Hacker News new | past | comments | ask | show | jobs | submit | bluetidepro's comments login

All that work for ONLY a $240 Amazon gift card is absolutely wild to me. It still surprises me that people choose not exploit these things when these mega corporations basically award them pennies for finding major vulnerabilities like this.


I was going to complain about that, but then I looked at their bug bounty program: https://mcdelivery.co.in/bug-bounty

"The reward for a valid bug will be Rs. 2,500/- (Rupees Two Thousand Five Hundred only) in the form of coupons (applicable only in McDonald’s India West & South). Such coupons shall need to be used within the validity period mentioned therein and shall not be, encashable or transferable."

That's less than $30 per bug in non-transferable McDonald's coupons that only work in India, which is thousands of miles away from the bug reporter. Compared to what he thought he would get, a $240 Amazon gift card is a good deal.


It would be nice to see rewards that scale with severity. Ultimately they did accomodate me by sending a gift card I can use instead of coupons I would likely have given away, so I appreciate that. Most companies don't offer me anything!


+1 to that. McDonald's is sending out a clear message that exploits and vulnerabilities in the future will NOT be rewarded when reported to them.


Not so sure. I think the prestige these days is very valuable considering we are a society that values this sort of thing.


So what you are saying is, they are working for exposure?


There are certainly more things I could have done to get more $/hour. I ultimately find these things enjoyable and help keep my skills sharp.


Then you’d have to actually eat at McDonalds though


You could resell it and offer to order for people if they pay you half the regular price.


I don’t know how popular this service is in India, but holy cow these abilities could easily be exploited for nefarious purposes:

* The ability to steal/hijack/redirect other people’s delivery orders through a specific sequence of carefully timed API calls.

* The ability to retrieve the details of any order.

Wait for a target to order something, redirect the delivery to yourself. Then take the order and deliver it yourself to the target. Access granted, and you’ve got a nice fall guy- the original delivery person. IDK, I’m not a criminal, but seems like it could go for more than $240 on the black market.


Id take free Mcdonalds for a year via exploit over this. Heck they might have never catched it!


Eventually some accounting report will surface the discrepancy and the cops will be waiting for you.

No McDonalds is worth a felony.


I wonder how many hashbrowns a "robinhood" style hacker could have sent to strangers, or orders-in-transits discounted to a dollar, before they caught on.


in my experience corporate appathy in large companies is a near infinite resource but im probably still to optimistic.

it reminds me of a mysterious building no one knew the origin or purpose of. someone filled a form for poor cleaning then the message bounced around between a dozen cleaning companies who didn't have a contact for it. after decades a cleaning company filled a form because it didn't have a number and wasn't on the drawings.


Could you elaborate on that story?


-


As others have said, I would love to see more variations to show “options” on ties, and also have more customization around holidays. Not just show/hide but adding and removing custom dates would be great!


Make one for the NFL, please! I can’t stand how hard it is to get scores on their website. Haha


Funny you would mention that. A few weeks ago, I wrote a Python-based client library [0] for the website kicker.de [1]. It supports the NFL, too:

    import asyncio
    from kickerde_api_client import Api
    from kickerde_api_client.model import LeagueId

    api = Api()
    query = {'league': LeagueId.NFL, 'season': '2024/25'}
    season = asyncio.run(api.league_season(**query))
    
    print(season['longName'])             # 'National Football League'
    print(season['country']['longName'])  # 'USA'
    
    print([
        team['shortName']
        for team in season['teams'].values()
        if team['shortName'].startswith('B')
    ])                                    # ['Buffalo', 'Baltimore']
    
    day = season['gamedays'][18]
    print(str(day['dateFrom'].date()))    # '2025-01-05'
[0]: https://kickerde-api-client.readthedocs.io/en/stable/autoapi...

[1]: https://www.kicker.de/


There's like a gazzillion alternative scoring sites. Googling the team name also works while they're playing, Google usually has a good feed.


Off topic but related… With so many ways to get around downloading videos/media like this for example, I will never understand why companies don’t just allow videos to be saved like a picture. Add a simple download button to make it obvious and simple for users to download a video. For example, Tiktok has this, and just adds their watermark to the downloaded video.

It’s just a false sense of security to users when they think people “can’t” download their content. Even apps like Snapchat that are marketed to be “save proof” are def not. I think it’s a betrayal to the user for any company to pretend a user’s media is “safe” from downloads/screenshots/etc.


Pretty obvious isn’t it? If you download the video from youtube/twitter/whatever and you watch it from your hard drive next time, they can’t serve you an ad.


They want to spy on what you are doing when browsing their website, giving you a video without hoops to jump through stops them from doing that.

They don't really care if you have a good time or if you really watch the video, it's just a bait.


If they used standard HTML video elements it would be just as easy, but everyone wants to use their own non-standard players.


Actually most use the HTML video element but use JS to download blobs and add them as src, and/or bury the elements like this:

https://imgur.com/C8AP7y0 (random video I found on threads as an example)

Just to break native download functionality and/or add own silly controls on top.


It keeps 95% of people from downloading it.


> "...but part of the issue is that their shows just aren't that good..."

Hard disagree from a personal view. Also statistically, I don't think you can strongly claim this since many of their shows have lots of awards if you go off that metric. I haven't done the calculations but I would guess that their content to award ratio is even higher than many other networks.


>I haven't done the calculations but I would guess that their content to award ratio is even higher than many other networks.

That is probably true, but only because they have so little content overall. It is nice that it's not choke full of low budget reality nonsense and foreign stuff, but they also have basically none of the back catalog of content that other services have.


Whatever the reason may be, the article outlines a few possibilities, I do agree there is a ton of great content on Apple TV+ that people are sleeping on. I recently watched "The Morning Show", "For All Mankind", and "Presumed Innocent." All were absolutely incredible shows, and none of my friends had heard of them (people who are usually very up to date with shows) furthering that their marketing is not the best for their tv content. Ted Lasso seems to be the only show of theirs that I've felt like broke through all the noise and is most widely known.

However, I do think they have been marketing their movies a lot better. One the new movies "Wolfs" with Brad Pitt, and George Clooney had billboards all over my city. I know many people that did watch that the first week it came out.


For all mankind is a great show - nobody ever heard of it, but it's great


Watch out, the Lego police will you get you if it's illegal.


Nah they just won't produce it, just like how "Quest Builder" was rejected despite having a ton of support


100% this. It's laughable if you believe those requests work as expected. Sure they may "delete" some surface level bs like your account or login, but there is no way it's 100% scrubbed in the way it's supposed to work.


A lot of recourse is around intent and liability. I would like to believe my request is honored; in the event it is later proved to not have been honored, recourse is potentially available through legal and regulatory mechanisms.

23andme didn't implement strong customer identity and auth mechanisms, for example, and it cost them ~$30M to settle their data breach liability [1]. Take action, keep receipts, and failing good faith actions, step back while regulators and the legal system whack whack whack with a hammer.

[1] https://news.ycombinator.com/item?id=41536494 ("HN: 23andMe settles data breach lawsuit for $30M")


Oh nice, "~$30M to settle." That <$100 you get back in the class action will be amazing compensation. Sadly the legal route is a joke at this point.


> I'm happy if it contributes to the death of the org.

But the not the death of your data. That will be sold onto someone else.


Slightly off topic but when I read the headline, I assumed "large crater" would be much more large than you see in the picture. The article reports "7 meters (23 feet) in diameter and 1 meter (3 feet) deep." For a bomb that doesn't seem that "large."

Luckily no one was hurt or nearby when it went off.


The US 500lb bombs had about 270lbs of explosives in them. If this location were a WW-II airfield, it is the sort of bomb that would have been dropped on airplanes on the ground to destroy them.

Most of the damage to Japan's cities was actually done by napalm-filled bomblets combined into cluster-bombs[1], partly because weather made precision bombing difficult.

1: https://en.wikipedia.org/wiki/M69_incendiary


Also Japanese construction was conveniently, for the US, extremely flammable so you could do way more damage starting a firestorm than you could with the same number of bombers filled with traditional bombs.

There was also the incredible plan to fill a bomb with bats strapped with tiny incendiary charges on timers so they would be dropped, go roost somewhere, and hopefully start even wider spread fires. They spent about 2 million dollars on it before it was cancelled because the atomic bomb was showing much better progress. They also accidentally proved it's effectiveness and burned down part of the testing facility.

https://en.wikipedia.org/wiki/Bat_bomb


Similarly, the Japanese launched over 9000 incendiary balloon bombs against the US & Canada, but they were generally ineffective. Six civilians were killed in Oregon in 1945.

https://en.wikipedia.org/wiki/Fu-Go_balloon_bomb


Yeah one of the few instances of damage on the US side of the world from WW2 and it barely did anything. The US was incredibly fortunate to not have to fight basically any of the war on the home front. We rode that wave for a couple decades as Europe and Japan etc rebuilt.


