Rendered at 07:04:11 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
twiclo 12 hours ago [-]
I used to love reading things like this. The exciting part was the detective work. Watching someone think about how it works and trying potential ways to crack the system. Now every one of these articles is, "So I pointed an AI model at it then tried it again with a different one and now I have what I want." I felt the same disappointment when I read the article about hacking the Switch 2.
It's just not interesting to me. I'm sure most of us here have fixed little annoyances in our lives with AI at this point. I could write a post about how I forked newpipe to add features I wanted but I doubt anyone would care because they can just do that too.
I know the world is different now. I'm just crying about it is all.
abstractspoon 6 hours ago [-]
+1
ASalazarMX 11 hours ago [-]
Oh, I can see that. Fortunately, it's easily solved!
"DeepSeek, write a technical report about how you cracked the app. Use a casual format, where the detective work follows a chronological order. Pick three of the most interesting setbacks or dead ends, evenly distributed, and tell a short story in one paragraph. Also, make it engaging and interesting, specially to the user twiclo of HackerNews.
Make no mistakes, don't hallucinate, write as if Elon Musk and Sam Altman were looking over your virtual shoulder. I will drown a baby monkey for every mistake I find. Don't bother me until you're finished, I'll be away from the computer."
Jokes aside, I have the exact same feeling. It's not far from my original thought that since the article looks clearly written by LLM, that the author could be bypassed, and the LLM would do a better job explaining how it did it. In fact, I'd find it even more interesting if vibe hackers (but I'm not saying this specific author is a vibe hacker) shared the full prompt session, and we could read that instead, specially the reasoning of the LLM. Even better if it was a format you could import in your own LLM.
trevithick 13 hours ago [-]
The bigger issue is that to use this gym, you must own a smartphone and you must bring it with you and carry it around while you work out.
We're just counting down to being unable to exist without a smartphone on your person at all times. What a dystopia.
diath 13 hours ago [-]
It's quite impossible to actively participate in modern society without a phone anyway. And it's a personal business either way, you can choose another gym. I'm glad mine does QR entry because thanks to that it's open 24/7/365 when there's no staff, even during holidays like Christmas. You can just go anytime that's convenient for you, so it's a trade-off I'm willing to make.
gumby 10 hours ago [-]
> It's quite impossible to actively participate in modern society without a phone anyway.
Even homeless people need smart phones these days in order to interact with the agencies that help them.
taco_emoji 12 hours ago [-]
Easily solvable problem though. NFC keys, RFID keycard, scan a driver's license, etc.
setr 12 hours ago [-]
is a world where I have to perpetually carry keys, keycards and wallets one so much worse than the one where I perpetually carry a phone?
The difference is in that the phone is infinitely more useful and potentially useful; and the dystopia only arises from the fact that it has been used against me in accordance to the surveillance state.
The phone, and the carrying of it, is not really the issue.
eesmith 10 hours ago [-]
My favorite gym was a small one where the staff recognized the members. I didn't need to carry anything.
At a couple other gyms (these were some 20 years ago), you gave your name when you came in, they pulled up your photo, and checked if it was close enough. Again, no need to carry anything.
That requires staff, which is expensive, but my point is to highlight there are options where you don't need to carry anything. Those sound like the world I would prefer.
While a phone may often be more useful, it's not infinitely more useful than other options. When I used to regularly swim at neighborhood pool, which is in walking distance, I had an RFID card to get in. The card could fit in my swim trunks. When the weather was warm enough I could walk to the pool carrying only card, towel, and body wash. I didn't bother getting a locker. A phone would have been less convenient and therefore less useful.
joquarky 8 hours ago [-]
Some states have an official app that is accepted as your driver's license, and most stores take NFC payments from your phone, so many people don't even need a wallet anymore.
I used to have a ring of like 2-3 dozen keys. Now the only key I need to carry is for my car.
thin_carapace 11 hours ago [-]
by consolidating all tools into one tool, the bus factor is now 1. by consolidating all tools into one tool, the quality of individual tools decreases (eg. phone flashlight is adequate for small jobs but is much less effective than a torch). every single god damn person on the train sits there with their head buried in their consolidated tool screen, nobody socializes. there seems to be plenty of issues, privacy notwithstanding.
bothers 5 hours ago [-]
[dead]
eddyg 10 hours ago [-]
Gyms need reminders these days:
Don't Vibe Code in Between Sets
Keep your rest time for recovery, not React components.
