Wow. The QR code changing every 15 minutes... that's like trying to get into a rock concert. Well done

The QR changed every 15 seconds.

15 seconds... And the standard for TOTP is 30 seconds. So it's not crazy compared to the standard. Though, there's really no reason for the codes to update so fast.

They are probably doing it to avoid account sharing?

I find dissonance between “I hate these products” and “I’m going to freeride by eg blocking their ads”

I know the effect is negligible but isn’t that just stealing

He's paying for the gym already?

If you hate the app enough, you could see this as damaging them (consuming its resources without getting the ads). Even if it is negligible, it might feel good.

If you provide a service expecting the user to interact with your service in the way you designed and they do not, that is a problem with your service, not theft.

It would be theft if the user was bypassing payment-gated credentials, but that is not the case here.

Going to bathroom during the commercials is also stealing. Or maybe it's not stealing. The argument quickly becomes more complicated the more you think about it.

It becomes simple if you define stealing as having criminal legal consequences. Since there are none, it's not stealing.

I assumed we were talking about the moral argument. Is stealing still stealing if there is no government? If grok takes food from brog in the cave, is that not still wrong?

If someone looks away from ads while they're playing on TV, then watches the show they like, they haven't stolen anything. It's a technical point, not a moral one.

No

TFA doesn't mention advertising in relation to the specific app in question, nor does it imply that it even has ads. The only mention of it is a broader "I don't like social media because of the ads".

I always pay to remove ads. I only block if I'm left with no option to pay. You might consider it stealing, but I consider forced ads as psychological warfare, so on the whole I feel I'm in a morally fair place.

no

Guess I will steal then.

No. But failing to loudly protest gives these companies license to continue.

> I know the effect is negligible but isn’t that just stealing

No. They pay for a gym membership, there is literally nothing to steal from the social media feed in the door-unlocking app.

I assume he's paying a gym membership. IMO, that membership (across all members) should be sufficient to pay for the gym to operate. If not, that's the problem.

yes, just like you're stealing from the supermarket when you buy real food (low to no markup) instead of corn-syruped artificially-flavored slop, alcohol, and cigarettes (high to obscene markup). every time you leave the store without a bag of Doritos, a bottle of MtDew, and a pack of Marlboro, you're being a bad citizen.

It is, and it’s pretty unfortunate that so many companies are getting away with stealing so much of my time, attention, and hardware resources.

>However, I’m super aggressive about social media and feeds I don’t control. Any app that shows me a feed I can’t turn off, sort, or filter—I take that as psychological warfare against me.

Is it just me or are people getting too stuck in a Manichean mindset about this kind of thing? This reads like an alcoholic complaining about a work happy hour or something. Just, don't use the social media stuff.

>For the longest time, my LinkedIn bio was “I HATE LINKEDIN.”

OP kind of just seems insufferable. Touch grass.

Yeah, how DARE someone want to go to the gym without participating in social media?! What an absolute asshole!

Both things can be true at the same time, lol.

Lighten up asshole

Why do I even have to see it? It is designed to get me sucked in. Imagine if an sober alcoholic must see beer ads every time they open up amazon.com to go shopping.

Just you, maybe.

I hate the "ubiquity" of social media. For me, it's not social media conceptually that's the issue, it's that Meta and others are not good companies. They exist by doing their best to get me addicted to their feeds. It's not healthy. Whether or not there's a non-harmful way to do social media is unknown (by me, at least).

This person has too much time on their hands.

They said smugly, before continuing to scroll Hacker News

The bigger issue is that to use this gym, you must own a smartphone and you must bring it with you and carry it around while you work out.

We're just counting down to being unable to exist without a smartphone on your person at all times. What a dystopia.

[delayed]

I hear that's par for the course in Europe.

Don't worry, smartphones are cheap, can be easily upgraded by the user, and last for years or decades before needing upgrade or replacement.

Right?

I've taken to using the dumb, low-tech option where possible to try to push back on our techno-dystopian future. Printing out boarding passes, using cash, asking for menus at places with QR codes on the napkins, etc.

Unfortunately, I think it's already impossible to attend major events without a phone, at least if it's a major event at a stadium. Smaller venues still send out emails with QR codes we can just print out.

Ticketing apps are becoming ubiquitous even at small venues, and the app quality is quite low. They failed to pull up my tickets at the last two events I attended, but luckily I have a trustworthy face I guess.

It's quite impossible to actively participate in modern society without a phone anyway. And it's a personal business either way, you can choose another gym. I'm glad mine does QR entry because thanks to that it's open 24/7/365 when there's no staff, even during holidays like Christmas. You can just go anytime that's convenient for you, so it's a trade-off I'm willing to make.

Easily solvable problem though. NFC keys, RFID keycard, scan a driver's license, etc.

is a world where I have to perpetually carry keys, keycards and wallets one so much worse than the one where I perpetually carry a phone?

The difference is in that the phone is infinitely more useful and potentially useful; and the dystopia only arises from the fact that it has been used against me in accordance to the surveillance state.

The phone, and the carrying of it, is not really the issue.

by consolidating all tools into one tool, the bus factor is now 1. by consolidating all tools into one tool, the quality of individual tools decreases (eg. phone flashlight is adequate for small jobs but is much less effective than a torch). every single god damn person on the train sits there with their head buried in their consolidated tool screen, nobody socializes. there seems to be plenty of issues, privacy notwithstanding.

My favorite gym was a small one where the staff recognized the members. I didn't need to carry anything.

At a couple other gyms (these were some 20 years ago), you gave your name when you came in, they pulled up your photo, and checked if it was close enough. Again, no need to carry anything.

That requires staff, which is expensive, but my point is to highlight there are options where you don't need to carry anything. Those sound like the world I would prefer.

While a phone may often be more useful, it's not infinitely more useful than other options. When I used to regularly swim at neighborhood pool, which is in walking distance, I had an RFID card to get in. The card could fit in my swim trunks. When the weather was warm enough I could walk to the pool carrying only card, towel, and body wash. I didn't bother getting a locker. A phone would have been less convenient and therefore less useful.

Some states have an official app that is accepted as your driver's license, and most stores take NFC payments from your phone, so many people don't even need a wallet anymore.

I used to have a ring of like 2-3 dozen keys. Now the only key I need to carry is for my car.

I don't have to pay a thousand bucks to a guy I don't really like for my wallet.

> It's quite impossible to actively participate in modern society without a phone anyway.

Even homeless people need smart phones these days in order to interact with the agencies that help them.

an entry level smart phone is 150 bucks and can work through several generations.

plenty of places to charge, and lots of free wifi.

its a good thing. they can communicate, call for help, or just stay busy -- you have a lot of free time when you're homeless and jobless, and being able to scroll the internet keeps you in sync w/ the world.

probelm is getting them the phone, and making sure they don't lose it.

> they can > getting them > making sure

You speak as if this is a group of "others" that need controlling, rather than a (temporary) situation anyone can find themselves in. Nor do you recognize the reasons why people end up homeless. You suggest that pushing people to doom scroll all day is a good thing.

Have you considered that being homeless you'd have no money? At risk of theft? That many sell anything worth something to feed themselves or addictions? That you'd get kicked out of places where it's warm with wifi? That you'd have to carry a charger around too? Or that people often refuse to communicate and ignore you? Or that you'd desperately need help and long term support already, which isn't there? Probably struggling with mental health or abuse and trauma?

Tying our lives to a digital devices in order to exist is already dystopian. What you suggest in such a tone and attitude is detached from reality.

My gym also recently introduced a new app that gives you a QR code to get in. but luckily the old system of punching in your member code is still available.

As a new owner of EV, I can confirm that without a smartphone the experience is hair-raising.

Tesla's have cards as do all others I am aware of. But the car is a tracking data harvesting computer so I just give up.

Eh? How so?

Gyms need reminders these days:

Don't Vibe Code in Between Sets

Keep your rest time for recovery, not React components.

Please refrain from writing code, checking commits, or prompting Al during your workout.

Be present. Lift harder. Ship later.

https://x.com/iansbrash/status/2112219912475156650/photo/1

What's with all the negative comments here? I thought this was a reasonably interesting article about _actually hacking something_, whether this person needed to or not. You know, like in "HackerNews"?

I was going to post something positive, but it amounted to "good job, this is a clever way to use AI to improve your quality of life." But it seemed too basic and wouldn't serve as the nucleus for a discussion, so I didn't post it.

Being negative gives people something to talk about.

I didn't post a negative comment, but I found the article deeply unsatisfying. It didn't name the actual gym, and it didn't provide source code. There's nothing that binds it to the real world.

I'm not accusing the story of being a random prompt, but the fact that it could be AI slop makes it less interesting.