Side comment - as a PNW resident, what a cool username!


It was the great success of the Allied firebombing campaign that inflicted suburbia on the United States. US construction is just as flammable but fire is less likely to spread when the houses are farther apart.

(Let's rephrase the success part. The campaign was destructive and deadly for the civilian population but did nothing to end the war earlier. Bomber Harris and the Lord Lindemann got a career boost, though.)


There are many contemporary sources on the Japanese side that suggest the firebombings did hasten the (inevitable at this point) surrender. The US certainly had a strategic desire for Japan to surrender to the US rather than the USSR.


Yeah it turns out the whole idea of morale bombing is pretty flawed, it largely just galvanizes the population it turns out; Japan, England and Germany all reacted similarly, maybe for different cultural reasons but it was ineffective everywhere.


> but did nothing to end the war earlier

Really? To assert this, you need to show not that Axis production didn't decline, but that the damage done didn't prevent production from increasing even more. How does one show that?


Here is a good critique of the concept of strategic airpower: https://acoup.blog/2022/10/21/collections-strategic-airpower...

Axis production continued increasing, according to this, it tripled after the bombing campaign started.


Which, of course, proves nothing. What matters is how much it would have increased without the bombing.

Actually, it's even worse than that, since one must also subtract from this production the resources Germany was putting into air defense. This effort was massive.


Did you read the ACOUP article? I remember reading it when it was published, and it changed my mind on the topic.


I did. He was critiquing theories that airpower could win wars. This doesn't mean airpower can't help win a war. There's a large space between "useless" and "all important".

The Germans ended up devoting 1/4 of their war production and a million men to antiaircraft defense.


You are completely ignoring Japanese mindset during that time. Absolute devotion to emperor, casualties could be in millions and that wouldn't change anything. Their suicidal charges and not giving up alive are pretty famous and this comes from certain place, same as kamikadze. Some rational counting of outputs may be for bureaucrats but those were not holding any real power in Japan empire.

There is a lot of speculation why emperor and generals surrendered, even atomic bombs may not have been the triggering point as much as soviet declaration of war to Japan at 8 August 1945. Most probably it all compounded.


It's not impossible we have internal documents from the time, the US was actively reading all of the diplomatic traffic and basically anything broadcast via radio anywhere in the Japanese government. One big sticking point that appears in a lot of discussions is the demand for unconditional surrender, a lot of effort diplomatically was spent around getting past the allied agreement to only accept unconditional surrender. One big factor in that from the primary sources was the possibility of the emperor being executed or completely dethroned.


The war in Europe is highly arguable in both directions.

To assert that the bombing campaign did nothing for the war in the Pacific flies in the face of recorded history. We literally have the imperial Japanese equivalent of meeting minutes where they talk about this stuff and toward the end the sheer destruction of the bombing campaign did affect the credibility of the militarists "yeah we can still pull this off" claims in the eyes of many of the others.


> It was the great success of the Allied firebombing campaign that inflicted suburbia on the United States.

BS


Did historical bombs typically make big explosions? Reading some numbers from the war, it seemed like the strategy was more to dump enormous volume of ordinance and hope to get lucky hitting something vital.


That strategy was not because the bombs weren't very destructive, but because they just could not be placed accurately. So they had to drop a lot of bombs and hope a few of them hit the strategically important targets.


Yep. The US did drop around 160,800 tons of conventional bombs on Japan during WWII, thought that's still relatively tame compared to the 623,000 tons they drop on Germany. Though the two nukes more than made up for it, I guess.

Bomb findings during construction is nothing especially rare in these countries.


