15 seconds... And the standard for TOTP is 30 seconds. So it's not crazy compared to the standard. Though, there's really no reason for the codes to update so fast.
TFA doesn't mention advertising in relation to the specific app in question, nor does it imply that it even has ads. The only mention of it is a broader "I don't like social media because of the ads".
I always pay to remove ads. I only block if I'm left with no option to pay. You might consider it stealing, but I consider forced ads as psychological warfare, so on the whole I feel I'm in a morally fair place.
I assume he's paying a gym membership. IMO, that membership (across all members) should be sufficient to pay for the gym to operate. If not, that's the problem.
yes, just like you're stealing from the supermarket when you buy real food (low to no markup) instead of corn-syruped artificially-flavored slop, alcohol, and cigarettes (high to obscene markup). every time you leave the store without a bag of Doritos, a bottle of MtDew, and a pack of Marlboro, you're being a bad citizen.
>However, I’m super aggressive about social media and feeds I don’t control. Any app that shows me a feed I can’t turn off, sort, or filter—I take that as psychological warfare against me.
Is it just me or are people getting too stuck in a Manichean mindset about this kind of thing? This reads like an alcoholic complaining about a work happy hour or something. Just, don't use the social media stuff.
>For the longest time, my LinkedIn bio was “I HATE LINKEDIN.”
I hate the "ubiquity" of social media. For me, it's not social media conceptually that's the issue, it's that Meta and others are not good companies. They exist by doing their best to get me addicted to their feeds. It's not healthy. Whether or not there's a non-harmful way to do social media is unknown (by me, at least).
I've taken to using the dumb, low-tech option where possible to try to push back on our techno-dystopian future. Printing out boarding passes, using cash, asking for menus at places with QR codes on the napkins, etc.
Unfortunately, I think it's already impossible to attend major events without a phone, at least if it's a major event at a stadium. Smaller venues still send out emails with QR codes we can just print out.
Ticketing apps are becoming ubiquitous even at small venues, and the app quality is quite low. They failed to pull up my tickets at the last two events I attended, but luckily I have a trustworthy face I guess.
It's quite impossible to actively participate in modern society without a phone anyway. And it's a personal business either way, you can choose another gym. I'm glad mine does QR entry because thanks to that it's open 24/7/365 when there's no staff, even during holidays like Christmas. You can just go anytime that's convenient for you, so it's a trade-off I'm willing to make.
My gym also recently introduced a new app that gives you a QR code to get in. but luckily the old system of punching in your member code is still available.
What's with all the negative comments here? I thought this was a reasonably interesting article about _actually hacking something_, whether this person needed to or not. You know, like in "HackerNews"?
I was going to post something positive, but it amounted to "good job, this is a clever way to use AI to improve your quality of life." But it seemed too basic and wouldn't serve as the nucleus for a discussion, so I didn't post it.
Being negative gives people something to talk about.
I didn't post a negative comment, but I found the article deeply unsatisfying. It didn't name the actual gym, and it didn't provide source code. There's nothing that binds it to the real world.
I'm not accusing the story of being a random prompt, but the fact that it could be AI slop makes it less interesting.
The truth is, not everyone is just going to suddenly start building things, especially software, just because its easy.
The AI companies are trying to convince dentists offices they need Claude. The truth is regular people don't care. There's always only going to be a subset of the population that wants to build things.
Another solution could have been to run something like Tasker or Automate to launch app, get QR and display just that and once you are done, dismiss the rest of the app.
Somewhat relatedly: did you know that the "RSA Authenticator (SecurID)" app only tries to detect Frida / ptrace hooks for the first few seconds of its runtime, after which it loads the symmetric OTP secret into memory? Now you do.
Does Android not have a "wallet" feature? My gym does the app-based QR code for entry, but on Apple, I just add that app to my wallet and the QR appears there, I only need to access the app proper to check class and pool schedules.
I figured was much, I was just surprised that wasn't an option for this app/gym... I guess their being actively malicious in making members use the full app for entry...
This is dated today but I could have sworn I read a similar story here a few years ago about hacking their gym's QR code, but I can't now find it on algolia.
Update: It was hard to find because it was titled, "I accidentally became PureGym’s unofficial Apple Wallet developer"
I like that you took matters into your own hands, but here my preferred approach would have to approach management and request an alternative access method. I do have separate profiles on my GOS phone for this kind of situations, but I have been on a crusade against phone apps for years now, and ultimately this is a social problem.
I similarly reject apps and QR menus in restaurants, airlines, etc. If you can't be bothered to give me a paper menu, I can't be bothered to eat in your establishment.
