What's inside the QR code menu at this cafe?
peabee.substack.com
peabee.substack.com
There are pretty common ethical standards about disclosing vulnerabilities privately before disclosing them publicly. I don't see how the obviousness of the vulnerability changes the situation. By warning the company, you give them the opportunity to remedy the problem before announcing to the world that anyone with a laptop can exploit it. Probably they were just hoping that nobody would notice, which is stupid of course, but now they don't have the chance to build up a better wall before the flood of fake orders that could cause real harm to the small businesses whose financial information you disclosed online.
Perhaps I'm being too optimistic about how the company would respond, but I still think it's hard to justify not doing a private disclosure.
Pissing off the company, whose systems you accessed without authorization, is one way of getting to experience the full force of the justice system.
How is this, specifically, fraud?
Whether or not that seems reasonable to us is a different matter, but basically it boils down to the fact that "they left the door unlocked" doesn't make it legal to walk in.
If any person without permission of the owner or any other person who is incharge of a computer, computer system or computer network
- (a) accesses or secures access to such computer, computer system or computer network or computer resource;
- (b) downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium;
[...]
- (e) disrupts or causes disruption of any computer, computer system or computer network;
[...]
- (g) provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made thereunder;
If any person, dishonestly or fraudulently, does any act referred, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both.
====
Though, I prefer a lot the poster of the blog post than the company...
Types of computer fraud include: * [...] * Accessing unauthorized computers * [...]
He accessed their computers to access purchase information of other people (e.g. his friend) and business data. I guess making it public, thereby damaging the companies reputation and potentially getting sued by their lawyers is one way to find out, whether he was "unauthorized" to do so.
However, although you are free to walk around in search of the front door, you can't start eating the fruit off the trees. Perhaps that's the better analogy: the trees are happy to serve up a delicious treat for anyone requesting something of it, but that doesn't mean the tree sets the rules. Just because fences preventing this are popular doesn't make them compulsory.
But how does it become fraud?
Like, if you found a company badge laying around, go to that office and flash the badge to the security guard and go in. You've committed fraud by tricking the guard into thinking you're authorized to enter when you weren't.
No credentials involved here, though.
The same could be said about typing any URL that wasn't knowingly supplied to you by the owner, but a "reasonableness test" in court would sort those out from nefarious activity.
API documented on the website under a section called “For Developers”? Probably, yes. API reverse engineered by intercepting requests? Probably not.
Note that the blog was taken down before I could read it myself.
Though note that this would not help one if one started to use or abuse the API to get free food or cause financial damage to a restaurant through fake orders. For example, ordering the corn soup through the API could really backfire if someone wants to present it as good old fraud or theft, or if the recipient of the unexpected soup got into trouble and started to look for someone to hand the damages to.
By the definition that killed Aaron Swartz, it probably is.
> On July 11, 2011, he was indicted by a federal grand jury on charges of wire fraud, computer fraud, unlawfully obtaining information from a protected computer, and recklessly damaging a protected computer.
> On November 17, 2011, Swartz was indicted by a Middlesex County Superior Court grand jury on state charges of breaking and entering with intent, grand larceny, and unauthorized access to a computer network.
> On September 12, 2012, federal prosecutors filed a superseding indictment adding nine more felony counts, increasing Swartz's maximum criminal exposure to 50 years of imprisonment and $1 million in fines.
The only civil copyright proceedings were JSTOR settling with him out of court.
I mean, come on! To treat this as a proper security vulnerability just gives too much leeway for these fast-and-loose businesses/systems. It will just encourage more such crap to proliferate.
I am with the author on this one, I am fairly certain the issue of this was raised internally already, probably multiple times. Fortunately for the business, their management did the right decision - focus on quick and easy features, security is a non-issue, we will just blame the hackers and have legal channels deal with them. I mean, you even have people here berating someone uncovering gross negligence for Google-backed company. Why would businesses bother with basic security when they can play the victim so damn easy?
The API being unauthd is clearly a core design choice, and finding out any customer or service data is openly accessible with consecutive numbers through that API is not a zero day or something.
There is no "responsible disclosure" to be made here, going to the company and explaining what's the issue with all of this amounts to "handing out free consulting" if anything
The poster here has no proof that the vulnerability was already being exploited. For all we know, as obvious as this was, no one else had yet thought to look.
This is like going around people's house doors, testing to see if they are unlocked, and if they are, posting a big sign saying "unlocked door" on each one. It's obviously an anti-social act masquerading as benevolent, and it should be punished. Of course, the company running such highly vulnerable code should also be punished, but that doesn't absolve anyone.
Noticing an overhead pipe at McDonald's is dripping onto the griddle and pointing it out to people isn't harming the business, it's pointing out the business' gross negligence.
If you want, a more apt comparison might be going around a business park and sticking big signs on every unlocked archive door you find. The companies not properly locking the doors are at fault, and customer data may already have leaked; but, you are virtually guaranteeing that even more customer data will leak by doing this. It should absolutely be illegal.
Secondly: can consumers be blamed for gross negligence? It's not reasonable for a bank to post account balances in public billboard and ask people not to look at others. We should contest when private data is available publically, hidden only by small obfuscations, not professional security practices.
