15 seconds... And the standard for TOTP is 30 seconds. So it's not crazy compared to the standard. Though, there's really no reason for the codes to update so fast.
This is the answer here, gyms across the country have implemented nearly identical functionality (bar codes or QR codes are required on entry, staff are trained to be aware of customers sharing or using shared screenshots of the above codes, and the codes have a very short lifetime.)
If you hate the app enough, you could see this as damaging them (consuming its resources without getting the ads). Even if it is negligible, it might feel good.
If you provide a service expecting the user to interact with your service in the way you designed and they do not, that is a problem with your service, not theft.
It would be theft if the user was bypassing payment-gated credentials, but that is not the case here.
Going to bathroom during the commercials is also stealing. Or maybe it's not stealing. The argument quickly becomes more complicated the more you think about it.
I assumed we were talking about the moral argument. Is stealing still stealing if there is no government? If grok takes food from brog in the cave, is that not still wrong?
If someone looks away from ads while they're playing on TV, then watches the show they like, they haven't stolen anything. It's a technical point, not a moral one.
TFA doesn't mention advertising in relation to the specific app in question, nor does it imply that it even has ads. The only mention of it is a broader "I don't like social media because of the ads".
I always pay to remove ads. I only block if I'm left with no option to pay. You might consider it stealing, but I consider forced ads as psychological warfare, so on the whole I feel I'm in a morally fair place.
I assume he's paying a gym membership. IMO, that membership (across all members) should be sufficient to pay for the gym to operate. If not, that's the problem.
yes, just like you're stealing from the supermarket when you buy real food (low to no markup) instead of corn-syruped artificially-flavored slop, alcohol, and cigarettes (high to obscene markup). every time you leave the store without a bag of Doritos, a bottle of MtDew, and a pack of Marlboro, you're being a bad citizen.
>However, I’m super aggressive about social media and feeds I don’t control. Any app that shows me a feed I can’t turn off, sort, or filter—I take that as psychological warfare against me.
Is it just me or are people getting too stuck in a Manichean mindset about this kind of thing? This reads like an alcoholic complaining about a work happy hour or something. Just, don't use the social media stuff.
>For the longest time, my LinkedIn bio was “I HATE LINKEDIN.”
Why do I even have to see it? It is designed to get me sucked in. Imagine if an sober alcoholic must see beer ads every time they open up amazon.com to go shopping.
I hate the "ubiquity" of social media. For me, it's not social media conceptually that's the issue, it's that Meta and others are not good companies. They exist by doing their best to get me addicted to their feeds. It's not healthy. Whether or not there's a non-harmful way to do social media is unknown (by me, at least).
I've taken to using the dumb, low-tech option where possible to try to push back on our techno-dystopian future. Printing out boarding passes, using cash, asking for menus at places with QR codes on the napkins, etc.
Unfortunately, I think it's already impossible to attend major events without a phone, at least if it's a major event at a stadium. Smaller venues still send out emails with QR codes we can just print out.
Ticketing apps are becoming ubiquitous even at small venues, and the app quality is quite low. They failed to pull up my tickets at the last two events I attended, but luckily I have a trustworthy face I guess.
It's quite impossible to actively participate in modern society without a phone anyway. And it's a personal business either way, you can choose another gym. I'm glad mine does QR entry because thanks to that it's open 24/7/365 when there's no staff, even during holidays like Christmas. You can just go anytime that's convenient for you, so it's a trade-off I'm willing to make.
is a world where I have to perpetually carry keys, keycards and wallets one so much worse than the one where I perpetually carry a phone?
The difference is in that the phone is infinitely more useful and potentially useful; and the dystopia only arises from the fact that it has been used against me in accordance to the surveillance state.
The phone, and the carrying of it, is not really the issue.
by consolidating all tools into one tool, the bus factor is now 1. by consolidating all tools into one tool, the quality of individual tools decreases (eg. phone flashlight is adequate for small jobs but is much less effective than a torch). every single god damn person on the train sits there with their head buried in their consolidated tool screen, nobody socializes. there seems to be plenty of issues, privacy notwithstanding.
My favorite gym was a small one where the staff recognized the members. I didn't need to carry anything.
At a couple other gyms (these were some 20 years ago), you gave your name when you came in, they pulled up your photo, and checked if it was close enough. Again, no need to carry anything.
That requires staff, which is expensive, but my point is to highlight there are options where you don't need to carry anything. Those sound like the world I would prefer.
While a phone may often be more useful, it's not infinitely more useful than other options. When I used to regularly swim at neighborhood pool, which is in walking distance, I had an RFID card to get in. The card could fit in my swim trunks. When the weather was warm enough I could walk to the pool carrying only card, towel, and body wash. I didn't bother getting a locker. A phone would have been less convenient and therefore less useful.
Some states have an official app that is accepted as your driver's license, and most stores take NFC payments from your phone, so many people don't even need a wallet anymore.
I used to have a ring of like 2-3 dozen keys. Now the only key I need to carry is for my car.
an entry level smart phone is 150 bucks and can work through several generations.
plenty of places to charge, and lots of free wifi.
its a good thing. they can communicate, call for help, or just stay busy -- you have a lot of free time when you're homeless and jobless, and being able to scroll the internet keeps you in sync w/ the world.
probelm is getting them the phone, and making sure they don't lose it.
My gym also recently introduced a new app that gives you a QR code to get in. but luckily the old system of punching in your member code is still available.
What's with all the negative comments here? I thought this was a reasonably interesting article about _actually hacking something_, whether this person needed to or not. You know, like in "HackerNews"?
I was going to post something positive, but it amounted to "good job, this is a clever way to use AI to improve your quality of life." But it seemed too basic and wouldn't serve as the nucleus for a discussion, so I didn't post it.
Being negative gives people something to talk about.
I didn't post a negative comment, but I found the article deeply unsatisfying. It didn't name the actual gym, and it didn't provide source code. There's nothing that binds it to the real world.
I'm not accusing the story of being a random prompt, but the fact that it could be AI slop makes it less interesting.
The truth is, not everyone is just going to suddenly start building things, especially software, just because its easy.
The AI companies are trying to convince dentists offices they need Claude. The truth is regular people don't care. There's always only going to be a subset of the population that wants to build things.
Another solution could have been to run something like Tasker or Automate to launch app, take QR from current activity (this is the main part) and display just that and once you are done, dismiss the rest of the app.
Somewhat relatedly: did you know that the "RSA Authenticator (SecurID)" app only tries to detect Frida / ptrace hooks for the first few seconds of its runtime, after which it loads the symmetric OTP secret into memory? Now you do.
Does Android not have a "wallet" feature? My gym does the app-based QR code for entry, but on Apple, I just add that app to my wallet and the QR appears there, I only need to access the app proper to check class and pool schedules.
I figured was much, I was just surprised that wasn't an option for this app/gym... I guess they're being actively malicious in making members use the full app for entry...
Marketers need to realize that it's rude to not compensate people for those people helping with marketing.
I think a story of how you saw a dude drying off his gluteal cleft with the hand dryers in the locker rooms would be an appropriate "experience" if the payment is nothing.
This is dated today but I could have sworn I read a similar story here a few years ago about hacking their gym's QR code, but I can't now find it on algolia.
Update: It was hard to find because it was titled, "I accidentally became PureGym’s unofficial Apple Wallet developer"
I like that you took matters into your own hands, but here my preferred approach would have been to approach management and request an alternative access method. I do have separate profiles on my GOS phone for this kind of situations, but I have been on a crusade against phone apps for years now, and ultimately this is a social problem.
I similarly reject apps and QR menus in restaurants, airlines, etc. If you can't be bothered to give me a paper menu, I can't be bothered to eat in your establishment.
Yeah, I'd even leverage the fact that you work in software to make a note about how deeply invasive this is and how much it opens up unnecessary surface areas to attacks.
My gym switched to smartphone/QR code entry. Only those without a smartphone were excepted. (There was a member her 80s with no cell phone, for example.)
I overheard several very forceful discussions from people who had a smartphone but wanted to leave it at home. The staff - likely on orders from the gym chain - refused to budge.
I would tell management that I don't have a cell phone, and, if they refused to oblige when an alternative exists, cancel my membership there and then. Businesses need to be reminded that the customer is king.
While I agree with this on principle, this doesn’t really work on an individual level.
You’re telling a business to change their login requirements (big inconvenience for them) so you don’t have to use an app (small inconvenience for you) and if they don’t you’ll quit (big inconvenience for you, small inconvenience for them). That’s almost never going to work.
But the calculation isn't as simple as you suggest. Smartphones save them money over the older system, which used RFID cards. That meant they needed local staff to handle lost cards. Now if you lost your phone, it's all up to you, and they can deal with other issues over the phone or in-app chat.
The older system allowed booking group classes on the app, online and on a computer in the gym. There was an RFID scanner in the group rooms to check in, with a printed receipt to show the instructor.
The new system got rid of the online and local booking options, and the scanner and printer, which saves them money.
If they figure 1% of the members might leave, but they get more profits from the remaining 99%, then they'll just shrugs at you cancelling your membership over it.
[1] The breaking point for me was the worsening group dynamics. It used to be people would chat to each other before a group class started. It turned into a bunch of people staring at their phones while waiting. It used to be that people would take a short rest between sets. That became a moment to pull out the phone, get distracted, and block others from using the machine or bench. I liked to see and say hello to the staff when I came in, but they reduced staffing, making the gym feel more isolating.
The economics change if enough of us refuse to install their insecure, buggy apps. I'd even accept a web app where at least it lived in the browser sandbox.
That's why we've collectively stopped using fossil fuel, stopped buying clothes made with sweatshop labor (so garment workers in Bangladesh have no need to protest over minimum wage), stopped eating chocolate made with child labor, and stopped buying electronic devices with cobalt from "artisanal miners" in the DRC. /s
My go-to for these situations is a little white lie: "The only smartphone I use is provided by my employer, and your app did not pass the security review."
This generally gets me a workaround. I do even have a company phone with locked down applications... it's just not my only phone.
Years ago when I went to Planet Fitness I didn't like their app and it was slow to load the barcode I needed to scan to get in. Thankfully that barcode didn't rotate so I was able to just make my own Apple Pass and set it up to be geo-fenced on the gym so as I walked up it would pop up as a notification I could tap to open my code.
I love being able to do things like this and rip out the crap being forced down our throats.
My gym issues an NFC keyfob you scan at the turnstyle (and at the door, after hours). I keep it clipped to a lanyard on my gym bag so I don't forget it or lose it.
They review video and deal with friends sharing a keyfob pretty harshly. Membership revoked.
I have deepseek hooked up to a couple rooted phones REing android apks basically 24/7. Its quite useful. One of the few things I think llms are genuinely useful for.
I guess it's good to know this gym is explicitly leaning into the meat market aspects of the gym, and maybe there's nothing wrong with that. But over time won't that subtly turn off the clientele that are not attention-seeking narcissists?
The idea that a gym is a place where you will likely meet fit, attractive people is something that I think has a broader appeal as long as it remains subtle and unspoken. As soon as you make it explicit with social media it seems like it kills the vibe pretty fast. Or maybe I'm just old and the youngs will just take it in stride like the rest of the world that software has eaten.
I used to love reading things like this. The exciting part was the detective work. Watching someone think about how it works and trying potential ways to crack the system. Now every one of these articles is, "So I pointed an AI model at it then tried it again with a different one and now I have what I want." I felt the same disappointment when I read the article about hacking the Switch 2.