The conventional bombing of Japan was scheduled for massive increase. To quote Ian Toll's "Twilight of the Gods":

> If the war had lasted any longer than it did, the scale and ferocity of the conventional bombing campaign would have risen to inconceivable new heights. [...] At the height of the bombing campaign, between May and August 1945, a monthly average of 34,402 tons of high explosive and incendiary bombs were dropped on Japan. According to USAAF chief Hap Arnold, the monthly total would have reached 100,000 tons in September 1945, and then risen steadily month by month. By early 1946, if the Japanese were still fighting, eighty USAAF combat groups would be operating against Japan, a total of about 4,000 bombers. In January 1946, they would drop 170,000 tons of bombs on Japan, surpassing in one month the cumulative tonnage actually dropped on the country during the entire Pacific War. By March 1946, the anticipated date of the CORONET landings on the Tokyo plain, the monthly bombing figure would surpass 200,000 tons.


> The conventional bombing of Japan was scheduled for massive increase.

Allegedly.

It's possible it's true, but claims like this have the incentive of selling the "atom bombing Hiroshima and Nagasaki was necessary and justified" narrative behind them, so that should be taken into account as a factor.

It doesn't even have to be consciously disingenous - the more one can convince oneself (and thus eventually others) of how destructive and costly conventional warfare would have been, the more digestible the nuclear option becomes, so there's a lot of motivation to fuel some motivated reasoning.


There's no reason to doubt it. The resources that had been devoted to Europe were freed up and now could be fully focused on Japan.


Professionals talk logistics indeed. To imagine what kind is pipeline would be required to enable such a venture. Producing, assembling, and shipping millions of tons of explosives as a continual operation.


'Between 1965 and 1975, the United States and its allies dropped more than 7.5 million tons of bombs on Vietnam, Laos, and Cambodia—double the amount dropped on Europe and Asia during World War II.' - https://storymaps.arcgis.com/stories/2eae918ca40a4bd7a55390b...


>Though the two nukes more than made up for it, I guess.

Not if you go by the kiloton rating of those two bombs: they were each in the kiloton range (around 10-15 kT IIRC), so if you add a generous 30,000 tons to the 160,800 you mentioned before, that's 190,800 tons, still far short of the 623,000 tons dropped on Germany.


So like, is “no unexploded ordinances detected” a checkbox/service for those “call before you dig” organizations in those places?


In some parts of France, you can’t dig without getting a specialized surveyor inspection and certificate it’s safe to dig this deep in that place first.


Absolutely. In my country it is mandatory to submit an UXO report as part of getting the building permit for nontrivial stuff. Most of the time this is boring office work (Was there a strategic target nearby during WWII? Are there any records of bombing happening here? Have there been earthworks in the last 70 years significant enough to rule out anything still remaining?) and you get a report noting that there's no risk expected, but sometimes you have to call in the cavalry and go searching with ground-penetrating radar.

It's just part of doing business, really. Same story with archaeological remains, chemical contamination, or threatened animal species.


It would have done considerably more damage if it had gone off when and where it was intended. The runway is designed to have enormous, heavy planes takeoff and land on it routinely, it undoubtedly absorbed a lot of the bomb’s energy. Not to mention the earth underneath it.


> It would have done...

Real WWII historians could probably determine the date on which the bomb was dropped, its intended target, etc., etc.

But with the condition that most of Japan was in, later in WWII - I'm thinking that "gone off where & when intended" would probably have had little effect. Most of the country was burned-out rubble.


That's likely a stock image completely unrelated to the actual explosion. Blame reporters(or the sites they work for) for normalizing this behavior.

If it's not, I can't tell because it's hard to get a sense of scale from the video and image. The crater only appears maybe 2 or 3 meters wide judging by the grass, the painted stripes, and the overall taxiway width.


A crater that size can hold 80,000lb of dirt.


That's a lot of earth though. Most bombs detonate above the ground because rock is really heavy.


Agreed, seems very very small for 5000lb of explosives. Guessing it didn't reach its full yield given that its been buried under ground for decades.


If the crater is only 1 meter deep then the bomb was likely more shallow than that (although some of the ejected dirt will fall back into the crater). So much of the bomb's energy went into the atmosphere.


~270lbs of explosives in a US 500lb bomb.


Article says 500lb.


Watch the video- it was a large bomb


Apparently it was sized appropriately to shut down the airport.

A larger probability of a small crater(s) requiring repair would seem better for this purpose than a smaller probability of a large crater.


that's a little bigger than my old apartment. i think it doesn't look big in the picture because nothing is visible nearby to give it scale


a large crater the size of a small crater.

the reference: https://time.com/5772944/large-small-boulder/


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: