Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What's inside the QR code menu at this cafe?

peabee.substack.com

Post reply on HN
Print view View original

301–310 of 328 posts

Re: What's inside the QR code menu at this cafe?

#301

Post by nkrisc »

moralestapia wrote: post #275
esrauch wrote: post #257

Earlier quoted context omitted.

Defeating access control by using credentials that aren't yours is fraud. Like, if you found a company badge laying around, go to that office and flash the badge to the security guard and go in. You've committed fraud by tricking the guard into thinking you're authorized to enter when you weren't.

I see, thanks. No credentials involved here, though.

The question a judge (or jury) would answer is: would a reasonable person think they had permission to access it?

API documented on the website under a section called “For Developers”? Probably, yes. API reverse engineered by intercepting requests? Probably not.

Note that the blog was taken down before I could read it myself.

Re: What's inside the QR code menu at this cafe?

#303

Post by com2kid »

TeMPOraL wrote: post #66
com2kid wrote: post #54

Earlier quoted context omitted.

Many people like being able to see what they are ordering. I've seen people order by pointing to pictures on Yelp instead of using the paper menu. Online menus with pictures of every dish are desired by plenty of customers.

> Online menus with pictures of every dish The invention of color photography, and large and small format color printing, make it unnecessary for the whole thing to be online . You can have pictures without all the issues of online - like small, low-resolution screens (relative to paper all screens are low-res screens), and being coerced to give away personal data.

I've been to restaurants that have pictures of every dish on the menu. Those menus end up being the size of large books, and in one case the menu was delivered in the form of a three ring binder with laminated pages to flip through.

Good menu layout and design costs money, laying out 30 or so pages with full pictures of every dish, and then printing a bunch of those up, is not reasonable.

Meanwhile online menus can be searched and filtered through.

That said I think that online menus are generally sub-par compared to paper, mostly because paper is better than a screen for most things, for people who don't know a given cuisine, pictures are essential.

Re: What's inside the QR code menu at this cafe?

#304

Post by com2kid »

Freak_NL wrote: post #142
GJim wrote: post #99

Earlier quoted context omitted.

> pictures of every dish are desired by plenty of customers. I'd expect my waiter to look rather puzzled if I asked for a picture of my food, and also perhaps be politely remined that I am not in a fast food outlet.

Besides, for anyone completely lost in a restaurant with unfamiliar dishes (on holiday perhaps) the age-old solution is to simply ask the waiter for recommendations, or point at another diner's dish if that looks good. Or just choose the dish of the day — it's usually the best option anyway if you picked a decent restaurant.

My go to criteria for picking a restaurant is "do I not recognize the dishes they are serving?" As in, I prefer to go to places where I don't recognize anything on the menu.

I'll rotate through eating at a handful of restaurants until I've sampled everything on the menu, then I'll go look for a new batch of restaurants to try out.

In other words, my day to day is being in a restaurant with unfamiliar dishes!

That said I have no qualms ordering a dish and not having any idea what I'll be getting, but I know plenty of adventurous eaters who want to have at least a general idea of what they'll be getting and having a bunch of pictures available is easier than asking the waiter to describe every dish in a menu for a new cuisine.

(The one flaw with this plan is my rate of exploration is greater than the rate of new restaurants opening in my area, even living in a major west coast city, so I have to keep travelling farther and farther from home to find new places to eat! Also different cultural groups centralize in different places, which can lengthen the commute needed to find good food!)

Re: What's inside the QR code menu at this cafe?

#305

Post by com2kid »

TeMPOraL wrote: post #295
hot_gril wrote: post #143

Earlier quoted context omitted.

I would expect the most expensive part to be printing and laminating those menus, which will also be longer due to the space used on images. Then they need to be cleaned, possibly updated, and will still go bad over time.

Printing is cheap and, even with a half-decent consumer-grade inkjet or laser printer, takes very little labor. Laminating is much more labor-intensive, though it's not bad as long as you stick to a standard paper size[0]. In my experience, somehow, in the transition to digital and past worries about "dead trees", most people missed the fact that paper and printing are dirt-cheap these days[1], and if you account for…

I've been to restaurants with home printed laminated menus. It cheapens the entire experience, to an incredible degree.

The inks fade very quickly, the lamination job feels like, well, a elementary school art project, and there is no way a nicer upscale establishment is doing this. (And with food prices being what they are, almost everyplace now days is a "nicer" place!)

Meanwhile there is a damn good reason that the fancy expensive cocktails at get their own full color advert at every table! Making food look good, with high quality design and printing, makes the food look more desirable.

Re: What's inside the QR code menu at this cafe?

#306

Post by always_imposter »

The api is still up and they still haven't done anything to remedy this. Like, that should be your first priority, first send an email to your customers apologizing for this and then start working on it.

Yikes.

As one commenter on X(itter) said that the only way this company will think about fixing this is when another competitor who will gather all their customer's details and send emails to them to migrate to their service if they don't want their precious data to leak.

Re: What's inside the QR code menu at this cafe?

#307

Post by carlosjobim »

n4r9 wrote: post #216
carlosjobim wrote: post #201

Earlier quoted context omitted.

Here's a hint: Eating at a restaurant is not like eating in a school canteen. And it's not about stilling your hunger. You can eat in any order and pace that you prefer. So if people arrive at different times, you can share some starters while waiting for the other people to arrive. Then jump into some main courses when everybody is ready. You're not supposed to arrive hungry to a restaurant, then you are doing it wr…

> you can share some starters while waiting for the other people to arrive. Then jump into some main courses when everybody is ready True, and that does sometimes happen, depending on the situation. But still, this is much easier to do when you don't have to flag down the waiter everytime you want to order. > You're not supposed to arrive hungry to a restaurant Not if it's fine dining and I have low expectations abou…

Yes, I'm a bit moralistic about this, you're right. I think eating at a restaurant is a skill that a lot of modern people are not taught. It's not about eating, it is about socializing – unless you're going alone. Portion sizes have nothing to do with it, because you can order more food until you are satisfied.

Or, if money is tight and you really don't want to order more than your main meal, you can always have a bite at home before going out.

It's also possible to train your resistance to hunger, so that you can stand being hungry for 12 hours easy (let's hope service is not that slow). The way to train is to skip your meals during a day and wait until you become extremely hungry. Then just don't eat and after a couple of hours it passes. Do this three times on different occasions and after that you are trained for the rest of your life, and will never again become frustrated or desperate because of hunger.

Re: What's inside the QR code menu at this cafe?

#308

Post by jeffchien »

TeMPOraL wrote: post #298
jeffchien wrote: post #107

Earlier quoted context omitted.

I will gladly do the work myself if it means not being stuck behind people chatting up the cashier or doing complicated coupon/return/exchange/gift card transactions. The value is in the consistency and predictability of time spent for someone who just wants a single bag of onions or a single T-shirt. If stores had no-BS lanes (more than just "X items or less" lanes) operated by human cashiers I would use that too, b…

> The value is in the consistency and predictability "Consistency" and "predictability" are not the words I associate with self-service checkout. Maybe I'm spectacularly unlucky, but almost every time I use one of these machines with more than 3 products, the machine will get confused about the weight, or decide to randomly check me, or find another reason to lock up and have me wait for a clerk to show up and unlock…

That's still a lot more predictable than my human cashier experience. I wish I didn't have to dread being held up by the only cashier in store holding a riveting conversation with 4 groups in front of me. Will the other groups hold up the line too? I guess we'll see!

Re: What's inside the QR code menu at this cafe?

#309

Post by ldjb »

msephton wrote: post #248
rococode wrote: post #32

Not to be a party pooper, but posting detailed financial analysis of the exact sales data of a multi-million dollar business using numbers obtained through an obviously overlooked backdoor seems like a very bad idea. Haven't people have gone to jail for less? (iirc "but it was an insecure API" has not held up in court in the past) On a more positive note, I've used a QR menu recently and it really is a game changer.…

I'm interested to know what the correct way to report this would have been? Specifically in this case. And what would one expect after reporting it? I've found many things like this and I only reported two (Genius, they said thanks) and Amazon (they replied but ultimately ignored it, and the issue is still there today)

First thing I would do is look for a security.txt file or search to see if they operate some kind of bug bounty. Failing that, I would browse their website or search for contact details (or even just a contact form). WHOIS can be useful for this. Ideally you'd want some kind of security contact, or a technical contact, but other times you have to make do with the general contact email/form.

In this specific case, they have a general email address at the bottom of their privacy policy, so that's what I'd use.

I'd send them an email along the lines of "I found a security issue with your website; how would you like me to report it to you?". Then they'll hopefully put me in touch with the right person.

In terms of what I'd expect… If they operate a bug bounty (which they don't in this case) then I'd expect what's on offer. If not, it would depend. I often don't expect anything. There have been businesses I've disclosed security vulnerabilities to that are shady enough that I've refused the reward they offered. Sometimes I don't want anything to do with them.

Re: What's inside the QR code menu at this cafe?

#310

Post by loktarogar »

hunter2_ wrote: post #283
loktarogar wrote: post #219

Earlier quoted context omitted.

> At that scale, it would take years to get fixed without forcing it like this. But it also might not take years. The point of responsible disclosure is to give them the opportunity. If they don't take it, fine - that's now on them. Instead this guy is committing fraud with actual financial damages (wasted food) and then sharing how others can commit the same fraud on a massive scale, potentially causing more damage.…

> fine - that's now on them Is that legally true? The legal risk of having published this without responsible disclosure vanishes if the conventional period of opportunity is ignored? That smells fishy.

I'm not a lawyer so I'm not speaking to the legality of this. Legality is not the only thing that matters.

If you publish an exploit without at least making an attempt to fix it, and someone follows you and exploits it, then there's a direct moral line between you and that exploitation. They more likely than not wouldn't have exploited it without you putting that published info in their path. It's now on you, them and the company, morally. Any damages that result from this interaction are because you and the company enabled them to happen.

That's different to someone else stumbling on it and exploiting it. That's purely on the company and the exploiter.

Post reply on HN