It's just not interesting to me. I'm sure most of us here have fixed little annoyances in our lives with AI at this point. I could write a post about how I forked newpipe to add features I wanted but I doubt anyone would care because they can just do that too.
I know the world is different now. I'm just crying about it is all.
Oh, I can see that. Fortunately, it's easily solved!
"DeepSeek, write a technical report about how you cracked the app. Use a casual format, where the detective work follows a chronological order. Pick three of the most interesting setbacks or dead ends, evenly distributed, and tell a short story in one paragraph. Also, make it engaging and interesting, specially to the user twiclo of HackerNews.
Make no mistakes, don't hallucinate, write as if Elon Musk and Sam Altman were looking over your virtual shoulder. I will drown a baby monkey for every mistake I find. Don't bother me until you're finished, I'll be away from the computer."
Jokes aside, I have the exact same feeling. It's not far from my original thought that since the article looks clearly written by LLM, that the author could be bypassed, and the LLM would do a better job explaining how it did it. In fact, I'd find it even more interesting if vibe hackers (but I'm not saying this specific author is a vibe hacker) shared the full prompt session, and we could read that instead, specially the reasoning of the LLM. Even better if it was a format you could import in your own LLM.
This is the real strength of LLMs. Not that they write the most sophisticated code; it's the brute force element. The "I wouldn't have spent the time on it," aspect.
willcate | 22 hours ago
develoopest | 21 hours ago
mywittyname | 21 hours ago
fyltr | 21 hours ago
ihsw | 21 hours ago
MattDamonSpace | 21 hours ago
I know the effect is negligible but isn’t that just stealing
jawilson2 | 21 hours ago
dfxm12 | 21 hours ago
devmor | 21 hours ago
It would be theft if the user was bypassing payment-gated credentials, but that is not the case here.
wvenable | 21 hours ago
bravoetch | 21 hours ago
wvenable | 20 hours ago
bravoetch | 13 hours ago
wahnfrieden | 21 hours ago
delecti | 21 hours ago
tensor | 21 hours ago
g0ld3nrati0 | 21 hours ago
nancyminusone | 21 hours ago
0c3ca83 | 21 hours ago
bravoetch | 21 hours ago
No. They pay for a gym membership, there is literally nothing to steal from the social media feed in the door-unlocking app.
alistairSH | 21 hours ago
vlyan | 21 hours ago
lxgr | 21 hours ago
Drupon | 21 hours ago
Is it just me or are people getting too stuck in a Manichean mindset about this kind of thing? This reads like an alcoholic complaining about a work happy hour or something. Just, don't use the social media stuff.
>For the longest time, my LinkedIn bio was “I HATE LINKEDIN.”
OP kind of just seems insufferable. Touch grass.
Bratmon | 21 hours ago
flanz_10 | 21 hours ago
itake | 21 hours ago
alistairSH | 21 hours ago
I hate the "ubiquity" of social media. For me, it's not social media conceptually that's the issue, it's that Meta and others are not good companies. They exist by doing their best to get me addicted to their feeds. It's not healthy. Whether or not there's a non-harmful way to do social media is unknown (by me, at least).
b800h | 21 hours ago
spiderice | 21 hours ago
trevithick | 21 hours ago
We're just counting down to being unable to exist without a smartphone on your person at all times. What a dystopia.
esseph | 21 hours ago
I posted about it yesterday, I think.
stvltvs | 16 hours ago
pc86 | 21 hours ago
Right?
mywittyname | 21 hours ago
Unfortunately, I think it's already impossible to attend major events without a phone, at least if it's a major event at a stadium. Smaller venues still send out emails with QR codes we can just print out.
stvltvs | 16 hours ago
diath | 21 hours ago
taco_emoji | 21 hours ago
setr | 20 hours ago
The difference is in that the phone is infinitely more useful and potentially useful; and the dystopia only arises from the fact that it has been used against me in accordance to the surveillance state.
