they ate it. And still we waited.
After a while we asked a waiter if our food order had got lost. They were apologetic, and pointed to my partner's still-unfinished drink, but said they'd get our food out ASAP. The food arrived rapidly (it was delicoius).
What had happened? Well, a negroni is an apéritif, so is drunk before a meal. The staff hadn't been inattentive; quite the opposite -- they were waiting for the apéritif to be finished. Serving the meal beforehand would have been... rude? Undignified, perhaps. And certainly something that all the other local diners would have been well aware of.
Sure, it was a leisurely situation, nobody was in a rush, this isn't a daily occurrence, blah blah. Anwyay, I learned a thing about apéritifs. Cultural heterogeneity is educational and enriching in a way that QR codes and social isolation are not.
Re: What's inside the QR code menu at this cafe?
#237Earlier quoted context omitted.
Curious. How is this, specifically, fraud?
The gist of some various laws around the world is that simply obtaining credentials does not authorize you to access the system, and accessing it without authorization is the illegal part.
This principle is clear if you apply a real world analogy. Just because you happen to have keys to a building doesn't mean you can enter without authorization from the owner. (E.g. you may have kept copies after a lease expires or a sale, it maybe you found them, etc.)
Re: What's inside the QR code menu at this cafe?
#238Re: What's inside the QR code menu at this cafe?
#239Earlier quoted context omitted.
Unfortunately that is not how the law works, at least in most countries. As soon as you enumerate ids regardless of whether there is any security in place it is unauthorised access and it's illegal.
Seems outlandish. Citation needed? I'm aware of a couple of cases in the US, but not all over the world. Secondly: can consumers be blamed for gross negligence? It's not reasonable for a bank to post account balances in public billboard and ask people not to look at others. We should contest when private data is available publically, hidden only by small obfuscations, not professional security practices.
So for example in the UK with the computer misuse act, intent matters. If you intentionally change an id because you expect you will be able to access other data it becomes a crime.
Your example is flawed because in this case the private data was not made available publicly at all – you need to intentionally exploit a software flaw to access it.
Of course, it also matters how you handle it. If you do enough to just discover the flaw, try to adhere to the bug bounty program scope (if any), use your own accounts in testing and responsibly disclose any findings as soon as you have a poc then you'll probably be ok.
In this case the author went way beyond just finding the flaws, and then disclosed it publicly in a completely irresponsible way without even trying to contact the company or any of the clients affected by it (some of which will certainly have a security contact that can liaise with the vendor)
Re: What's inside the QR code menu at this cafe?
#240The other day I used one of these "order with QR" things for the first time. I ordered nachos and they brought me a fish! Curse you peabee!