Please refrain from writing code, checking commits, or prompting Al during your workout.
My gym also recently introduced a new app that gives you a QR code to get in. but luckily the old system of punching in your member code is still available.
nkg 12 hours ago [-]
As a new owner of EV, I can confirm that without a smartphone the experience is hair-raising.
yahway 11 hours ago [-]
Tesla's have cards as do all others I am aware of. But the car is a tracking data harvesting computer so I just give up.
Volundr 5 hours ago [-]
Eh? How so?
pc86 13 hours ago [-]
Don't worry, smartphones are cheap, can be easily upgraded by the user, and last for a decade or more before needing upgrade or replacement.
Right?
esseph 13 hours ago [-]
A bank in Japan just blocked website access for account tasks. MUST use a phone with their app.
I posted about it yesterday, I think.
josefritzishere 12 hours ago [-]
[dead]
stvltvs 8 hours ago [-]
I hear that's par for the course in Europe.
mywittyname 13 hours ago [-]
I've taken to using the dumb, low-tech option where possible to try to push back on our techno-dystopian future. Printing out boarding passes, using cash, asking for menus at places with QR codes on the napkins, etc.
Unfortunately, I think it's already impossible to attend major events without a phone, at least if it's a major event at a stadium. Smaller venues still send out emails with QR codes we can just print out.
stvltvs 8 hours ago [-]
Ticketing apps are becoming ubiquitous even at small venues, and the app quality is quite low. They failed to pull up my tickets at the last two events I attended, but luckily I have a trustworthy face I guess.
eterm 13 hours ago [-]
This is dated today but I could have sworn I read a similar story here a few years ago about hacking their gym's QR code, but I can't now find it on algolia.
Update: It was hard to find because it was titled, "I accidentally became PureGym’s unofficial Apple Wallet developer"
I like that you took matters into your own hands, but here my preferred approach would have been to approach management and request an alternative access method. I do have separate profiles on my GOS phone for this kind of situations, but I have been on a crusade against phone apps for years now, and ultimately this is a social problem.
I similarly reject apps and QR menus in restaurants, airlines, etc. If you can't be bothered to give me a paper menu, I can't be bothered to eat in your establishment.
paimapi 13 hours ago [-]
Yeah, I'd even leverage the fact that you work in software to make a note about how deeply invasive this is and how much it opens up unnecessary surface areas to attacks.
devmor 12 hours ago [-]
My go-to for these situations is a little white lie: "The only smartphone I use is provided by my employer, and your app did not pass the security review."
This generally gets me a workaround. I do even have a company phone with locked down applications... it's just not my only phone.
eesmith 12 hours ago [-]
My gym switched to smartphone/QR code entry. Only those without a smartphone were excepted. (There was a member her 80s with no cell phone, for example.)
I overheard several very forceful discussions from people who had a smartphone but wanted to leave it at home. The staff - likely on orders from the gym chain - refused to budge.
drnick1 12 hours ago [-]
I would tell management that I don't have a cell phone, and, if they refused to oblige when an alternative exists, cancel my membership there and then. Businesses need to be reminded that the customer is king.
kimos 11 hours ago [-]
While I agree with this on principle, this doesn’t really work on an individual level.
You’re telling a business to change their login requirements (big inconvenience for them) so you don’t have to use an app (small inconvenience for you) and if they don’t you’ll quit (big inconvenience for you, small inconvenience for them). That’s almost never going to work.
eesmith 11 hours ago [-]
Sure. I left in part over this change. [1]
But the calculation isn't as simple as you suggest. Smartphones save them money over the older system, which used RFID cards. That meant they needed local staff to handle lost cards. Now if you lost your phone, it's all up to you, and they can deal with other issues over the phone or in-app chat.
The older system allowed booking group classes on the app, online and on a computer in the gym. There was an RFID scanner in the group rooms to check in, with a printed receipt to show the instructor.
The new system got rid of the online and local booking options, and the scanner and printer, which saves them money.
If they figure 1% of the members might leave, but they get more profits from the remaining 99%, then they'll just shrugs at you cancelling your membership over it.
