65 pointsby yewenjie2 hours ago23 comments
  • trevithickan hour ago
    The bigger issue is that to use this gym, you must own a smartphone and you must bring it with you and carry it around while you work out.

    We're just counting down to being unable to exist without a smartphone on your person at all times. What a dystopia.

    • diathan hour ago
      It's quite impossible to actively participate in modern society without a phone anyway. And it's a personal business either way, you can choose another gym. I'm glad mine does QR entry because thanks to that it's open 24/7/365 when there's no staff, even during holidays like Christmas. You can just go anytime that's convenient for you, so it's a trade-off I'm willing to make.
      • taco_emojian hour ago
        Easily solvable problem though. NFC keys, RFID keycard, scan a driver's license, etc.
    • S0y29 minutes ago
      My gym also recently introduced a new app that gives you a QR code to get in. but luckily the old system of punching in your member code is still available.
    • pc86an hour ago
      Don't worry, smartphones are cheap, can be easily upgraded by the user, and last for a decade or more before needing upgrade or replacement.

      Right?

    • mywittynamean hour ago
      I've taken to using the dumb, low-tech option where possible to try to push back on our techno-dystopian future. Printing out boarding passes, using cash, asking for menus at places with QR codes on the napkins, etc.

      Unfortunately, I think it's already impossible to attend major events without a phone, at least if it's a major event at a stadium. Smaller venues still send out emails with QR codes we can just print out.

    • essephan hour ago
      A bank in Japan just blocked website access for account tasks. MUST use a phone with their app.

      I posted about it yesterday, I think.

  • otter-in-a-suitan hour ago
    What's with all the negative comments here? I thought this was a reasonably interesting article about _actually hacking something_, whether this person needed to or not. You know, like in "HackerNews"?
    • mywittynamean hour ago
      I was going to post something positive, but it amounted to "good job, this is a clever way to use AI to improve your quality of life." But it seemed too basic and wouldn't serve as the nucleus for a discussion, so I didn't post it.

      Being negative gives people something to talk about.

  • twiclo44 minutes ago
    I used to love reading things like this. The exciting part was the detective work. Watching someone think about how it works and trying potential ways to crack the system. Now every one of these articles is, "So I pointed an AI model at it then tried it again with a different one and now I have what I want." I felt the same disappointment when I read the article about hacking the Switch 2.

    It's just not interesting to me. I'm sure most of us here have fixed little annoyances in our lives with AI at this point. I could write a post about how I forked newpipe to add features I wanted but I doubt anyone would care because they can just do that too.

    I know the world is different now. I'm just crying about it is all.

  • throwaway89201an hour ago
    Somewhat relatedly: did you know that the "RSA Authenticator (SecurID)" app only tries to detect Frida / ptrace hooks for the first few seconds of its runtime, after which it loads the symmetric OTP secret into memory? Now you do.
  • drnick1an hour ago
    I like that you took matters into your own hands, but here my preferred approach would have been to approach management and request an alternative access method. I do have separate profiles on my GOS phone for this kind of situations, but I have been on a crusade against phone apps for years now, and ultimately this is a social problem.

    I similarly reject apps and QR menus in restaurants, airlines, etc. If you can't be bothered to give me a paper menu, I can't be bothered to eat in your establishment.

    • devmor15 minutes ago
      My go-to for these situations is a little white lie: "The only smartphone I use is provided by my employer, and your app did not pass the security review."

      This generally gets me a workaround. I do even have a company phone with locked down applications... it's just not my only phone.

    • paimapian hour ago
      Yeah, I'd even leverage the fact that you work in software to make a note about how deeply invasive this is and how much it opens up unnecessary surface areas to attacks.
    • eesmith42 minutes ago
      My gym switched to smartphone/QR code entry. Only those without a smartphone were excepted. (There was a member her 80s with no cell phone, for example.)

      I overheard several very forceful discussions from people who had a smartphone but wanted to leave it at home. The staff - likely on orders from the gym chain - refused to budge.

      • drnick123 minutes ago
        I would tell management that I don't have a cell phone, and, if they refused to oblige when an alternative exists, cancel my membership there and then. Businesses need to be reminded that the customer is king.
  • eterman hour ago
    This is dated today but I could have sworn I read a similar story here a few years ago about hacking their gym's QR code, but I can't now find it on algolia.