This is the future of software with AI: everyone can have hyper-personalized software to solve very personally-specific problems.

The truth is, not everyone is just going to suddenly start building things, especially software, just because its easy.

The AI companies are trying to convince dentists offices they need Claude. The truth is regular people don't care. There's always only going to be a subset of the population that wants to build things.

it's just gym access to get through a turnstile. we've solved barcode scanners and DB lookups. or RSA dongles and yubikeys.

why do I need to burn tokens to do this?

Another solution could have been to run something like Tasker or Automate to launch app, take QR from current activity (this is the main part) and display just that and once you are done, dismiss the rest of the app.

Somewhat relatedly: did you know that the "RSA Authenticator (SecurID)" app only tries to detect Frida / ptrace hooks for the first few seconds of its runtime, after which it loads the symmetric OTP secret into memory? Now you do.

Does Android not have a "wallet" feature? My gym does the app-based QR code for entry, but on Apple, I just add that app to my wallet and the QR appears there, I only need to access the app proper to check class and pool schedules.

[delayed]

I figured was much, I was just surprised that wasn't an option for this app/gym... I guess their being actively malicious in making members use the full app for entry...

Yes it does, I use it for my Gym's barcode and NFC login.

Just change your gym bro, not worth supporting this behaviour.

>it prompts you to post a story of your session

An excellent portal to accept a fictionalized ai slop version of "your" experience. Make it long, and maybe put a recipe at the bottom.

Marketers need to realize that it's rude to not compensate people for those people helping with marketing.

I think a story of how you saw a dude drying off his gluteal cleft with the hand dryers in the locker rooms would be an appropriate "experience" if the payment is nothing.

This is dated today but I could have sworn I read a similar story here a few years ago about hacking their gym's QR code, but I can't now find it on algolia.

I like that you took matters into your own hands, but here my preferred approach would have to approach management and request an alternative access method. I do have separate profiles on my GOS phone for this kind of situations, but I have been on a crusade against phone apps for years now.

I similarly reject apps and QR menus in restaurants, airlines, etc. If you can't be bothered to give me a paper menu, I can't be bothered to eat in your establishment.

Yeah, I'd even leverage the fact that you work in software to make a note about how deeply invasive this is and how much it opens up unnecessary surface areas to attacks.

My gym switched to smartphone/QR code entry. Only those without a smartphone were excepted. (There was a member her 80s with no cell phone, for example.)

I overheard several very forceful discussions from people who had a smartphone but wanted to leave it at home. The staff - likely on orders from the gym chain - refused to budge.

I would tell management that I don't have a cell phone, and, if they refused to oblige when an alternative exists, cancel my membership there and then. Businesses need to be reminded that the customer is king.

While I agree with this on principle, this doesn’t really work on an individual level.

You’re telling a business to change their login requirements (big inconvenience for them) so you don’t have to use an app (small inconvenience for you) and if they don’t you’ll quit (big inconvenience for you, small inconvenience for them). That’s almost never going to work.

Sure. I left in part over this change.

But the calculation isn't as simple as you suggest. Smartphones save them money over the older system, which used RFID cards. That meant they needed local staff to handle lost cards. Now if you lost your phone, it's all up to you, and they can deal with other issues over the phone or in-app chat.

The older system allowed booking group classes on the app, online and on a computer in the gym. There was an RFID scanner in the group rooms to check in, with a printed receipt to show the instructor.

The new system got rid of the online and local booking options, and the scanner and printer, which saves them money.

If they figure 1% of the members might leave, but they get more profits from the remaining 99%, then they'll just shrugs at you cancelling your membership over it.

The economics change if enough of us refuse to install their insecure, buggy apps. I'd even accept a web app where at least it lived in the browser sandbox.

Clearly.

That's why we've collectively stopped using fossil fuel, stopped buying clothes made with sweatshop labor (so garment workers in Bangladesh have no need to protest over minimum wage), stopped eating chocolate made with child labor, and stopped buying electronic devices with cobalt from "artisanal miners" in the DRC. /s

AI is easier to avoid than most of those things, so far anyway.

We collectively ditched Disney+ and got results. It's not as futile as you seem to think.

How did Disney+ change as the result of your ditching them?

Kimmel is still on the air.

https://www.yahoo.com/entertainment/tv/articles/why-people-c...

I had forgotten about that.

