4 ms·

That Covid vaccine project gives me chills. That’s not saying it’s wrong to use an advantage like coding skill or anything else to increase your odds of survivi

That Covid vaccine project gives me chills. That’s not saying it’s wrong to use an advantage like coding skill or anything else to increase your odds of surviving a pandemic— but it’s a new world we live in for sure. Edit: I guess I need to clarify I’m not asserting anything was right or wrong.

sergiomattei 5y ago
I did the same. When vaccinations opened up for the elderly, I wrote a script to check open slots and get my grandparents a vaccine appointment. They patched it up, but similar to the author, I managed to get them one soon after through their website. I’m wondering if we’re even talking about the same website. Wild days.
melling 5y ago
“This didn’t turn out to be necessary (more appointments opened up pretty soon anyway), but it was fun.”
kinduff 5y ago
Have done the same but using a scrapper, not for COVID, but for an impossible to schedule appointment I had to do in a government website. I still think it could be monetized but I don't feel like doing it. I heard a friend that there is a lot of people doing this manually and they charge you a considerable rate.
mr_mitm 5y ago
This was done with a lot of collaborative effort in Germany: https://github.com/iamnotturner/vaccipy https://github.com/iamnotturner/vaccipy
bhaak 5y ago
It's always been this way. But advantages aren't always that obvious. In my case, it was just "don't reload the page while waiting for the server to respond" as the servers were DDOSed on the first day they opened the appointments. Obvious to many programmers, not so obvious to the general public that you might lose your position in the queue if you reload the page and not wait for a proper error page before reloading. Another advantage was getting my PS5. I wrote a simple web scraper that just looked if the shops had any PS5 in stock and wrote that into a static RSS I uploaded to my webserver and stuck this into my regular RSS reader. Over the last year, this way I could provide myself and 3 friends/acquaintances the opportunity to get a PS5. Other people can build tables and shelves. I'm a programmer.
Macuyiko 5y ago
We had a similar governmentally organized system in our country during the first vaccination round where people could book an appointment. The website fell over and the devs introduced a queuing system and had you waiting in line. Except that it was badly implemented and only enforced client-side (through JavaScript) and hence very easy to circumpass. It also had a similar API which could be polled to see when a slot freed up. This actually happens quite often. As another example, there is a particular country visa centre which requires you to make an appointment and is typically fully booked for weeks on end. The calendar info is loaded in through an API call and the selected date then form POSTed with a hidden field's value set to an identifier representing the date and time. Not in plaintext, but easy enough so that it can be guessed. