←back to thread

527 points lxm | 1 comments | | HN request time: 0s | source
Show context
Karrot_Kream ◴[] No.27671804[source]
I gotta say, I disagree with this piece. I, for one, love QR code menus. I can pinch zoom rather than squint at a menu with small/unreadable fonts in dim lighting. I don't need to badger the already exhausted wait staff on a busy night when they forget to drop us a menu or two. When orders are taken online, rather than awkwardly force a friend to not go to the bathroom (or take their kid to the bathroom) until a server can take their order, they can just order and then go. I do think restaurants should handle payment themselves and have the option for paper menus or menus posted on a wall if needed, but otherwise I'm a fan.
replies(5): >>27671896 #>>27672255 #>>27672565 #>>27675012 #>>27678146 #
dheera ◴[] No.27672255[source]
Ugh. Why can't we have both?

First of all it takes a shitton of steps to scan a QR code if you don't have WeChat. On a default Android device you have to click 7 or 8 times to get into the QR scanner thingy inside Google Lens. I carry a 2nd phone with WeChat and I can scan things in 0 seconds flat, but most people don't have it around here in the US.

And then many restaurants' QR menus just redirect you to their website with a terrible experience, and sometimes no pictures.

And then it's annoying as hell to try to read a phone screen in daylight outdoors.

If you can print a QR menu just print the damn menu also. Put the QR code on the menu cover for people who really want that.

These days I often just ask wait staff what they have because I don't want to look at my phone.

replies(5): >>27672264 #>>27672292 #>>27672329 #>>27673378 #>>27673382 #
dragonwriter ◴[] No.27672329[source]
> First of all it takes a shitton of steps to scan a QR code if you don't have WeChat Not really, on most real devices.

> On a default Android device you have to click 7 or 8 times to get into the QR scanner thingy inside Google Lens.

Perhaps, on stock Android with no manufacturer special apps. But the Samsung, Google, and LG Camera apps, at least, have “point at a QR code and the camera reads it”, so it takes as many clicks as opening the Camera app.

replies(2): >>27672460 #>>27672499 #
dheera ◴[] No.27672460[source]
Hm, I have a Pixel 5 and it most certainly doesn't do that. Nothing happens.

https://i.imgur.com/kjFEwiR.jpg

Then again, starting about 5 weeks ago it also stopped responding to "OK Google" and 3 weeks ago it stopped announcing turn-by-turn directions during GPS navigation so I guess this is the state of tech in 2021 :-/

(Definitely don't want an Apple device though, massive privacy issue for me to use a closed source kernel and that I can't easily introspect and MITM SSL requests on to see what data is being sent about me, I do like Android for the fact that I can more or less much hook into any part of the OS and execute custom code to monitor what the hell apps are doing behind the curtain, and even give them fake-but-realistic sensor data to even further protect my privacy.)

replies(4): >>27672525 #>>27672806 #>>27672813 #>>27674702 #
dzhiurgis ◴[] No.27672525[source]
How do you do MITM SSL when pretty much every secure app use key pinning.
replies(1): >>27672547 #
dheera ◴[] No.27672547[source]
Exactly, on iOS it's not easy, on Android it's far easier because the OS listens to you, not Apple or Google, and it's far easier to root Android than it is to jailbreak iOS, or run an open source fork like LineageOS and run the same apps on that.

You can (a) decompile the app, mod it, recompile it, sign it, and then execute it (b) modify the OS to not care about app signatures (c) bypass it with Xposed hooks, ... lots of ways.

replies(1): >>27672775 #
dzhiurgis ◴[] No.27672775[source]
I find hard to believe that you can decompile any app that has bothered implementing key pinning (which I always assumed is done at app level, not OS).
replies(1): >>27673300 #
mcny ◴[] No.27673300[source]
Speaking of https, I will give my own example. I can get to the cockpit (local ip:9090) of my fedora machine on my android phone if I continue past the scary warning but not on my iphone.
replies(2): >>27673958 #>>27674388 #
1. NavinF ◴[] No.27674388{3}[source]
I can bypass the self-signed cert error on my iPhone 8 on iOS 14.4.2

That aside, what's the point? There's no practical threat model where https makes what you're doing more secure. If you have neither a domain name that can use a real TLS cert nor your own CA added to the mobile device, it would be trivial for someone to MITM you. Just configure your Fedora dashboard to use http if you don't care about security