the adjectives on the tip options are so weird lol What a shitty system to even exist
The meme says “IRS”, so it’s obviously intended to refer to America.
But outside of that context, they’d fucking deserve it for their shitty dark pattern UX trying to export American tipping culture into the civilised world. If people want to tip, they can do it using cash (so the money actually goes to the person you intended it to!). Or at most, there could be a little “tip” button in the corner somewhere that then takes you to a page like this. It shouldn’t be shoved in our faces like this.
Who carries cash, though?
Farmers. Farmers’ mums.
Americunts shit on you when you tell them tipping culture is bad. Like, here in my third world country, where we all earn a misery compared to the minimum wage in burger land, we can say no to tips or just give a few cents or some more…fuck this. Food is already expensive. I am not going to waste extra cash for my food.
Who the fuck defends tipping culture, you’re just making shit up to justify your hatred of an entire country
Live in a country where tipping is practically unheard of. Lately pay terminals have started appearing in restaurants that have asking for tip enabled by default, and restaurants often don’t know how to disable it.
Well, at least there are some safeguards. I was handed the terminal so I put in my PIN code, not realising it was actually asking for a tip. I was pretty confused when it said “value too high” or something like that.
Taalen’s PIN > 0001 confirmed.
Too complicated. Just enter a negative number.
No negative sign on the keyboard. But you can enter 2147483647
Risky gamble there
I’d love to know what this would actually do.
Edit: Thanks for the responses and lively discussion!!
Assuming the accounting system this thing links with both does not protect from SQL injection attacks (many don’t, despite it being easy to protect against) and also has a table named “Bills” with a field named “amount”; what this would do is go through every single Bills record and half the value in the amount field. This would completely fuck the system, particularly when it came to billing and tax filing as the numbers for accounts billing and receivable wouldn’t even come close to matching each other. The accounting department would have a hell of a time fixing the damage.
does not protect from SQL injection attacks (many don’t, despite it being easy to protect against)
Every modern database library automatically protects against SQL injection, usually by using prepared statements (where the query with placeholders, and the placeholder values, are sent as two separate things). so a system would have to be written extremely poorly to be vulnerable to it.
This post is just a joke as developers should hopefully be aware of the OWASP top 10 security vulnerabilities.
Edit: Bad developers will do bad things, but any reasonable developer should be well aware of these risks.
Oh sweet summer child.
First, injection attacks are third on the owasp list, although they do roll xss into it too, which changed the name, since “shit sanitization on input” and “shit escaping before use” are the cause of both.
https://owasp.org/Top10/A03_2021-Injection/Secondly, SQL injection is freakishly common and easy. I don’t know of any database libraries that prevent you from directly executing an SQL literal, they just encourage parameterized statements.
I have personally run into plenty of systems where people build SQL via string concatenation because for whatever reason they can’t use an orm or “proper” SQL generator.
You can find them in the wild fairly often by just tossing
' or 1=1;--into fields in forms. If it gets mad in a way that doesn’t make sense or suddenly takes forever, you win!Don’t do that though, because it’s illegal.
Secondly, SQL injection is freakishly common and easy.
Do you have any recent examples of major SQL injection holes?
https://www.darkreading.com/remote-workforce/critical-security-flaw-wordpress-sql-injection
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
You can fiddle with the nvd search settings to find whatever severity score you like, or filter by execution parameters.
https://nvd.nist.gov/vuln/detail/CVE-2024-1597
That one was a treat when I check under critical, since it’s an injection attack that can bypass parameterized query protections for the database driver, which is why “defense in depth” and “always sanitize your fucking inputs” are such key things to remember.
I hope that provided what you’re looking for, and maybe increases your awareness of SQL injection. 😊
Great comment. Thanks!
Couldn’t they just *2 all the bills from before this was ran and straighten it out?
I imagine they could if they knew exactly what you did and when, but if it doesn’t get discovered until later and nobody knows what happened, it would probably be a bitch to figure out
Now if I could only bypass the float only input field…
F12 lol. The only issue with a dev console helping would be serverside checking
How do you press F12 on a touchscreen interface?
I wish 15% and 18% were options. Normally it’s more like 20%, 25% (default), 28%, 30%
I hate %, give me a option to round up to the nearest 5. This is useful for my financial tracking, and I’m willing to bet a lot of people would like nice round numbers. If I buy a coffee or whatever and it’s $7 I round up to $10, not because I’m trying to give a good tip but because it’s more convenient for me when I’m sitting there doing my finances (I track everything) and while I know that not everyone would universally agree maybe they would only want to round up to the nearest whole dollar the fact remains I feel like most places would actually end up with more total tips overall if that was a one button option
Can’t they trace it back to you since you’re using a card to get that prompt?
In my country, we can buy pre-paid credit cards in the supermarket using cash. I guess that is still traceable using supermarket security cameras and facial recognition, but if you’re attempting this, I’d make it as difficult as possible.
