4 ms·
Whenever you do this sort of thing, you should check whether they do negative number checking on the client side or in the API itself. You might be able to get
by 13of40 9y ago
Whenever you do this sort of thing, you should check whether they do negative number checking on the client side or in the API itself. You might be able to get 1 pizza with bacon and (1) pizza without, all for the price of the bacon.
- joombaga 9y agoGood advice; I'm not sure I tried that. The goal wasn't to steal toppings or get free pizza though; it was an impromptu response to my desire for lots of bacon and encountering the duplicate limit, and then a busy signal on the phone. Once I figured out it didn't charge me for more, I just wanted to see what would happen. I figured they'd think it was a system glitch and call when they received the order.
- BigJono 9y agoI'm struggling to grok exactly how that would work. 1 pizza with bacon, -1 pizza (without bacon?) Then what, hope the employee reads -1 as 1 and doesn't cancel the order and call you to find out what you wanted? I must be missing something...
- thiagocsf 9y agoThe employee will ignore the negative sign in front of the number and make you that pizza anyway. The calculation of the total is where it might give you free pizza.
- BigJono 9y agoYeah that's what I figured. The wording of the post made it sound like it had something to do with the bacon though. You could just do this for any arbitrary pizza.
- TomMarius 9y agoThe bacon is there so you pay something, a free pizza would be weird even to a minimal wage employee (not that they're dumb, but they probably don't care).
- XaspR8d 9y agoThough that's assuming the people making online orders even bother looking at the amount paid. I don't necessarily see why they would (or why they wouldn't assume you had merely cashed in some sort of promo or balance).
- lambdas 9y agoBeing a negative, the delivery driver arrives and demands you give him a pizza.
- ikeboy 9y agoI've seen instances this works on gift cards.
- Lazare 9y agoI work for a company with a similar sort of online ordering API, and a while back some enterprising person discovered that: 1. Our API had a hidden "tip" feature; we hadn't exposed it in the storefront yet, mostly because the developer in charge of it had left with it halfway finished, and nobody had picked it back up yet 2. But the API itself was perfectly functional. If you manually submitted an order to the API with a tip set, it would be reflected in the total, would bill your credit card, etc. 3. Except (I'm sure you saw where this is going...) the now-departed dev hadn't added any validation yet. So if you ordered $40 worth of pizza and added a negative $39 tip...boom, nearly free pizza. We learned a few valuable lessons for the cost of buying a college student a couple of pizzas. :)
- dx034 9y agoAt least you didn't sue them for that. There are enough companies that would've done so..
- Lazare 9y agoWe actually debated offering them a job interview when they graduated. If they'd contacted us first, we might have. :) Instead we just fixed the bug, called it a day, and spent a few days reviewing the rest of the API for weak validation.
- laythea 9y agoI wonder what would happen if you order $40 worth of pizza and stated a -$41 tip! paid to eat pizza, hurray!
- CamperBob2 9y agoInstructions unclear. Employee entered home and stole existing pizza from freezer.
- fredley 9y agoNo pizza, half -1 bacon?