Live data from Hacker News

Snake in a QR Code

itsmattkc.com

61–70 of 83 posts

Re: Snake in a QR Code

#61
The HTML5 version converted to a data URL would be a more accessible demo than a windows executable I think, especially if it supported mobile input.

Unfortunately, scanning large QR codes doesn't seem to work too well in practice :(

Re: Snake in a QR Code

#62
post #45

Earlier quoted context omitted.

That's what I thought about as soon as I read this. Seems like a great malware installation vector. Just print out stickers and put them up at restaurants, stores...

For which 99.99999% of users will be using mobile clients to scan the QR code that have no capability of executing the code...

Yes, embedding a Windows app is essentially pointless for mobile users, but there are many other delivery vectors available from QR codes.

There are some interesting approaches listed at https://news.sophos.com/en-us/2019/10/17/beware-the-square-h...

Re: Snake in a QR Code

#63
post #29
post #3

Earlier quoted context omitted.

"Please run this binary from my business card". I guess it's easier than leaving USB drives in the parking lot...

You could run it in a VM.

YOU could perhaps, but your average target hasn't much of a clue what a VM is, let alone how to set one up.

And keep in mind, malicious software is going to be challenging, and there are much more clever ways to use QR codes.

E.g., imagine some store that has QR codes on the product aisles to access information on a product via a URL. I make a fake website that spoofs the legit product page, but offers the user a special "Buy online and save 25%" offer, which of course they are very tempted by due to the steep discount.

Re: Snake in a QR Code

#64
post #14

Am I the only one unwilling to run a non-sandboxed process I found on a tech demo?

As the demoscene would say, "your loss". It's unfortunate that security hysteria has put such a damper on creativity.

Besides, that binary is small enough that it would be far easier to analyse than the piles of other software you use every day.

Re: Snake in a QR Code

#65
Initially I was looking at the QR-code and thinking about punchcards, code golf and javascript, but reading that it contains a Windows executable was a surprise.

Re: Snake in a QR Code

#67
post #59
post #48

Earlier quoted context omitted.

Yeah I'd much prefer it be a javascript: URL that did all the magic in the browser. Much safer, cross platform, and it would probably work out of the box in existing QR reader apps.

But the snake in a QR code probably works offline

A javascript: URL can work offline. Try this: javascript:document.write("hello world");

Note that if you cut and paste into Chrome it may delete the "javascript:" part and you will have to add that back.

Re: Snake in a QR Code

#68
post #8

Cool, so all the 1k demos/intros from Assembly ( https://archive.assembly.org/2019/1k-intro ) could also be distributed via QR code... the 4k intros unfortunately not. Maybe it's time for a new category ;)

Or a QR-code paging system. (I feel a little evil for even suggesting that)

“Scan Code 22 and Press Button to Continue.”

(If you want to take a guess at what I'm referencing, spoiler alert — the URL itself contains a clue: https://web.archive.org/web/20160129014847/http://i.emezeta.... )

Re: Snake in a QR Code

#69

If you want to see a variation of this concept in the wild, in active use by lots of people, check out PICO-8 cartidges. PICO-8 is a virtual game console. I.e. it's an emulator for an oldschool game console that doesn't exist in reality. It's designed to be easy to code for while maintaining the limits and aesthetics of old game computers PICO-8 games are, of course, distributed on cartridges. However because it's a…

I don't know if I'm stupid, but those anyone have an example PICO-8 PNG? I can't find one in either of the two links you sent, nor on the internet. Am i missing something here?
Post reply on HN