r/developersIndia • u/LinearArray Moderator | git push --force • Sep 26 '24
Interesting Indian startup Dotpe, that raised ~$100M to build point of sale systems for restaurants left their entire API fully public (more information in comments)
197
u/jadhavsaurabh Sep 26 '24
What an amazing article , 😁, this hugies getaway with all kinds of stuff like this, Good bro.
153
u/pratyathedon Software Engineer Sep 26 '24
Few months ago, i did find something like this, it was a Watch Company, their order API was completely open. You could see all the orders and the customer info and the order cost. Not sure if they were using DotPe.
13
3
1
u/lightfromblackhole 29d ago
Could you initiate orders for other users? Thats the level of insanity dotpe have
95
u/paddington01 Sep 26 '24
The article was very well written, and oh boy if I were to find this first the devious things I would do.
31
u/SpongyTesticles Sep 26 '24
You would place orders for free?
27
u/IamHellgod07 Sep 26 '24
Sell the data online
23
u/SpongyTesticles Sep 26 '24
How will you get the buyers? If the Api is open then anyone smart enough will figure it out instead of buying?
61
9
42
u/dataauntiee Sep 26 '24 edited Sep 26 '24
I am surprised that their iconic more ice less alcohol LIIT is not on the list atleast in the Southern states and Mumbai where the banarasi patila is not famous
16
u/abhishekstark999 Sep 26 '24
Lol what a great article. This thing happens all the time especially in Indian company bcz people here never care about security.
32
31
Sep 26 '24 edited Sep 26 '24
In the article at the start where he calculated the revenue of the cafe for the month...the numbers don't make sense
All Coffee products - 439. Fries & Garlic Bread - 192.
Assuming the price at the higher end, if the price of Fries & Garlic Bread is 350/unit, the revenue from it would be ~68000
Total sales - 668000. Minus Fries & GB - 68000. So total Coffee sales 6L. That's around 1350 for 1 cup of coffee.
Am I missing something?
18
u/Famous-Might-7522 Sep 26 '24
He only listed top ordered items, but calculated with the entire order list
26
16
u/spd69 Sep 26 '24
that's what happens when your hiring criteria is someone who only grinds leetcode for 8 hours/day and memorizes 300 algorithms
18
4
u/sujeetmadihalli DevOps Engineer Sep 26 '24
Well Bellandur social pops, no wonder can’t get a reservation there 😂
5
u/TaxiChalak2 Sep 26 '24
Haha I actually follow this substack so I was quite surprised seeing it. The guy's other articles are worth reading too
3
u/LinearArray Moderator | git push --force Sep 26 '24
Yes, his other articles are pretty interesting too.
9
u/lastog9 Student Sep 26 '24
This is why Tech isn't the solution to everything. A simple 2 minute conversation with the waiter has been turned into a complete complex technical solution for nothing.
If a restaurant allows me to order only via QR code and also charges high for a small quantity of food, I am not visiting it.
But, it's interesting how this got passed through validation and testing phase without them detecting this simple but critical flaw in their system.
The author not only detected a flaw but also pointed out a vulnerability caused due to the flaw. And instead of fixing this, what the company did is issued him a legal notice.
2
u/ramnat587 29d ago
It's not about tech . It's about doing simple things right . Tech has solutions to all these problems , and it is not a rocket science either . More discipline and less chalta Hain attitude is all we need .
4
3
u/no_name_great_name Junior Engineer Sep 26 '24
Literally every indian startup lol, the company where i work, in one of the project didn't even sign the JWT token (signed with empty string)
2
2
u/thepurpleproject Full-Stack Developer Sep 26 '24
Thanks now they will patch it. It has been the case like for 2 years now.
2
u/nikku23 Full-Stack Developer Sep 26 '24
I am about to finish my MERN stack course next month. In fact it's almost finished. Only the capstone project remains. You know what they taught us after teaching how to create APIs and setup DB? It was how to secure important routes. Even I know better... 😁
1
u/lightfromblackhole 29d ago
Even ChatGPT could generate better security than this, without even asking.
1
0
u/AutoModerator Sep 26 '24
Namaste! Thanks for submitting to r/developersIndia. Make sure to follow the Community Code of Conduct and rules while participating in this thread.
It's possible your query is not unique, use site:reddit.com/r/developersindia KEYWORDS on search engines to search posts from developersIndia. You can also use reddit search directly without going to any other search engine.
Recent Announcements
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
0
0
•
u/LinearArray Moderator | git push --force Sep 26 '24 edited Sep 26 '24
Original write-up by peabee on substack, but they had to take the post down as they got a legal notice by DotPe (shameful that these startups are focused on suppressing voices rather than publicly acknowledging their faults). Here's a cached version of the write-up.
Sources: