Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's inside the QR code menu at this cafe?

peabee.substack.com

Post reply on HN
Print view View original

251–260 of 328 posts

Re: What's inside the QR code menu at this cafe?

#251

Post by infecto »

rapnie wrote: post #13

> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.

Unfortunately the implementation that most Western countries took is pretty terrible. One of the highlights for me in China is the lack of menus in restaurants, I can still ask the staff questions if there are any but its nice being able to order add-ons throughout the meal without having to wave someone down.

Re: What's inside the QR code menu at this cafe?

#252

Post by moralestapia »

drdec wrote: post #237
nkrisc wrote: post #220

Earlier quoted context omitted.

The gist of some various laws around the world is that simply obtaining credentials does not authorize you to access the system, and accessing it without authorization is the illegal part.

This principle is clear if you apply a real world analogy. Just because you happen to have keys to a building doesn't mean you can enter without authorization from the owner. (E.g. you may have kept copies after a lease expires or a sale, it maybe you found them, etc.)

I get the unauthorized access argument.

But how does it become fraud?

Re: What's inside the QR code menu at this cafe?

#253

Post by tsimionescu »

krsdcbl wrote: post #153
tomalaci wrote: post #149

Earlier quoted context omitted.

In this case? Nope. This must be treated as willful design decision to open up API to entire public (including PII/phone-number leak as per design), even if they say they totally didn't meant that to happen. Government itself should then be notified to go after these guys for failing to do the most basic access controls. I mean, come on! To treat this as a proper security vulnerability just gives too much leeway for…

Fully agree with you! The API being unauthd is clearly a core design choice, and finding out any customer or service data is openly accessible with consecutive numbers through that API is not a zero day or something. There is no "responsible disclosure" to be made here, going to the company and explaining what's the issue with all of this amounts to "handing out free consulting" if anything

There are exactly two activities you can be participating in if you are exploring someone else's undocumented API: (1) free consulting, or (2) illegal hacking. Disclosing vulnerabilities you found in someone else's product, regardless of how obvious, is free consulting. If you're not responsibly disclosing them, then you were illegally hacking their systems.

Re: What's inside the QR code menu at this cafe?

#254

Post by tsimionescu »

komali2 wrote: post #171
mpeg wrote: post #161

Earlier quoted context omitted.

Unfortunately that is not how the law works, at least in most countries. As soon as you enumerate ids regardless of whether there is any security in place it is unauthorised access and it's illegal.

Right, I believe they're posting as if the ethical standpoint is normalized, to further highlight the absurdity and injustice of the current legal framework.

Why is it unjust to prosecute people who harm a business and unsuspecting customers of that business by disclosing 0-day vulnerabilities publicly without giving them even a chance to patch?

The poster here has no proof that the vulnerability was already being exploited. For all we know, as obvious as this was, no one else had yet thought to look.

This is like going around people's house doors, testing to see if they are unlocked, and if they are, posting a big sign saying "unlocked door" on each one. It's obviously an anti-social act masquerading as benevolent, and it should be punished. Of course, the company running such highly vulnerable code should also be punished, but that doesn't absolve anyone.

Re: What's inside the QR code menu at this cafe?

#256

Post by ceejayoz »

AdamN wrote: post #247
ceejayoz wrote: post #227

Earlier quoted context omitted.

By the sensible definition, it isn’t. By the definition that killed Aaron Swartz, it probably is.

He wasn't prosecuted for logging in and looking around. He overtly did copyleft type things like finding ways to take copyrighted journal articles and release them into the public domain. Overzealous prosecution for sure regardless.

https://en.wikipedia.org/wiki/Aaron_Swartz#United_States_v._...

> On July 11, 2011, he was indicted by a federal grand jury on charges of wire fraud, computer fraud, unlawfully obtaining information from a protected computer, and recklessly damaging a protected computer.

> On November 17, 2011, Swartz was indicted by a Middlesex County Superior Court grand jury on state charges of breaking and entering with intent, grand larceny, and unauthorized access to a computer network.

> On September 12, 2012, federal prosecutors filed a superseding indictment adding nine more felony counts, increasing Swartz's maximum criminal exposure to 50 years of imprisonment and $1 million in fines.

The only civil copyright proceedings were JSTOR settling with him out of court.

Re: What's inside the QR code menu at this cafe?

#257

Post by esrauch »

moralestapia wrote: post #252
drdec wrote: post #237

Earlier quoted context omitted.

This principle is clear if you apply a real world analogy. Just because you happen to have keys to a building doesn't mean you can enter without authorization from the owner. (E.g. you may have kept copies after a lease expires or a sale, it maybe you found them, etc.)

I get the unauthorized access argument. But how does it become fraud?

Defeating access control by using credentials that aren't yours is fraud.

Like, if you found a company badge laying around, go to that office and flash the badge to the security guard and go in. You've committed fraud by tricking the guard into thinking you're authorized to enter when you weren't.

Re: What's inside the QR code menu at this cafe?

#258

Post by PUSH_AX »

austinjp wrote: post #236
PUSH_AX wrote: post #98

Earlier quoted context omitted.

> you are ordering food and drinks, speed is not essentials, if you're in a hurry you don't sit down in a diner/restaurant Honestly if I received poor/slow service and management came back with this I'd be pretty upset. Especially given a large number of places have an explicit service charge or there is a cultural expectation that this should be paid extra for. You're either trying to solve the problem of service or…

>> you are ordering food and drinks, speed is not essentials, if you're in a hurry you don't sit down in a diner/restaurant > Honestly if I received poor/slow service and management came back with this I'd be pretty upset. Plenty of places will tell you not to expect fast service for certain dishes or drinks. If you order a cocktail at a bar and complain when it arrives after the cola, you'll raise eyebrows. The conf…

I'd amend that to being confusion between the accepted norm of service vs poor service. I'm fully aware that there is breathing space in a service, it's not a conveyor belt.

Your anecdote is nice. I think another thing to recognise is everyone has different expectations around service time and availability of service. The great thing about some of these systems is you can choose, the one I helped implement is there if you want it, if not your table falls back to classical service, and best of all there are of course still staff around to talk to if you need.

Re: What's inside the QR code menu at this cafe?

#259

Post by OvbiousError »

gibolt wrote: post #31
rapnie wrote: post #13

> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.

Even worse when the weird ass website has links to multiple PDF documents to download. Then you find out all the items you looked at aren't available when the waiter stares blankly at you about your order. Turns out the dinner menu requires horizontal scrolling on the page to find.

I prefer the pdfs. Most of the time you can zoom out enough to actually have a sizeable part of the menu visitble instead of 3 items at a time.

Re: What's inside the QR code menu at this cafe?

#260

Post by mmsc »

> I checked on my laptop what other tables were ordering to get a quick vibe check of the place. I could've just looked around, but it felt cooler to do it on the laptop.

I think it would be great if you could go to a restaurant and they had this data available. Sure, some menus say "best seller!" but I don't believe them all the time. And tastes change, chefs, etc.

Post reply on HN