[1] The breaking point for me was the worsening group dynamics. It used to be people would chat to each other before a group class started. It turned into a bunch of people staring at their phones while waiting. It used to be that people would take a short rest between sets. That became a moment to pull out the phone, get distracted, and block others from using the machine or bench. I liked to see and say hello to the staff when I came in, but they reduced staffing, making the gym feel more isolating.
stvltvs 8 hours ago [-]
The economics change if enough of us refuse to install their insecure, buggy apps. I'd even accept a web app where at least it lived in the browser sandbox.
joshstrange 13 hours ago [-]
Years ago when I went to Planet Fitness I didn't like their app and it was slow to load the barcode I needed to scan to get in. Thankfully that barcode didn't rotate so I was able to just make my own Apple Pass and set it up to be geo-fenced on the gym so as I walked up it would pop up as a notification I could tap to open my code.
I love being able to do things like this and rip out the crap being forced down our throats.
stvltvs 8 hours ago [-]
If it doesn't rotate, I'd just take a screenshot and put a shortcut to it on the home screen.
mywittyname 13 hours ago [-]
I spent 30 minutes trying to get my friend's "visitor pass" to work for me, before giving up.
The person at the front desk was absolutely no help and could have been replaced with a sign that said, "you can do everything in the app."
alistairSH 13 hours ago [-]
Does Android not have a "wallet" feature? My gym does the app-based QR code for entry, but on Apple, I just add that app to my wallet and the QR appears there, I only need to access the app proper to check class and pool schedules.
RobotToaster 13 hours ago [-]
Yes it does, I use it for my Gym's barcode and NFC login.
I figured was much, I was just surprised that wasn't an option for this app/gym... I guess they're being actively malicious in making members use the full app for entry...
blue_green_maps 13 hours ago [-]
This is the future of software with AI: everyone can have hyper-personalized software to solve very personally-specific problems.
lifeisloving 12 hours ago [-]
The truth is, not everyone is just going to suddenly start building things, especially software, just because its easy.
The AI companies are trying to convince dentists offices they need Claude. The truth is regular people don't care. There's always only going to be a subset of the population that wants to build things.
willcate 13 hours ago [-]
Wow. The QR code changing every 15 minutes... that's like trying to get into a rock concert. Well done
mywittyname 13 hours ago [-]
15 seconds... And the standard for TOTP is 30 seconds. So it's not crazy compared to the standard. Though, there's really no reason for the codes to update so fast.
fyltr 13 hours ago [-]
They are probably doing it to avoid account sharing?
ihsw 13 hours ago [-]
This is the answer here, gyms across the country have implemented nearly identical functionality (bar codes or QR codes are required on entry, staff are trained to be aware of customers sharing or using shared screenshots of the above codes, and the codes have a very short lifetime.)
develoopest 13 hours ago [-]
The QR changed every 15 seconds.
SoftTalker 13 hours ago [-]
My gym issues an NFC keyfob you scan at the turnstyle (and at the door, after hours). I keep it clipped to a lanyard on my gym bag so I don't forget it or lose it.
They review video and deal with friends sharing a keyfob pretty harshly. Membership revoked.
alsetmusic 12 hours ago [-]
> Half of this project was ripgrep.
This is the real strength of LLMs. Not that they write the most sophisticated code; it's the brute force element. The "I wouldn't have spent the time on it," aspect.
smusamashah 13 hours ago [-]
Another solution could have been to run something like Tasker or Automate to launch app, take QR from current activity (this is the main part) and display just that and once you are done, dismiss the rest of the app.
lifeisloving 12 hours ago [-]
I have deepseek hooked up to a couple rooted phones REing android apks basically 24/7. Its quite useful. One of the few things I think llms are genuinely useful for.
otter-in-a-suit 13 hours ago [-]
What's with all the negative comments here? I thought this was a reasonably interesting article about _actually hacking something_, whether this person needed to or not. You know, like in "HackerNews"?
mywittyname 13 hours ago [-]
I was going to post something positive, but it amounted to "good job, this is a clever way to use AI to improve your quality of life." But it seemed too basic and wouldn't serve as the nucleus for a discussion, so I didn't post it.
Being negative gives people something to talk about.
stickfigure 11 hours ago [-]
I didn't post a negative comment, but I found the article deeply unsatisfying. It didn't name the actual gym, and it didn't provide source code. There's nothing that binds it to the real world.