My gym switched to smartphone/QR code entry. Only those without a smartphone were excepted. (There was a member her 80s with no cell phone, for example.)
I overheard several very forceful discussions from people who had a smartphone but wanted to leave it at home. The staff - likely on orders from the gym chain - refused to budge.
I would tell management that I don't have a cell phone, and, if they refused to oblige when an alternative exists, cancel my membership there and then. Businesses need to be reminded that the customer is king.
While I agree with this on principle, this doesn’t really work on an individual level.
You’re telling a business to change their login requirements (big inconvenience for them) so you don’t have to use an app (small inconvenience for you) and if they don’t you’ll quit (big inconvenience for you, small inconvenience for them). That’s almost never going to work.
But the calculation isn't as simple as you suggest. Smartphones save them money over the older system, which used RFID cards. That meant they needed local staff to handle lost cards. Now if you lost your phone, it's all up to you, and they can deal with other issues over the phone or in-app chat.
The older system allowed booking group classes on the app, online and on a computer in the gym. There was an RFID scanner in the group rooms to check in, with a printed receipt to show the instructor.
The new system got rid of the online and local booking options, and the scanner and printer, which saves them money.
If they figure 1% of the members might leave, but they get more profits from the remaining 99%, then they'll just shrugs at you cancelling your membership over it.
[1] The breaking point for me was the worsening group dynamics. It used to be people would chat to each other before a group class started. It turned into a bunch of people staring at their phones while waiting. It used to be that people would take a short rest between sets. That became a moment to pull out the phone, get distracted, and block others from using the machine or bench. I liked to see and say hello to the staff when I came in, but they reduced staffing, making the gym feel more isolating.
The economics change if enough of us refuse to install their insecure, buggy apps. I'd even accept a web app where at least it lived in the browser sandbox.
My go-to for these situations is a little white lie: "The only smartphone I use is provided by my employer, and your app did not pass the security review."
This generally gets me a workaround. I do even have a company phone with locked down applications... it's just not my only phone.
Years ago when I went to Planet Fitness I didn't like their app and it was slow to load the barcode I needed to scan to get in. Thankfully that barcode didn't rotate so I was able to just make my own Apple Pass and set it up to be geo-fenced on the gym so as I walked up it would pop up as a notification I could tap to open my code.
I love being able to do things like this and rip out the crap being forced down our throats.
My gym issues an NFC keyfob you scan at the turnstyle (and at the door, after hours). I keep it clipped to a lanyard on my gym bag so I don't forget it or lose it.
I have deepseek hooked up to a couple rooted phones REing android apks basically 24/7. Its quite useful. One of the few things I think llms are genuinely useful for.
I guess it's good to know this gym is explicitly leaning into the meat market aspects of the gym, and maybe there's nothing wrong with that. But over time won't that subtly turn off the clientele that are not attention-seeking narcissists?
The idea that a gym is a place where you will likely meet fit, attractive people is something that I think has a broader appeal as long as it remains subtle and unspoken. As soon as you make it explicit with social media it seems like it kills the vibe pretty fast. Or maybe I'm just old and the youngs will just take it in stride like the rest of the world that software has eaten.
I used to love reading things like this. The exciting part was the detective work. Watching someone think about how it works and trying potential ways to crack the system. Now every one of these articles is, "So I pointed an AI model at it then tried it again with a different one and now I have what I want." I felt the same disappointment when I read the article about hacking the Switch 2.
It's just not interesting to me. I'm sure most of us here have fixed little annoyances in our lives with AI at this point. I could write a post about how I forked newpipe to add features I wanted but I doubt anyone would care because they can just do that too.
I know the world is different now. I'm just crying about it is all.
Oh, I can see that. Fortunately, it's easily solved!
"DeepSeek, write a technical report about how you cracked the app. Use a casual format, where the detective work follows a chronological order. Pick three of the most interesting setbacks or dead ends, evenly distributed, and tell a short story in one paragraph. Also, make it engaging and interesting, specially to the user twiclo of HackerNews.
Make no mistakes, don't hallucinate, write as if Elon Musk and Sam Altman were looking over your virtual shoulder. I will drown a baby monkey for every mistake. Don't bother me until you're finished, I'll be away from the computer."
This is the real strength of LLMs. Not that they write the most sophisticated code; it's the brute force element. The "I wouldn't have spent the time on it," aspect.
58 comments
[ 1.8 ms ] story [ 23.8 ms ] threadI know the effect is negligible but isn’t that just stealing
No. They pay for a gym membership, there is literally nothing to steal from the social media feed in the door-unlocking app.