Your example is flawed because in this case the private data was not made available publicly at all – you need to intentionally exploit a software flaw to access it.
Of course, it also matters how you handle it. If you do enough to just discover the flaw, try to adhere to the bug bounty program scope (if any), use your own accounts in testing and responsibly disclose any findings as soon as you have a poc then you'll probably be ok.
In this case the author went way beyond just finding the flaws, and then disclosed it publicly in a completely irresponsible way without even trying to contact the company or any of the clients affected by it (some of which will certainly have a security contact that can liaise with the vendor)
Maybe a better analogy is a bank with open lockers and no vigilance: if someone enters and steals money, the police will look for them, because "the coffers were open" is not a valid defense. But customers will also demand answers from the bank - why were they so negligent and incompetent that someone can just enter and get their money?
We should hold similar values for digital systems.
Was the author's intent on stealing private data and causing harm? Did he gain from this abuse? Did the company take enough measures to safeguard their data?
Companies have been mostly not held responsible for their fuck ups, and no matter the law, that's wrong to me.
We shouldn't limit ourselves to only be responsible and disclose properly when the vulnerability suits us.
That is both unfair and irrational.
Truth is even in the west this kind of irresponsible disclosure could land you in jail, much more so in a developing country where these laws are all relatively new.
At that scale, it would take years to get fixed without forcing it like this.
It's too small for them to care about the liability of security and too large to move quickly
But it also might not take years. The point of responsible disclosure is to give them the opportunity. If they don't take it, fine - that's now on them.
Instead this guy is committing fraud with actual financial damages (wasted food) and then sharing how others can commit the same fraud on a massive scale, potentially causing more damage. This is now on him and Dotpe, not Dotpe alone.
Is that legally true? The legal risk of having published this without responsible disclosure vanishes if the conventional period of opportunity is ignored? That smells fishy.
If you publish an exploit without at least making an attempt to fix it, and someone follows you and exploits it, then there's a direct moral line between you and that exploitation. They more likely than not wouldn't have exploited it without you putting that published info in their path. It's now on you, them and the company, morally. Any damages that result from this interaction are because you and the company enabled them to happen.
That's different to someone else stumbling on it and exploiting it. That's purely on the company and the exploiter.
But in responsible disclosure you usually give a 90 day notice period before publicly disclosing and "forcing" them.
Call me old-fashioned, but to me the peak experience is a paper menu to choose from, and a waiter that patiently takes the order. Far prefer that to everyone at the table fiddling on their phones in some weird-ass website or even god forbid custom app.
When I want to leave I just get up and go without the stupid ask to know how much I need to pay then ask again to actually pay with expectation that I pay more than what was asked like it's my choice to pay but really it isn't.
Then you find out all the items you looked at aren't available when the waiter stares blankly at you about your order.
Turns out the dinner menu requires horizontal scrolling on the page to find.
This inefficiency is simply accepted and not even really thought about, it’s just the way things are. But one thing I can say for this tech is it fixed it and the difference is noticeable.
The app isn't there to improve on this. The app is there to maaaybe cut a little bit of hassle with replacing paper menus, but mostly promises to improve the business analytics site and creates many marketing opportunities, including but not limited to screwing with (er, personalizing) recommendations, creating incentive structures, and better tracking thanks to tricking the user into giving the vendor their phone number and bunch of other data.
And, whatever else on top it is, one thing the app is not is an improvement in convenience or experience to the user.
Why contribute to that system?
Good god man!
At a social meal, we eat together; children included as this is how they learn to socialise. One would be a little concerned and puzzled if arriving for a meal, one finds others have already eaten.
Ummm... When was the last time you were out in public? I hate to break it to you but this doesn't happen, ever; if I see a kid in a restaurant they are pretty much always watching iPads. If they aren't watching an iPad they certainly aren't learning to socialize, because iPad-less kids in restaurants are almost always allowed to misbehave and be disruptive or even destructive.
Look, it works pretty simple. Witching hour is right before dinner time. Kids are grumpy / hangry (hungry + angry). On top of that, young children have a short attention span and patience. Children certainly can socialize (after toddler age), but while sitting still at a restaurant table? Not for long. A tablet or smartphone is a tool to keep them distracted during waiting. Heck, playing is learning too, so it is IMO a learning tool.
That said, I can recommend a family restaurant.
For example, on vacation to Texel we went to this one [1]. I have not even seen the indoor playground (only outdoor) as the two times we were here the weather was great. Tons of children playing, the picture you see of the outdoor playground is not even 20% of the whole playground. It is quite large, with a special area for toddlers.
Moreover, we went to a family friendly bungalow park with activities for children, and the restaurant on the park (we didn't go to it this year but previous year) has an adjacent playground. If you're on a more tight budget, the same exists for camping.
Do children socialize on playgrounds? Toddlers kind of don't. They're still in their own world, at best they play 'parallel'. After toddler age? Absolutely. They form new bonds, become friends, they play together. They also get into conflict with each other, which forces them to learn conflict solving skills. They practice motor skills and build muscles. But I couldn't leave them completely alone, so I stayed in the vicinity. Hence, I did not socialize (which, as autistic as I am, I do not mind :P).