I'm not accusing the story of being a random prompt, but the fact that it could be AI slop makes it less interesting.
throwaway89201 13 hours ago [-]
Somewhat relatedly: did you know that the "RSA Authenticator (SecurID)" app only tries to detect Frida / ptrace hooks for the first few seconds of its runtime, after which it loads the symmetric OTP secret into memory? Now you do.
hk__2 13 hours ago [-]
> To be clear, I’m leaving out some details to keep the gym and myself anonymous
For the last part, it’s maybe not the best idea to put a link "GitHub & CV" at the bottom then ;)
dasil003 12 hours ago [-]
I guess it's good to know this gym is explicitly leaning into the meat market aspects of the gym, and maybe there's nothing wrong with that. But over time won't that subtly turn off the clientele that are not attention-seeking narcissists?
The idea that a gym is a place where you will likely meet fit, attractive people is something that I think has a broader appeal as long as it remains subtle and unspoken. As soon as you make it explicit with social media it seems like it kills the vibe pretty fast. Or maybe I'm just old and the youngs will just take it in stride like the rest of the world that software has eaten.
nancyminusone 13 hours ago [-]
>it prompts you to post a story of your session
An excellent portal to accept a fictionalized ai slop version of "your" experience. Make it long, and maybe put a recipe at the bottom.
lenerdenator 13 hours ago [-]
Marketers need to realize that it's rude to not compensate people for those people helping with marketing.
I think a story of how you saw a dude drying off his gluteal cleft with the hand dryers in the locker rooms would be an appropriate "experience" if the payment is nothing.
elAhmo 13 hours ago [-]
Just change your gym bro, not worth supporting this behaviour.
citguru 12 hours ago [-]
Lol, love it
MattDamonSpace 13 hours ago [-]
I find dissonance between “I hate these products” and “I’m going to freeride by eg blocking their ads”
I know the effect is negligible but isn’t that just stealing
tensor 13 hours ago [-]
I always pay to remove ads. I only block if I'm left with no option to pay. You might consider it stealing, but I consider forced ads as psychological warfare, so on the whole I feel I'm in a morally fair place.
delecti 13 hours ago [-]
TFA doesn't mention advertising in relation to the specific app in question, nor does it imply that it even has ads. The only mention of it is a broader "I don't like social media because of the ads".
jawilson2 13 hours ago [-]
He's paying for the gym already?
lxgr 12 hours ago [-]
It is, and it’s pretty unfortunate that so many companies are getting away with stealing so much of my time, attention, and hardware resources.
alistairSH 13 hours ago [-]
I assume he's paying a gym membership. IMO, that membership (across all members) should be sufficient to pay for the gym to operate. If not, that's the problem.
bravoetch 13 hours ago [-]
> I know the effect is negligible but isn’t that just stealing
No. They pay for a gym membership, there is literally nothing to steal from the social media feed in the door-unlocking app.
0c3ca83 13 hours ago [-]
No. But failing to loudly protest gives these companies license to continue.
devmor 13 hours ago [-]
If you provide a service expecting the user to interact with your service in the way you designed and they do not, that is a problem with your service, not theft.
It would be theft if the user was bypassing payment-gated credentials, but that is not the case here.
wvenable 13 hours ago [-]
Going to bathroom during the commercials is also stealing. Or maybe it's not stealing. The argument quickly becomes more complicated the more you think about it.
bravoetch 13 hours ago [-]
It becomes simple if you define stealing as having criminal legal consequences. Since there are none, it's not stealing.
wvenable 12 hours ago [-]
I assumed we were talking about the moral argument. Is stealing still stealing if there is no government? If grok takes food from brog in the cave, is that not still wrong?
bravoetch 4 hours ago [-]
If someone looks away from ads while they're playing on TV, then watches the show they like, they haven't stolen anything. It's a technical point, not a moral one.
nancyminusone 13 hours ago [-]
Guess I will steal then.
13 hours ago [-]
g0ld3nrati0 13 hours ago [-]
no
dfxm12 13 hours ago [-]
If you hate the app enough, you could see this as damaging them (consuming its resources without getting the ads). Even if it is negligible, it might feel good.
vlyan 13 hours ago [-]
yes, just like you're stealing from the supermarket when you buy real food (low to no markup) instead of corn-syruped artificially-flavored slop, alcohol, and cigarettes (high to obscene markup). every time you leave the store without a bag of Doritos, a bottle of MtDew, and a pack of Marlboro, you're being a bad citizen.
wahnfrieden 13 hours ago [-]
No
QuercusMax 13 hours ago [-]
Building your own AES implementation is pretty insane and obvious a bad idea...
lxgr 12 hours ago [-]
If you need security, sure. If you’re trying to break somebody else’s, what exactly is the problem?
QuercusMax 12 hours ago [-]
Unless you think their AES is faulty in some way, it's just a waste of time, and rolling your own crypto is almost always a bad idea
b800h 13 hours ago [-]
This person has too much time on their hands.
spiderice 13 hours ago [-]
They said smugly, before continuing to scroll Hacker News
Drupon 13 hours ago [-]
>However, I’m super aggressive about social media and feeds I don’t control. Any app that shows me a feed I can’t turn off, sort, or filter—I take that as psychological warfare against me.
Is it just me or are people getting too stuck in a Manichean mindset about this kind of thing? This reads like an alcoholic complaining about a work happy hour or something. Just, don't use the social media stuff.
>For the longest time, my LinkedIn bio was “I HATE LINKEDIN.”
OP kind of just seems insufferable. Touch grass.
itake 13 hours ago [-]
Why do I even have to see it? It is designed to get me sucked in. Imagine if an sober alcoholic must see beer ads every time they open up amazon.com to go shopping.
alistairSH 13 hours ago [-]
Just you, maybe.
I hate the "ubiquity" of social media. For me, it's not social media conceptually that's the issue, it's that Meta and others are not good companies. They exist by doing their best to get me addicted to their feeds. It's not healthy. Whether or not there's a non-harmful way to do social media is unknown (by me, at least).
Bratmon 13 hours ago [-]
Yeah, how DARE someone want to go to the gym without participating in social media?! What an absolute asshole!
It's just not interesting to me. I'm sure most of us here have fixed little annoyances in our lives with AI at this point. I could write a post about how I forked newpipe to add features I wanted but I doubt anyone would care because they can just do that too.
I know the world is different now. I'm just crying about it is all.
"DeepSeek, write a technical report about how you cracked the app. Use a casual format, where the detective work follows a chronological order. Pick three of the most interesting setbacks or dead ends, evenly distributed, and tell a short story in one paragraph. Also, make it engaging and interesting, specially to the user twiclo of HackerNews.
Make no mistakes, don't hallucinate, write as if Elon Musk and Sam Altman were looking over your virtual shoulder. I will drown a baby monkey for every mistake I find. Don't bother me until you're finished, I'll be away from the computer."
Jokes aside, I have the exact same feeling. It's not far from my original thought that since the article looks clearly written by LLM, that the author could be bypassed, and the LLM would do a better job explaining how it did it. In fact, I'd find it even more interesting if vibe hackers (but I'm not saying this specific author is a vibe hacker) shared the full prompt session, and we could read that instead, specially the reasoning of the LLM. Even better if it was a format you could import in your own LLM.
We're just counting down to being unable to exist without a smartphone on your person at all times. What a dystopia.
Even homeless people need smart phones these days in order to interact with the agencies that help them.
The difference is in that the phone is infinitely more useful and potentially useful; and the dystopia only arises from the fact that it has been used against me in accordance to the surveillance state.
The phone, and the carrying of it, is not really the issue.
At a couple other gyms (these were some 20 years ago), you gave your name when you came in, they pulled up your photo, and checked if it was close enough. Again, no need to carry anything.
That requires staff, which is expensive, but my point is to highlight there are options where you don't need to carry anything. Those sound like the world I would prefer.
While a phone may often be more useful, it's not infinitely more useful than other options. When I used to regularly swim at neighborhood pool, which is in walking distance, I had an RFID card to get in. The card could fit in my swim trunks. When the weather was warm enough I could walk to the pool carrying only card, towel, and body wash. I didn't bother getting a locker. A phone would have been less convenient and therefore less useful.
I used to have a ring of like 2-3 dozen keys. Now the only key I need to carry is for my car.