    Update: It was hard to find because it was titled, "I accidentally became PureGym’s unofficial Apple Wallet developer"

    https://news.ycombinator.com/item?id=44910865

  • alistairSHan hour ago
    Does Android not have a "wallet" feature? My gym does the app-based QR code for entry, but on Apple, I just add that app to my wallet and the QR appears there, I only need to access the app proper to check class and pool schedules.
  • hk__2an hour ago
    > To be clear, I’m leaving out some details to keep the gym and myself anonymous

    For the last part, it’s maybe not the best idea to put a link "GitHub & CV" at the bottom then ;)

  • joshstrangean hour ago
    Years ago when I went to Planet Fitness I didn't like their app and it was slow to load the barcode I needed to scan to get in. Thankfully that barcode didn't rotate so I was able to just make my own Apple Pass and set it up to be geo-fenced on the gym so as I walked up it would pop up as a notification I could tap to open my code.

    I love being able to do things like this and rip out the crap being forced down our throats.

    • mywittynamean hour ago
      I spent 30 minutes trying to get my friend's "visitor pass" to work for me, before giving up.

      The person at the front desk was absolutely no help and could have been replaced with a sign that said, "you can do everything in the app."

  • alsetmusic34 minutes ago
    > Half of this project was ripgrep.

    This is the real strength of LLMs. Not that they write the most sophisticated code; it's the brute force element. The "I wouldn't have spent the time on it," aspect.

  • blue_green_mapsan hour ago
    This is the future of software with AI: everyone can have hyper-personalized software to solve very personally-specific problems.
    • lifeisloving41 minutes ago
      The truth is, not everyone is just going to suddenly start building things, especially software, just because its easy.

      The AI companies are trying to convince dentists offices they need Claude. The truth is regular people don't care. There's always only going to be a subset of the population that wants to build things.

  • SoftTalkeran hour ago
    My gym issues an NFC keyfob you scan at the turnstyle (and at the door, after hours). I keep it clipped to a lanyard on my gym bag so I don't forget it or lose it.

    They review video and deal with friends sharing a keyfob pretty harshly. Membership revoked.

  • willcate2 hours ago
    Wow. The QR code changing every 15 minutes... that's like trying to get into a rock concert. Well done
    • mywittynamean hour ago
      15 seconds... And the standard for TOTP is 30 seconds. So it's not crazy compared to the standard. Though, there's really no reason for the codes to update so fast.
      • fyltran hour ago
        They are probably doing it to avoid account sharing?
        • ihswan hour ago
          This is the answer here, gyms across the country have implemented nearly identical functionality (bar codes or QR codes are required on entry, staff are trained to be aware of customers sharing or using shared screenshots of the above codes, and the codes have a very short lifetime.)
    • develoopest2 hours ago
      The QR changed every 15 seconds.
  • dasil00344 minutes ago
    I guess it's good to know this gym is explicitly leaning into the meat market aspects of the gym, and maybe there's nothing wrong with that. But over time won't that subtly turn off the clientele that are not attention-seeking narcissists?

    The idea that a gym is a place where you will likely meet fit, attractive people is something that I think has a broader appeal as long as it remains subtle and unspoken. As soon as you make it explicit with social media it seems like it kills the vibe pretty fast. Or maybe I'm just old and the youngs will just take it in stride like the rest of the world that software has eaten.

  • smusamashahan hour ago
    Another solution could have been to run something like Tasker or Automate to launch app, take QR from current activity (this is the main part) and display just that and once you are done, dismiss the rest of the app.
  • nancyminusonean hour ago
    >it prompts you to post a story of your session

    An excellent portal to accept a fictionalized ai slop version of "your" experience. Make it long, and maybe put a recipe at the bottom.

    • lenerdenatoran hour ago
      Marketers need to realize that it's rude to not compensate people for those people helping with marketing.

      I think a story of how you saw a dude drying off his gluteal cleft with the hand dryers in the locker rooms would be an appropriate "experience" if the payment is nothing.