On top of that, I remember going to McDonald's as kid in the late 80s (it was one of the first McD's in my country) and they had a playground with balls in it. Also great fun. For the record: I did have a Nintendo game watch and Game Boy back then. But in the McD's such wasn't necessary.
And finally, to all those people who claim they want to socialize with strangers they visually meet. Yeah, that is why people sat on banks reading newspapers, why walkman and discman existed long ago already, why the hairdresser has magazines, why trains have a silent area where you can read a book, etc. Let's face it: not everyone is an extrovert.
You're not supposed to arrive hungry to a restaurant, then you are doing it wrong. It's not about filling your belly.
True, and that does sometimes happen, depending on the situation. But still, this is much easier to do when you don't have to flag down the waiter everytime you want to order.
> You're not supposed to arrive hungry to a restaurant
Not if it's fine dining and I have low expectations about portion sizes. If I'm going to a "fast casual" restaurant like Nandos then I will arrive ready to eat. I dunno, maybe you're not classing that as a "restaurant" ?
P.S. "you are doing it wrong" is kinda moralistic! I respect that some people still prefer to speak to human beings when getting service, but cultural processes are always changing and adapting to new technology.
Or, if money is tight and you really don't want to order more than your main meal, you can always have a bite at home before going out.
It's also possible to train your resistance to hunger, so that you can stand being hungry for 12 hours easy (let's hope service is not that slow). The way to train is to skip your meals during a day and wait until you become extremely hungry. Then just don't eat and after a couple of hours it passes. Do this three times on different occasions and after that you are trained for the rest of your life, and will never again become frustrated or desperate because of hunger.
Might as well stay at home if that's a struggle
Also we should recognize that the waiter is often looked down at, it is not a very nice job, and as a human being, having a poor experience with some customers will probably pass on to other customers, etc...
I'd go as far as having a job with "wait" in the name, and having to wait, calmy and happily or else you don't get your tip, is not so far from slavery.
If interacting with the people facilitating that is stressful I would recommend finding a bench near a vending machine, having someone else in your party handle the interaction, or, not going out.
Is this just an issue in countries where waiters depend on tips for their income?
A waiter orchestrates and coordinates the experience for the diners they are looking after. They slow down orders to stop the kitchen getting overwhelmed. They upsell on the menu in a way that is helpful and informative. They understand the dietary requirements of guests. They hold complex orders in their head and drop the right plate to the right person. They know the flow of a table and engage or back off as appropriate.
Don't undervalue a role that can make a night out magical or a simple coffee memorable.
As for the arguments that QR codes are somehow a time-saver, they can be a real time waster. Find phone (not glued to my eyeballs), scan QR, swerve option to install app, wait for enormously bloated website to render badly, get frustrated trying to find what I want, get up to find a staff member to order something but with X instead of Y please if that's possible, can I pay with cash, etc etc etc.
Clearly, everyone's needs and experiences are different. If you like QR codes in cafes, fine, but we should recognise that they represent something other than supposed 'convenience'. They are there to gather data, and to allow cafes to hire fewer staff. They represent the creeping invasion of privacy in every possible aspect of life. The fact that cafes may want to hire fewer staff masks the issue that an increasing number need to in order to survive. Small business margins are squeezed by unreasonable costs and shrinking profit margins, and these pressures are instinctively passed down to the customer -- you and me. Rather than mindlessly capitulate to this and encourage the one-way downward spiral, I really would hope for communities such as HN to see opportunities to 'disrupt upwards'. How can businesses resist exorbitant rents? Why are our lives so hectic that talking to a waiter is seen as too slow? Why do we give away data without being an eyelid?
A waiter recording your order is at a completely different, much smaller scale. Additionally, the waiter is an anonymizing wall between the system that records my order and me and will only correlate orders across multiple visits to the same restaurant. Not potentially across single visits to multiple, geographically highly separated, restaurants.
Look, all these micro-arguments about the micro-invasions of privacy are 'bread and circuses' [0]. We've entirely lost sight of what it means to be a private citizen just going about our own lives without every nanosecond being tracked, without every damn interaction being an opportunity for someone to skim a cent. Any micro-invasion can be 'justified': it's more convenient, I don't care about a restaurant chain knowing what I've ordered, I don't want to talk to other people, etc. But they all add up.
Societies are increasingly unhappy, anxious, overweight, polarised. The gap between ultra-rich and regular citizens is widening. It all adds up.
Yeah.. old man, cloud. Whatever. The overall evidence is stark and obvious, it just hides in the tiny details.
It's easier to choose from an online system because it's up to date with what's in stock
Why has privacy become something that is only available to a dwindling few? What price convenience?
No one cares if the worst thing that happens is they get slightly better ads
Those who enjoy tasteless gruel and want to spend their days farting?
Namely, restaurants who move to slabnus simply get rid of the waiters who would have taken the order. You're left with even fewer waiters serving food and drinks, let alone taking orders.
The coup de grace is I don't even get a discount for the degraded service.