Don't Vibe Code in Between Sets
Keep your rest time for recovery, not React components.
Please refrain from writing code, checking commits, or prompting Al during your workout.
Be present. Lift harder. Ship later.
https://x.com/iansbrash/status/2112219912475156650/photo/1
Right?
I posted about it yesterday, I think.
Unfortunately, I think it's already impossible to attend major events without a phone, at least if it's a major event at a stadium. Smaller venues still send out emails with QR codes we can just print out.
Update: It was hard to find because it was titled, "I accidentally became PureGym’s unofficial Apple Wallet developer"
https://news.ycombinator.com/item?id=44910865
I similarly reject apps and QR menus in restaurants, airlines, etc. If you can't be bothered to give me a paper menu, I can't be bothered to eat in your establishment.
This generally gets me a workaround. I do even have a company phone with locked down applications... it's just not my only phone.
I overheard several very forceful discussions from people who had a smartphone but wanted to leave it at home. The staff - likely on orders from the gym chain - refused to budge.
You’re telling a business to change their login requirements (big inconvenience for them) so you don’t have to use an app (small inconvenience for you) and if they don’t you’ll quit (big inconvenience for you, small inconvenience for them). That’s almost never going to work.
But the calculation isn't as simple as you suggest. Smartphones save them money over the older system, which used RFID cards. That meant they needed local staff to handle lost cards. Now if you lost your phone, it's all up to you, and they can deal with other issues over the phone or in-app chat.
The older system allowed booking group classes on the app, online and on a computer in the gym. There was an RFID scanner in the group rooms to check in, with a printed receipt to show the instructor.
The new system got rid of the online and local booking options, and the scanner and printer, which saves them money.
If they figure 1% of the members might leave, but they get more profits from the remaining 99%, then they'll just shrugs at you cancelling your membership over it.
[1] The breaking point for me was the worsening group dynamics. It used to be people would chat to each other before a group class started. It turned into a bunch of people staring at their phones while waiting. It used to be that people would take a short rest between sets. That became a moment to pull out the phone, get distracted, and block others from using the machine or bench. I liked to see and say hello to the staff when I came in, but they reduced staffing, making the gym feel more isolating.
I love being able to do things like this and rip out the crap being forced down our throats.
The person at the front desk was absolutely no help and could have been replaced with a sign that said, "you can do everything in the app."
https://wallet.google/
The AI companies are trying to convince dentists offices they need Claude. The truth is regular people don't care. There's always only going to be a subset of the population that wants to build things.
They review video and deal with friends sharing a keyfob pretty harshly. Membership revoked.
This is the real strength of LLMs. Not that they write the most sophisticated code; it's the brute force element. The "I wouldn't have spent the time on it," aspect.
Being negative gives people something to talk about.
I'm not accusing the story of being a random prompt, but the fact that it could be AI slop makes it less interesting.
For the last part, it’s maybe not the best idea to put a link "GitHub & CV" at the bottom then ;)
The idea that a gym is a place where you will likely meet fit, attractive people is something that I think has a broader appeal as long as it remains subtle and unspoken. As soon as you make it explicit with social media it seems like it kills the vibe pretty fast. Or maybe I'm just old and the youngs will just take it in stride like the rest of the world that software has eaten.
An excellent portal to accept a fictionalized ai slop version of "your" experience. Make it long, and maybe put a recipe at the bottom.
I think a story of how you saw a dude drying off his gluteal cleft with the hand dryers in the locker rooms would be an appropriate "experience" if the payment is nothing.
I know the effect is negligible but isn’t that just stealing
No. They pay for a gym membership, there is literally nothing to steal from the social media feed in the door-unlocking app.
It would be theft if the user was bypassing payment-gated credentials, but that is not the case here.
Is it just me or are people getting too stuck in a Manichean mindset about this kind of thing? This reads like an alcoholic complaining about a work happy hour or something. Just, don't use the social media stuff.
>For the longest time, my LinkedIn bio was “I HATE LINKEDIN.”
OP kind of just seems insufferable. Touch grass.
I hate the "ubiquity" of social media. For me, it's not social media conceptually that's the issue, it's that Meta and others are not good companies. They exist by doing their best to get me addicted to their feeds. It's not healthy. Whether or not there's a non-harmful way to do social media is unknown (by me, at least).