  • lifeislovingan hour ago
    I have deepseek hooked up to a couple rooted phones REing android apks basically 24/7. Its quite useful. One of the few things I think llms are genuinely useful for.
  • elAhmoan hour ago
    Just change your gym bro, not worth supporting this behaviour.
  • citguru34 minutes ago
    Lol, love it
  • QuercusMaxan hour ago
    Building your own AES implementation is pretty insane and obvious a bad idea...
    • lxgran hour ago
      If you need security, sure. If you’re trying to break somebody else’s, what exactly is the problem?
      • QuercusMaxa few seconds ago
        Unless you think their AES is faulty in some way, it's just a waste of time, and rolling your own crypto is almost always a bad idea
  • MattDamonSpacean hour ago
    I find dissonance between “I hate these products” and “I’m going to freeride by eg blocking their ads”

    I know the effect is negligible but isn’t that just stealing

    • wvenablean hour ago
      Going to bathroom during the commercials is also stealing. Or maybe it's not stealing. The argument quickly becomes more complicated the more you think about it.
      • bravoetchan hour ago
        It becomes simple if you define stealing as having criminal legal consequences. Since there are none, it's not stealing.
        • wvenable15 minutes ago
          I assumed we were talking about the moral argument. Is stealing still stealing if there is no government? If grok takes food from brog in the cave, is that not still wrong?
    • tensoran hour ago
      I always pay to remove ads. I only block if I'm left with no option to pay. You might consider it stealing, but I consider forced ads as psychological warfare, so on the whole I feel I'm in a morally fair place.
    • delectian hour ago
      TFA doesn't mention advertising in relation to the specific app in question, nor does it imply that it even has ads. The only mention of it is a broader "I don't like social media because of the ads".
    • jawilson2an hour ago
      He's paying for the gym already?
    • lxgran hour ago
      It is, and it’s pretty unfortunate that so many companies are getting away with stealing so much of my time, attention, and hardware resources.
    • alistairSHan hour ago
      I assume he's paying a gym membership. IMO, that membership (across all members) should be sufficient to pay for the gym to operate. If not, that's the problem.
    • bravoetchan hour ago
      > I know the effect is negligible but isn’t that just stealing

      No. They pay for a gym membership, there is literally nothing to steal from the social media feed in the door-unlocking app.

    • 0c3ca83an hour ago
      No. But failing to loudly protest gives these companies license to continue.
    • nancyminusonean hour ago
      Guess I will steal then.
    • devmoran hour ago
      If you provide a service expecting the user to interact with your service in the way you designed and they do not, that is a problem with your service, not theft.

      It would be theft if the user was bypassing payment-gated credentials, but that is not the case here.

    • an hour ago
      undefined
    • vlyanan hour ago
      yes, just like you're stealing from the supermarket when you buy real food (low to no markup) instead of corn-syruped artificially-flavored slop, alcohol, and cigarettes (high to obscene markup). every time you leave the store without a bag of Doritos, a bottle of MtDew, and a pack of Marlboro, you're being a bad citizen.
    • g0ld3nrati0an hour ago
      no
    • dfxm12an hour ago
      If you hate the app enough, you could see this as damaging them (consuming its resources without getting the ads). Even if it is negligible, it might feel good.
    • wahnfriedenan hour ago
      No
  • b800han hour ago
    This person has too much time on their hands.
    • spidericean hour ago
      They said smugly, before continuing to scroll Hacker News
  • Druponan hour ago
    >However, I’m super aggressive about social media and feeds I don’t control. Any app that shows me a feed I can’t turn off, sort, or filter—I take that as psychological warfare against me.

    Is it just me or are people getting too stuck in a Manichean mindset about this kind of thing? This reads like an alcoholic complaining about a work happy hour or something. Just, don't use the social media stuff.

    >For the longest time, my LinkedIn bio was “I HATE LINKEDIN.”

    OP kind of just seems insufferable. Touch grass.

    • itakean hour ago
      Why do I even have to see it? It is designed to get me sucked in. Imagine if an sober alcoholic must see beer ads every time they open up amazon.com to go shopping.
    • Bratmonan hour ago
      Yeah, how DARE someone want to go to the gym without participating in social media?! What an absolute asshole!
      • flanz_10an hour ago
        Both things can be true at the same time, lol.
    • alistairSHan hour ago
      Just you, maybe.

      I hate the "ubiquity" of social media. For me, it's not social media conceptually that's the issue, it's that Meta and others are not good companies. They exist by doing their best to get me addicted to their feeds. It's not healthy. Whether or not there's a non-harmful way to do social media is unknown (by me, at least).