Note: Slabnu because I'm pecking at a slab of silicon instead of a proper menu.
It's like self-service checkouts: the store gets to save on stuff and get their customers do the store's work instead, and we don't even get a discount for that free labor and more time spent in checkout and degraded experience.
"Consistency" and "predictability" are not the words I associate with self-service checkout. Maybe I'm spectacularly unlucky, but almost every time I use one of these machines with more than 3 products, the machine will get confused about the weight, or decide to randomly check me, or find another reason to lock up and have me wait for a clerk to show up and unlock it, which takes anything between 1 to 5 minutes. And I'm not the only unlucky person, either - I see it happening often enough to others, which usually reassures me that I made a good call standing in the queue for the old-fashion human-operated register.
- you are ordering food and drinks, speed is not essentials, if you're in a hurry you don't sit down in a diner/restaurant
- you assume that everything on the menu is perfectly clear, but what exactly is that thing with the mysterious name? (for example peri peri fries means nothing to me) you can ask to a person, not to a PDF
- you really want X but you have food allergies or some other dietary restriction, again you can ask that to staff, not to a web site
- most importantly, you're assuming that waiting is generally considered an inefficiency, that should be addressed or fixed and that should be the goal of every place serving food and beverages, while it usually is the moment were people sit and relax and have a little chat, it is called lunch break for a reason, isn't it? It's the generalization of XKCD #303.
p.s. in my experience in places that use QR code menus orders are not served faster, actually the opposite is often true.
Honestly if I received poor/slow service and management came back with this I'd be pretty upset. Especially given a large number of places have an explicit service charge or there is a cultural expectation that this should be paid extra for.
You're either trying to solve the problem of service or you're not, it's binary.
Do or do not, there is no try
They are trying indeed, if they succeed or not is a completely different story.
The point is: throwing a QR code at your issues won't solve your issues.
> Honestly if I received poor/slow service and management came back with this I'd be pretty upset.
I don't understand what you mean, it's probably that I, as a non US citizen, don't understand why people should sit down and enjoy a meal while also being in a hurry, there's no management involved here, it's just my opinion.
if I'm in a hurry I'll buy a sandwich or some pizza slice (it has a kinda different meaning here than in the US, but to get you an idea of what I mean)
I believe this to be (generally, but with exceptions) false. On one of my contracts I worked on solving this during covid for a large restaurant chain, they still use the QR system today and there are clear and concrete metrics that tell the story of large improvements to service.
> don't understand why people should sit down and enjoy a meal while also being in a hurry
You're hyper focused on the ideal situation. You can not be in a hurry and still receive a level of service that makes you feel uncomfortable with the service charge/cultural expectation of the tip for this specific service.
Covid is the most disrupting global event of the recent human history I bet it had a quite larger impact than a simple QR code, assuming what you say it's true.
> You're hyper focused on the ideal situation
Am I? I know that for a diner to serve me at a table it can't take less than 20-30 minutes or I am eating literal dog shit and I honestly don't like dog shit, regardless of the service I am receiving (or worse: I am making the staff uncomfortable by asking them to be quick because I am the one who's in a hurry).
It means in total it will take at least one hour, if I don't have that time available I simply do not sit down in a diner.
It's as simple as that, the ideal condition it's a dinner that usually takes from 2 to 4 hours.
The 10 seconds saved on a QR code assuming that the QR code really saves time it's irrelevant at that point.
It is possible that different cultures have different ways of understanding 'service standards'.
> expectation of the tip
You're hyper focused on your own bubble, in most of the World tips are not mandatory nor common especially for a quick lunch break.
And still your answers do not address the larger picture: the staff is there to help you, not to serve you in the as a servant way. They shouldn't, in my opinion, be considered like minions executing what the machine told them to do. That's what Fritz Lang warned us about in 1927.
But even assuming that the QR code saves a lot of time, good staff can go a long way, a fast self-service order system where you wait at the table because the place is understaffed it's a worse experience than an understaffed place where at least a real human greets me asking what I want to drink, before taking my order.
I mean, yeah.. You've even done it again. Outlining situations with perfect service. That's great, now think about the original problem statement where service becomes a bottle neck, and no "if you want great fast service just go elsewhere" is not an elegant solution, sorry.
What are you even talking about?
Are you implying that QR code solutions are optimal for shitty services?
> where service becomes a bottle neck
this is a textbook example of false dilemma. If service is the bottleneck making the ordering process faster will make things worse, not better.
If anything if a place is slow to take orders, I know they'll be late on serving it I can anticipate the problem and go somewhere else, if I already placed the order now I'm stuck.
It's the same things happening at McDonalds with ordering booths, your order is very fast, the service is not and you end up wasting a lot of time in line waiting for your number.
As one of the error pages of this website states Please stop hammering. It makes the problem worse.
Thanks, but no thanks.
You're also contradicting yourself here
> where service becomes a bottle neck
> "if you want great fast service just go elsewhere" is not an elegant solution
The "service is the bottleneck but please stay here and wait until we serve you who knows when, after you placed your order" is much worse.
At least with staff taking the orders they can straight tell you "we're full, there's a wait list" or warn you that that day orders are being processed more solwly than normal and you can decide what to do.
QR code machines will place orders no matter what, but, again, people are not machines and quality has its merits, more than speediness, In my opinion.
YMMV
I’m sort of at a loss for words, I haven’t posed a dilemma, also do you think a server exclusively does one task and nothing else, or is it more fair to say they do multiple and eradicating one task frees up capacity for another?
As I’ve said I’ve seen the efficiencies first hand, and I gain nothing trying to explain them further at this point. Enjoy your day.
Edit for the below reply: apparently I’m a liar too? Super rude and highly disappointing. Systems like this have been rolled out in thousands if not millions of restaurants, apparently for no good reason..
My wife owns a restaurant that has been her family business for over 70 years.
You clearly have never even been near one and think that you can fix problems that have nothing to do with tech with technical solutions, it's like believing that you can solve the fertility crisis with Tinder.
I recommend you to read something about τέχνη.
Good luck my dear friend, you'll need a lot of it.
> Honestly if I received poor/slow service and management came back with this I'd be pretty upset.
Plenty of places will tell you not to expect fast service for certain dishes or drinks. If you order a cocktail at a bar and complain when it arrives after the cola, you'll raise eyebrows.
The confusion between you two in this thread may be partly due to the conflation of 'slow service' with 'poor service', they're not necessarily the same. Sure, if I ordered a cola and was still waiting after the table next to me received their 5 different cocktails, something would have gone wrong.
Here's a fun story. The other day, I was in Belgium. We ordered food at a restaurant. While we were waiting I had a beer, my partner had a negroni. We waited... and waited... and waited. Other diners arrived, ordered food, their food arrived, they ate it. And still we waited.
After a while we asked a waiter if our food order had got lost. They were apologetic, and pointed to my partner's still-unfinished drink, but said they'd get our food out ASAP. The food arrived rapidly (it was delicoius).
What had happened? Well, a negroni is an apéritif, so is drunk before a meal. The staff hadn't been inattentive; quite the opposite -- they were waiting for the apéritif to be finished. Serving the meal beforehand would have been... rude? Undignified, perhaps. And certainly something that all the other local diners would have been well aware of.
Sure, it was a leisurely situation, nobody was in a rush, this isn't a daily occurrence, blah blah. Anwyay, I learned a thing about apéritifs. Cultural heterogeneity is educational and enriching in a way that QR codes and social isolation are not.
Your anecdote is nice. I think another thing to recognise is everyone has different expectations around service time and availability of service. The great thing about some of these systems is you can choose, the one I helped implement is there if you want it, if not your table falls back to classical service, and best of all there are of course still staff around to talk to if you need.
The experience is as, if not more, important than the result for most things. Leave that for assembly lines (and even that is debatable)
If you want peak efficiency order caffeine powder from Amazon and snort it, it's going to be much cheaper and much more efficient than going to a coffee shop
The invention of color photography, and large and small format color printing, make it unnecessary for the whole thing to be online. You can have pictures without all the issues of online - like small, low-resolution screens (relative to paper all screens are low-res screens), and being coerced to give away personal data.
In contrast, the digital menus usually come as a solution, packaged with a promise of some juicy business analytics, so the restaurant only needs to sign the contract and send over some files - that's even less work than regular paper menus.
So no surprise they're jumping to "high tech" - they're really outsourcing menus to a marketing company.
--
[0] - I don't know how things are at the very highest tier of restaurants for the rich, but for those accessible to less rich, it seems the higher-end the restaurant is, the worse the menu is. Bad design, typos, etc. I suppose having an established reputation allows them to get careless about the minor details.
In my experience, somehow, in the transition to digital and past worries about "dead trees", most people missed the fact that paper and printing are dirt-cheap these days[1], and if you account for e-waste, often much more environment-friendly than digital alternatives.
--
[0] - We bought a laminating machine recently, so my wife could make various educational tools for our kids herself. It quickly stops being fun once you're trying to laminate a bunch of arbitrarily-cut shapes on a single shit; keeping things aligned is a PITA.
[1] - Well, not if you're paying a print shop. I think that biases the intuition for many. Even color printing is too cheap to meter if you have a half-decent printer at home.
The inks fade very quickly, the lamination job feels like, well, a elementary school art project, and there is no way a nicer upscale establishment is doing this. (And with food prices being what they are, almost everyplace now days is a "nicer" place!)
Meanwhile there is a damn good reason that the fancy expensive cocktails at get their own full color advert at every table! Making food look good, with high quality design and printing, makes the food look more desirable.
Good menu layout and design costs money, laying out 30 or so pages with full pictures of every dish, and then printing a bunch of those up, is not reasonable.
Meanwhile online menus can be searched and filtered through.
That said I think that online menus are generally sub-par compared to paper, mostly because paper is better than a screen for most things, for people who don't know a given cuisine, pictures are essential.
I'd expect my waiter to look rather puzzled if I asked for a picture of my food, and also perhaps be politely remined that I am not in a fast food outlet.
I'll rotate through eating at a handful of restaurants until I've sampled everything on the menu, then I'll go look for a new batch of restaurants to try out.
In other words, my day to day is being in a restaurant with unfamiliar dishes!
That said I have no qualms ordering a dish and not having any idea what I'll be getting, but I know plenty of adventurous eaters who want to have at least a general idea of what they'll be getting and having a bunch of pictures available is easier than asking the waiter to describe every dish in a menu for a new cuisine.
(The one flaw with this plan is my rate of exploration is greater than the rate of new restaurants opening in my area, even living in a major west coast city, so I have to keep travelling farther and farther from home to find new places to eat! Also different cultural groups centralize in different places, which can lengthen the commute needed to find good food!)
I have a soft spot for cafeteria-style "point to order" systems myself, especially when there's a language barrier. But that does impose a certain industrial feel on an establishment.
Unfortunately "server" is not considered a respectable career but something you put up with before your film career takes off, or how you pay your college tuition for that juicy psychiatric nurse degree.
So nobody can be paid enough, or retained long enough, to care about customers or the food. So 25 years from now, the best server will be a Roomba with a prominent QR on its back.
In the USA maybe.
I can assure you, being a waiter is taken quite seriously by much of the civilised world. A good waiter is an important part of the dining experience.
Yet in the US, due to tipping, it can be (and generally is in most more affluent areas) considerably better paid and lucrative than pretty much anywhere else.
Also I'm not sure what are you saying is generally true at all in most places (unless we're talking about a specific subset of restaurants).
Even worse are the restaurants who require one table to be all ordered on one phone ... so one lemon ends up effectively being the waiter for the table and doing the ordering for everyone. Ask me how I know.
I found the experience better than ordering from a waiter and better than using your own phone.
I've told that chains in China have now replaced this last bit "a waiter brings it" by a little robot.
Ah yes... superiority complex?
Of course, all the downsides are the very reason restaurants are switching to digital menus in the first place, which is something people need to be reminded of. In cases of "I can't believe they replaced a perfectly good X with inferior but 'modern tech' Y", the surprise is usually the person not realizing the vendor is adversarial, and Y is giving some extra benefit to them at the expense of the customer.
At least once you start decoding the drink section (much more consistent) then you can go back and try to interpret the rest.
- staff can keep the menu up to date, basically realtime (they have to do it tho)
- orders can directly land in the kitchen instead of through the waiting staff, which may or may not be coming
- payment can also be done thst way
Of course there are more advantages for the restaurants that may or may not go counter to the interests (or rights!) of their customers. E.g. the ability to easily build profiles and sell that data to the highest bidder.
There are downsides too:
- digital menus can fail more easily than paper menus
- congrats you are a waiter, and now IT-support as well
- customers without phones, no/sucky internet or devices that fail to display the menu are out of luck, so you have to provide offline alternatives/own devices that need their own maintenance
- options that are not in the menu and fields that are not offered cannot be filled, e.g. can be a problem if you are allergic rtc.
- unpersonal. Most people prefer not having to jump through hoops.
Using a tablet that is provided by the restaurant can aleviate many (but not all) of these issues.
I would say that from the restuarant's point of view, having the order-from-app experience works out since the freelancers can order via their laptops whenever they want, without having to flag down a waiter. And during rush hours, tables could order what they want without having to spot and call a waiter among a very drunk dancing crowd.
[1] https://ihpi.umich.edu/news/your-cell-phone-10-times-dirtier...
I would say that there is no difference! : )
Except not everyone is using the toilet door handle, and not for prolonged time, holding and swiping for long seconds or minutes, no, unlike with a touch screen ordering system, which they swipe around for looong, each of them ordering, making sure all the content of their skin is thorougly applied on the surface, practically everyone does that - except me in case I have the option going to the till and order by speaking (before someone niggle: I stand back and not spraying saliva :) ).
"There's something special about having a wire attached to your phone."
"There's something special about greeting a lift operator."
"There's something special about hand-washing clothes."
Most of these ordering systems (at least the ones that have survived COVID) are pretty good websites now. I don't remember ever having to use a custom app. It's a far superior experience.
(Oh yeah and I guess you may be American and have a very different eating experience to the rest of the world where waiters don't live off the arbitrary generosity of customers.)
That is always the worst experience. The most painful apps always require you to spend another 7 minutes after installation; typing in and verifying your credit card information... That has to be the most convoluted paying experience.
I was almost shocked when I rented a Hertz car (via IKEA), that everything was done through a website. The website asked for permission to use the phone camera to take pictures of the car etc. and off we went. Such a good experience compared to fiddling with a new app..
A real waiter also allows for a human connection to be created. Experienced waiters (rather than part timers) can really help you make an order, give you recommendations etc. which makes the experience of dining out much nicer.
If a restaurant has a QR-code menu, I ask for a physical one.
If they don't have a physical one, I walk out.
I've done that many, many, many times.
Without the app I would've had to keep an eye for a roaming waiter, call them out and then place an order. This takes away from the dining experience. I also don't like to wait for the server to clear plates, take the card, swipe it and get it back. The old fashioned ways will disappear for good.
On a more positive note, I've used a QR menu recently and it really is a game changer. Scanned a code, pressed a few buttons, and my food was there in minutes! Looking forward to seeing it more often, especially in places where you're not looking for stellar service.
Not sure if you're serious after reading the paragraph where he ordered food for another table ;-)
This is the front door. It's not even open, it's taken off the hinges.
Scratch that, there never was a door in the first place, just a gaping hole right to the street.
I loathe them perhaps even more than I loathe the order-kiosks that McDonald's has rolled out. My phone is smaller than the folded napkin, I would rather not have to scroll to examine a menu.
Regardless, a restaurant should think twice about outsourcing this kind of thing to a 3rd party that now has all of your (and your competitors) financials. Even if the API is better vetted, why would you trust this faceless, profit-motivated site with your data?
"Convenience" seems to be the way they market "getting rid of employees" these days — from self-service gas, self-checkout lanes, etc.
In this specific case, they have a general email address at the bottom of their privacy policy, so that's what I'd use.
I'd send them an email along the lines of "I found a security issue with your website; how would you like me to report it to you?". Then they'll hopefully put me in touch with the right person.
In terms of what I'd expect… If they operate a bug bounty (which they don't in this case) then I'd expect what's on offer. If not, it would depend. I often don't expect anything. There have been businesses I've disclosed security vulnerabilities to that are shady enough that I've refused the reward they offered. Sometimes I don't want anything to do with them.
Leaving PDPA aside, as a Software professional I find this act kiddy and unethical. 10 years back I found a major vulnerability bug in an major multinational bank where I was able to see monthly statements of any person. I reported this to the bank and they took approx 1 year to fix that. I did not even mention about this bug to my friends or my CV till it was fixed.
In India, personal data is not yet taken seriously with both educated and un-educated people. It would take some time but I believe this realisation will come over time in people.
I've worked in lambda web editor (not in Git) and my lead considered replacing sql injection with parameterised queries was a distraction/insubordination. Cant wait till audits, data breach insurance and imprisonment becomes the reality.
Lazy API that did not vet a simple backdoor?
Good coders but accidentally pushed the debug version of the API?
I am going to have to say the second option feels less likely (yes, I have been called cynical).
It was just an example. Maybe they knew.
No, this is not some obscure security hole they forgot about. This is plain incompetence and/or deliberate design decisions.
I agree that full public disclosure like this is irresponsible, but exposing issues like this to the public is the only way for such companies to make a change or, preferably, lose business and shutdown.
It feels like the usual case of vendors buying service to better exploit the users, and themselves getting burned and/or exploited by that service too.
It would be different if for example the application was showing data for other customers through normal use of it, but even if there is no other barrier to access than changing an id that is considered bypassing access control and can result in jail time in most places. Now I'm not an expert in India's computer misuse laws but I am willing to wager they are not the most progressive when it comes to this kind of thing.
Private disclosure is for when you believe the company cares about security but made a genuine mistake. For the company in the OP it would be more like free education in fundamental privacy and ethics. They're not entitled to that. Name and shame.
There's little public benefit in responsible disclosure here; all it would lead to is the whole thing being swept under the rug with some trivial "fix". There's lots of public benefit in immediate, wide disclosure - the scramble to fix this under pressure from vendors before potential abuse, and any real or imagined attempt at abuse, and subsequent lawsuits, would go far towards educating people and the industry about privacy, security, and bad business practice. It's a nice low real damage, high publicity case.
It's not like this stuff is new. But without serious pressure, the businesses will never learn and never stop making or enrolling into such systems.
Anyway, if it happened over here in the EU, I'd do the responsible disclosure thing and give a full, detailed advance expose to the local Data Protection Authority.
(And if I sound adversarial, then consider that neither the vendor developing such systems, nor the venues using them, are doing it in the interest of the customers.)
I think most people would acknowledge there's a big difference.
Which would still be wrong but you're implying that the business is the victim here when it's the complete opposite.
Nothing wrong about that. Of course still doesn't justify publishing/providing access to client data who did nothing wrong.
Of course in other places, there aren't really any good options. So I guess the most "moral" approach would be to what you think would cause most financial damage to the business and discourage people from going there.
Everyone who designed engineering requirements, technical requirements, test plan, everyone who wrote technical specifications, everyone who performed traceability. It was all approved by security engineers and management.
> The company was founded during the pandemic when contactless dining became popular.
There were tons of people intimately aware of the issue, yet for four years nobody cared.
Most likely the company will blame them for trying to help. Also, if the company is so incompetent that they allow this why bother. He's not getting paid to be their test engineer.
I'll admit it is a bit funny and the damage caused is tiny(just the price of the food). However, things like this do harm the reputation of bug-bounty hunters.
You can get their gender, age, name, mobile number.
I simply reported it to their website's support email and state cyber cell.
This was 7 years ago, that vulnerability still exists.
The other day I was at burger king. They allow you to refill your drink as many times as you like within 60 minutes of purchasing it, and the way this restriction is implemented is by having you scan a QR code they print on your receipt at the drink machine. I scanned the QR code with Binary Eye (android app that reads all sorts of barcodes, highly recommended). It contained some numbers I couldn't immediately recognize as interesting, a timestamp in a format similar to 202409231049, and a UUID.
Now, the UUID is probably the ID of the order in their internal system, so the question is: does the drink machine only read the timestamp or does it also use the UUID to query the internal system to re-validate it? Can you craft a QR code with the same data but change the timestamp to achieve for infinite refills?
Well, can you? :). It's the obvious next thing to try, given that Binary Eye is conveniently also a barcode generator, not just a scanner.
I'm hoping nobody is this naive to let your client have mission critical info to implement something as crucial as giving a discount or refills in your case. It would be just be an extra column in your db table, the only identifier available to the user should be just the UUID, along with some identifier.
the old "HELO" hack
You accidentally stumbling on something unprotected generally clears you from any liability as long as you stop as soon as you notice it.
Code of conduct for white hat hackers is to explore but not abuse, and report as soon as they have enough clarity on the issue. But there is no legal basis for this avoiding any liability except if a company runs an official bounty program.
In that sense, the OP author could face hacking charges if India has similar laws to the rest of the developed world, and the author doesn't even have the "well intentioned" for their defence since they never reached out: the only defence they have is they did not attempt to profit off it.
IANAL, though :)
With a couple of clicks on the web app, you'd encounter a bug... and then you can see every single person's orders, email, and personal addresses. And it was my partner who discovered it (she was struggling to order service through the website bc it kept failing).
Oh and they also never charged us for service despite multiple emails asking them how we should pay (somehow we were able to order service through the site but never paid?)
Clearly they're not a serious company...
source: https://x.com/prstb/status/1838179660959465596
Original blog post, archived copy: https://web.archive.org/web/20240923091701/https://peabee.su...
I am sure some companies using that service will ask for more closed doors before everyone can lookup their revenues. That's one big example of a non technical vulnerability based on a 101 technical principle.
On the other hand, I agree with other comments that posting the whole financials of a company does not seem like a good idea
PS: I really like your writing style. Subscribed your newsletter
Probably. But IMHO it's the right/moral thing to do, posting/showing how to access their client data is of course hardly justifiable.
Yikes.
As one commenter on X(itter) said that the only way this company will think about fixing this is when another competitor who will gather all their customer's details and send emails to them to migrate to their service if they don't want their precious data to leak.
From the comments it seems likely the author realized they may have accidentally committed a crime or at least done something that could cause real legal consequences for them and quickly destroyed the evidence. That's probably better than leaving it up but I'd wager it wouldn't protect them from any legal consequences publishing the article already made possible.
There's a problematic but not critical personal information leak, a mild business intelligence leak and that's about it.
> They could keep this script running for months, even years, creating awkward scenes and uncomfortable conversations at every restaurant across the country.
If that's about the worst thing you can actively do, then it's only about the data leak.
"By following the pattern of when you were there and what you ordered, I found the other person's details too"
Isn’t this just sample size one? In other systems this information can be passed securely and not leaked later.
Having a complete lack of any authentication and sequential IDs does seem like a design decision.
Anyone have a cached copy?
You can spend countless hours trying to break your application, finding holes but who cares.
Police cares about financial fraud. Did someone clickbait you into swindling money from you? well they will pounce on it because they will extract their cut from all involved and it gives them nice PR on the daily newspaper.
PII fraud or vulnerability, eh well. whose gonna notice? we have enough on our plates.
second thing. whatever government is doing, they protect themselves at all costs. they WILL throw you under the bus if it protects their interests.
why? because of the massive population, jobs are scarce, people get college degrees and stuff to pad up their resumes because employers, govt or private REQUIRE documentary evidence you did something. doesn't matter your skills,y ou have the papers or not.
this dotpe company, whatever its doing is indicative of the systemic problems in india. You have lots of people, lots of smart people, lots of dumb people and in the long run, bigger, cheaper, faster. that's all that matters
I think it would be great if you could go to a restaurant and they had this data available. Sure, some menus say "best seller!" but I don't believe them all the time. And tastes change, chefs, etc.
They realize that the whole API does not use authentication or authorization and start reverse engineering it/trying out various endpoints. They can then do things like ordering stuff for other tables, calculate earnings of restaurants, etc.
They probably took it down because they disclosed it publicly directly instead of contacting that QR code based ordering service provider (which I won't mention the name of).
Given that this is a substack which has a newsletter, this article has probably reached many people before being taken offline.
Please no one write that random script… f*king up high cash flow but ultimately usually pretty low margin businesses like these, while also pushing the poor staff around in a way that costs them time and very likely wages is really, really, really bad karma.
Seriously, its a PII leak and it should be reported. And since you said Google is an investor someone (theoretically) should care.
If it wasn't so sad, it would be almost funny that their Terms & Conditions page errors out (for me). The whole page looks pretty broken and like the landingpage is an afterthought...
Anyways, the closest to a contact us is this what I found (after looking for 15 seconds and randomly clicking links) https://dotpe.in/contact-us.html maybe that helps to get in touch at least...
Good thing the APIs can be used to easily identify that company. /s
Makes this blog post sound like an advert for whatever this product is.
Maybe the next big app for AI is to analyze web pages and scrub this crap out of otherwise decent articles.