81–90 of 328 posts
I am confused, they didn't contact the company at all and just disclose this publicly? Very immature handling of a vulnerability finding.
The author says "I refuse to believe they’re unaware of this. This doesn’t feel like an oversight, it's either a deliberate design decision or they just don't care." Agree that this is an uncharitable way of looking at it.
Earlier quoted context omitted.
Much like how widening the I-405 does not improve Los Angeles's legendary traffic jams, slabnus do not improve the bottleneck. Namely, restaurants who move to slabnus simply get rid of the waiters who would have taken the order. You're left with even fewer waiters serving food and drinks, let alone taking orders. The coup de grace is I don't even get a discount for the degraded service. Note: Slabnu because I'm pecki…
> The coup de grace is I don't even get a discount for the degraded service. It's like self-service checkouts: the store gets to save on stuff and get their customers do the store's work instead, and we don't even get a discount for that free labor and more time spent in checkout and degraded experience.
There are pretty common ethical standards about disclosing vulnerabilities privately before disclosing them publicly. I don't see how the obviousness of the vulnerability changes the situation. By warning the company, you give them the opportunity to remedy the problem before announcing to the world that anyone with a laptop can exploit it. Probably they were just hoping that nobody would notice, which is stupid of course, but now they don't have the chance to build up a better wall before the flood of fake orders that could cause real harm to the small businesses whose financial information you disclosed online.
Perhaps I'm being too optimistic about how the company would respond, but I still think it's hard to justify not doing a private disclosure.
Next up: "How I became a millionaire by consulting restaurants on Menu items and targeted Text Message Ads" ... Seriously, its a PII leak and it should be reported. And since you said Google is an investor someone (theoretically) should care.
I looked around to find a security contact at DotPe, and couldn’t find anything. Hopefully, this HN post raises enough alarms.
If it wasn't so sad, it would be almost funny that their Terms & Conditions page errors out (for me). The whole page looks pretty broken and like the landingpage is an afterthought...
Anyways, the closest to a contact us is this what I found (after looking for 15 seconds and randomly clicking links) https://dotpe.in/contact-us.html maybe that helps to get in touch at least...
Please no one write that random script… f*king up high cash flow but ultimately usually pretty low margin businesses like these, while also pushing the poor staff around in a way that costs them time and very likely wages is really, really, really bad karma.
Earlier quoted context omitted.
Why? Why should they be the responsible ones, when the well-funded, well-connected service provider is acting like the fly-by-night startup (that they probably started as)? There's little public benefit in responsible disclosure here; all it would lead to is the whole thing being swept under the rug with some trivial "fix". There's lots of public benefit in immediate, wide disclosure - the scramble to fix this under…
There's a big difference between announcing "I found all this private data" and "I found all this private data and here's exactly how I did it and here are the URLs". What the author has done is detail exactly how anyone else can abuse this system from anywhere in the world and also given them ideas about what to do with that information that would cause a direct cost to the company. I think that's irresponsible and…
Earlier quoted context omitted.
I’m not sure if this could be considered “peak”. The ratio of waiting staff to customers is an obvious bottleneck. This inefficiency is simply accepted and not even really thought about, it’s just the way things are. But one thing I can say for this tech is it fixed it and the difference is noticeable.
inefficiency? It's part of the experience. I'm not in a restaurant or café to drink as fast as possible. I'm there to socialize as well. Waiting a bit is not a bottleneck, but a feature. (If I wanted speed, I'd take the drive-through).
Also we should recognize that the waiter is often looked down at, it is not a very nice job, and as a human being, having a poor experience with some customers will probably pass on to other customers, etc...
I'd go as far as having a job with "wait" in the name, and having to wait, calmy and happily or else you don't get your tip, is not so far from slavery.
I like to scan the "specialized" bar/QR codes I come across in my daily life in case they're not just URLs. Sometimes I find some interesting stuff and possibly some opportunities for mild exploits. The other day I was at burger king. They allow you to refill your drink as many times as you like within 60 minutes of purchasing it, and the way this restriction is implemented is by having you scan a QR code they print…
Well, can you? :). It's the obvious next thing to try, given that Binary Eye is conveniently also a barcode generator, not just a scanner.
> Is this what the peak ordering experience looks like? Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.
[flagged]
Earlier quoted context omitted.
inefficiency? It's part of the experience. I'm not in a restaurant or café to drink as fast as possible. I'm there to socialize as well. Waiting a bit is not a bottleneck, but a feature. (If I wanted speed, I'd take the drive-through).
Have to disagree with this. At a group meet-up where everyone arrives at different times and wants their order to come shortly after they do, a digital system is so much better. These type of meetups are quite common as a parent.
Good god man!
At a social meal, we eat together; children included as this is how they learn to socialise. One would be a little concerned and puzzled if arriving for a meal, one finds others have already eaten.