Is it just me or are people getting too stuck in a Manichean mindset about this kind of thing? This reads like an alcoholic complaining about a work happy hour or something. Just, don't use the social media stuff.
>For the longest time, my LinkedIn bio was “I HATE LINKEDIN.”
OP kind of just seems insufferable. Touch grass.
I hate the "ubiquity" of social media. For me, it's not social media conceptually that's the issue, it's that Meta and others are not good companies. They exist by doing their best to get me addicted to their feeds. It's not healthy. Whether or not there's a non-harmful way to do social media is unknown (by me, at least).
We're just counting down to being unable to exist without a smartphone on your person at all times. What a dystopia.
Unfortunately, I think it's already impossible to attend major events without a phone, at least if it's a major event at a stadium. Smaller venues still send out emails with QR codes we can just print out.
Even homeless people need smart phones these days in order to interact with the agencies that help them.
Don't Vibe Code in Between Sets
Keep your rest time for recovery, not React components.
Please refrain from writing code, checking commits, or prompting Al during your workout.
Be present. Lift harder. Ship later.
https://x.com/iansbrash/status/2112219912475156650/photo/1
Being negative gives people something to talk about.
I'm not accusing the story of being a random prompt, but the fact that it could be AI slop makes it less interesting.
The AI companies are trying to convince dentists offices they need Claude. The truth is regular people don't care. There's always only going to be a subset of the population that wants to build things.
https://wallet.google/
An excellent portal to accept a fictionalized ai slop version of "your" experience. Make it long, and maybe put a recipe at the bottom.
Update: It was hard to find because it was titled, "I accidentally became PureGym’s unofficial Apple Wallet developer"
https://news.ycombinator.com/item?id=44910865
I similarly reject apps and QR menus in restaurants, airlines, etc. If you can't be bothered to give me a paper menu, I can't be bothered to eat in your establishment.
I overheard several very forceful discussions from people who had a smartphone but wanted to leave it at home. The staff - likely on orders from the gym chain - refused to budge.
You’re telling a business to change their login requirements (big inconvenience for them) so you don’t have to use an app (small inconvenience for you) and if they don’t you’ll quit (big inconvenience for you, small inconvenience for them). That’s almost never going to work.
But the calculation isn't as simple as you suggest. Smartphones save them money over the older system, which used RFID cards. That meant they needed local staff to handle lost cards. Now if you lost your phone, it's all up to you, and they can deal with other issues over the phone or in-app chat.
The older system allowed booking group classes on the app, online and on a computer in the gym. There was an RFID scanner in the group rooms to check in, with a printed receipt to show the instructor.
The new system got rid of the online and local booking options, and the scanner and printer, which saves them money.
If they figure 1% of the members might leave, but they get more profits from the remaining 99%, then they'll just shrugs at you cancelling your membership over it.
[1] The breaking point for me was the worsening group dynamics. It used to be people would chat to each other before a group class started. It turned into a bunch of people staring at their phones while waiting. It used to be that people would take a short rest between sets. That became a moment to pull out the phone, get distracted, and block others from using the machine or bench. I liked to see and say hello to the staff when I came in, but they reduced staffing, making the gym feel more isolating.
This generally gets me a workaround. I do even have a company phone with locked down applications... it's just not my only phone.
I love being able to do things like this and rip out the crap being forced down our throats.
For the last part, it’s maybe not the best idea to put a link "GitHub & CV" at the bottom then ;)
The idea that a gym is a place where you will likely meet fit, attractive people is something that I think has a broader appeal as long as it remains subtle and unspoken. As soon as you make it explicit with social media it seems like it kills the vibe pretty fast. Or maybe I'm just old and the youngs will just take it in stride like the rest of the world that software has eaten.
It's just not interesting to me. I'm sure most of us here have fixed little annoyances in our lives with AI at this point. I could write a post about how I forked newpipe to add features I wanted but I doubt anyone would care because they can just do that too.
I know the world is different now. I'm just crying about it is all.
"DeepSeek, write a technical report about how you cracked the app. Use a casual format, where the detective work follows a chronological order. Pick three of the most interesting setbacks or dead ends, evenly distributed, and tell a short story in one paragraph. Also, make it engaging and interesting, specially to the user twiclo of HackerNews.
Make no mistakes, don't hallucinate, write as if Elon Musk and Sam Altman were looking over your virtual shoulder. I will drown a baby monkey for every mistake. Don't bother me until you're finished, I'll be away from the computer."
This is the real strength of LLMs. Not that they write the most sophisticated code; it's the brute force element. The "I wouldn't have spent the time on it," aspect.