I think https://en.wikipedia.org/wiki/Suspension_of_Jimmy_Kimmel_Liv... is a better link for the economic impact of the consumer boycott which, after all, was only part of the negative consequences they faced.

That was a year ago. Have you rejoined, or is your boycott permanent?

As regards to the fuller context, a short-term boycott against an ill-conceived decision based on transitory event seem far different than, say, the ineffective consumer boycott against Coors for its anti-LGBTQ policies, or the effective consumer grape boycott combined with the strike against table grape growers in Delano, California, both of which took years.

The systemic issues like the expectation of universal adult smartphone carry, much less the climate ad labor exploitation issues I mentioned, don't seem readily resolvable that way.

My go-to for these situations is a little white lie: "The only smartphone I use is provided by my employer, and your app did not pass the security review."

This generally gets me a workaround. I do even have a company phone with locked down applications... it's just not my only phone.

Building your own AES implementation is pretty insane and obvious a bad idea...

If you need security, sure. If you’re trying to break somebody else’s, what exactly is the problem?

Unless you think their AES is faulty in some way, it's just a waste of time, and rolling your own crypto is almost always a bad idea

Whose time? Most likely, an agent's, these days, and its operator probably couldn't care less if the agent hand-rolls AES in COBOL as long as it gets the job done, if the job is reverse engineering somebody else's crypto.

The heuristic "don't hand roll your crypto" is just that – a heuristic. Understand why it exists and you get to decide if it makes sense in your scenario or not.

But in this case if they had used a standard AES package it would have saved time and tokens. Just because we have AI doesn't mean that we should encourage it to reinvent every wheel.

Years ago when I went to Planet Fitness I didn't like their app and it was slow to load the barcode I needed to scan to get in. Thankfully that barcode didn't rotate so I was able to just make my own Apple Pass and set it up to be geo-fenced on the gym so as I walked up it would pop up as a notification I could tap to open my code.

I love being able to do things like this and rip out the crap being forced down our throats.

I spent 30 minutes trying to get my friend's "visitor pass" to work for me, before giving up.

The person at the front desk was absolutely no help and could have been replaced with a sign that said, "you can do everything in the app."

If it doesn't rotate, I'd just take a screenshot and put a shortcut to it on the home screen.

> To be clear, I’m leaving out some details to keep the gym and myself anonymous

For the last part, it’s maybe not the best idea to put a link "GitHub & CV" at the bottom then ;)

My gym issues an NFC keyfob you scan at the turnstyle (and at the door, after hours). I keep it clipped to a lanyard on my gym bag so I don't forget it or lose it.

I have deepseek hooked up to a couple rooted phones REing android apks basically 24/7. Its quite useful. One of the few things I think llms are genuinely useful for.

I guess it's good to know this gym is explicitly leaning into the meat market aspects of the gym, and maybe there's nothing wrong with that. But over time won't that subtly turn off the clientele that are not attention-seeking narcissists?

The idea that a gym is a place where you will likely meet fit, attractive people is something that I think has a broader appeal as long as it remains subtle and unspoken. As soon as you make it explicit with social media it seems like it kills the vibe pretty fast. Or maybe I'm just old and the youngs will just take it in stride like the rest of the world that software has eaten.

I used to love reading things like this. The exciting part was the detective work. Watching someone think about how it works and trying potential ways to crack the system. Now every one of these articles is, "So I pointed an AI model at it then tried it again with a different one and now I have what I want." I felt the same disappointment when I read the article about hacking the Switch 2.

It's just not interesting to me. I'm sure most of us here have fixed little annoyances in our lives with AI at this point. I could write a post about how I forked newpipe to add features I wanted but I doubt anyone would care because they can just do that too.

I know the world is different now. I'm just crying about it is all.

Oh, I can see that. Fortunately, it's easily solved!

"DeepSeek, write a technical report about how you cracked the app. Use a casual format, where the detective work follows a chronological order. Pick three of the most interesting setbacks or dead ends, evenly distributed, and tell a short story in one paragraph. Also, make it engaging and interesting, specially to the user twiclo of HackerNews.

Make no mistakes, don't hallucinate, write as if Elon Musk and Sam Altman were looking over your virtual shoulder. I will drown a baby monkey for every mistake. Don't bother me until you're finished, I'll be away from the computer."

+1

> Half of this project was ripgrep.

This is the real strength of LLMs. Not that they write the most sophisticated code; it's the brute force element. The "I wouldn't have spent the time on it," aspect.

Lol, love it