The phone, and the carrying of it, is not really the issue.
thin_carapace | 19 hours ago
eesmith | 19 hours ago
At a couple other gyms (these were some 20 years ago), you gave your name when you came in, they pulled up your photo, and checked if it was close enough. Again, no need to carry anything.
That requires staff, which is expensive, but my point is to highlight there are options where you don't need to carry anything. Those sound like the world I would prefer.
While a phone may often be more useful, it's not infinitely more useful than other options. When I used to regularly swim at neighborhood pool, which is in walking distance, I had an RFID card to get in. The card could fit in my swim trunks. When the weather was warm enough I could walk to the pool carrying only card, towel, and body wash. I didn't bother getting a locker. A phone would have been less convenient and therefore less useful.
joquarky | 16 hours ago
I used to have a ring of like 2-3 dozen keys. Now the only key I need to carry is for my car.
singleshot_ | 59 minutes ago
gumby | 18 hours ago
Even homeless people need smart phones these days in order to interact with the agencies that help them.
red-iron-pine | an hour ago
plenty of places to charge, and lots of free wifi.
its a good thing. they can communicate, call for help, or just stay busy -- you have a lot of free time when you're homeless and jobless, and being able to scroll the internet keeps you in sync w/ the world.
probelm is getting them the phone, and making sure they don't lose it.
S0y | 20 hours ago
nkg | 20 hours ago
yahway | 20 hours ago
Volundr | 13 hours ago
eddyg | 18 hours ago
Don't Vibe Code in Between Sets
Keep your rest time for recovery, not React components.
Please refrain from writing code, checking commits, or prompting Al during your workout.
Be present. Lift harder. Ship later.
https://x.com/iansbrash/status/2112219912475156650/photo/1
otter-in-a-suit | 21 hours ago
mywittyname | 21 hours ago
Being negative gives people something to talk about.
stickfigure | 19 hours ago
I'm not accusing the story of being a random prompt, but the fact that it could be AI slop makes it less interesting.
blue_green_maps | 21 hours ago
lifeisloving | 21 hours ago
The AI companies are trying to convince dentists offices they need Claude. The truth is regular people don't care. There's always only going to be a subset of the population that wants to build things.
red-iron-pine | an hour ago
why do I need to burn tokens to do this?
smusamashah | 21 hours ago
throwaway89201 | 21 hours ago
alistairSH | 21 hours ago
esseph | 21 hours ago
https://wallet.google/
alistairSH | 18 hours ago
RobotToaster | 21 hours ago
elAhmo | 21 hours ago
nancyminusone | 21 hours ago
An excellent portal to accept a fictionalized ai slop version of "your" experience. Make it long, and maybe put a recipe at the bottom.
lenerdenator | 21 hours ago
I think a story of how you saw a dude drying off his gluteal cleft with the hand dryers in the locker rooms would be an appropriate "experience" if the payment is nothing.
eterm | 21 hours ago
Update: It was hard to find because it was titled, "I accidentally became PureGym’s unofficial Apple Wallet developer"
https://news.ycombinator.com/item?id=44910865
drnick1 | 21 hours ago
I similarly reject apps and QR menus in restaurants, airlines, etc. If you can't be bothered to give me a paper menu, I can't be bothered to eat in your establishment.
paimapi | 21 hours ago
eesmith | 21 hours ago
I overheard several very forceful discussions from people who had a smartphone but wanted to leave it at home. The staff - likely on orders from the gym chain - refused to budge.
drnick1 | 20 hours ago
kimos | 20 hours ago
You’re telling a business to change their login requirements (big inconvenience for them) so you don’t have to use an app (small inconvenience for you) and if they don’t you’ll quit (big inconvenience for you, small inconvenience for them). That’s almost never going to work.
eesmith | 19 hours ago
But the calculation isn't as simple as you suggest. Smartphones save them money over the older system, which used RFID cards. That meant they needed local staff to handle lost cards. Now if you lost your phone, it's all up to you, and they can deal with other issues over the phone or in-app chat.
The older system allowed booking group classes on the app, online and on a computer in the gym. There was an RFID scanner in the group rooms to check in, with a printed receipt to show the instructor.
The new system got rid of the online and local booking options, and the scanner and printer, which saves them money.
If they figure 1% of the members might leave, but they get more profits from the remaining 99%, then they'll just shrugs at you cancelling your membership over it.
[1] The breaking point for me was the worsening group dynamics. It used to be people would chat to each other before a group class started. It turned into a bunch of people staring at their phones while waiting. It used to be that people would take a short rest between sets. That became a moment to pull out the phone, get distracted, and block others from using the machine or bench. I liked to see and say hello to the staff when I came in, but they reduced staffing, making the gym feel more isolating.
stvltvs | 16 hours ago
eesmith | 7 hours ago
That's why we've collectively stopped using fossil fuel, stopped buying clothes made with sweatshop labor (so garment workers in Bangladesh have no need to protest over minimum wage), stopped eating chocolate made with child labor, and stopped buying electronic devices with cobalt from "artisanal miners" in the DRC. /s
devmor | 20 hours ago
This generally gets me a workaround. I do even have a company phone with locked down applications... it's just not my only phone.
QuercusMax | 21 hours ago
lxgr | 21 hours ago
QuercusMax | 20 hours ago
joshstrange | 21 hours ago
I love being able to do things like this and rip out the crap being forced down our throats.
mywittyname | 21 hours ago
The person at the front desk was absolutely no help and could have been replaced with a sign that said, "you can do everything in the app."
stvltvs | 16 hours ago
hk__2 | 21 hours ago
For the last part, it’s maybe not the best idea to put a link "GitHub & CV" at the bottom then ;)
SoftTalker | 21 hours ago
They review video and deal with friends sharing a keyfob pretty harshly. Membership revoked.
lifeisloving | 21 hours ago
dasil003 | 21 hours ago
The idea that a gym is a place where you will likely meet fit, attractive people is something that I think has a broader appeal as long as it remains subtle and unspoken. As soon as you make it explicit with social media it seems like it kills the vibe pretty fast. Or maybe I'm just old and the youngs will just take it in stride like the rest of the world that software has eaten.
twiclo | 21 hours ago
It's just not interesting to me. I'm sure most of us here have fixed little annoyances in our lives with AI at this point. I could write a post about how I forked newpipe to add features I wanted but I doubt anyone would care because they can just do that too.
I know the world is different now. I'm just crying about it is all.
ASalazarMX | 20 hours ago
"DeepSeek, write a technical report about how you cracked the app. Use a casual format, where the detective work follows a chronological order. Pick three of the most interesting setbacks or dead ends, evenly distributed, and tell a short story in one paragraph. Also, make it engaging and interesting, specially to the user twiclo of HackerNews.
Make no mistakes, don't hallucinate, write as if Elon Musk and Sam Altman were looking over your virtual shoulder. I will drown a baby monkey for every mistake I find. Don't bother me until you're finished, I'll be away from the computer."
Jokes aside, I have the exact same feeling. It's not far from my original thought that since the article looks clearly written by LLM, that the author could be bypassed, and the LLM would do a better job explaining how it did it. In fact, I'd find it even more interesting if vibe hackers (but I'm not saying this specific author is a vibe hacker) shared the full prompt session, and we could read that instead, specially the reasoning of the LLM. Even better if it was a format you could import in your own LLM.
abstractspoon | 14 hours ago
alsetmusic | 21 hours ago
This is the real strength of LLMs. Not that they write the most sophisticated code; it's the brute force element. The "I wouldn't have spent the time on it," aspect.
citguru | 21 hours ago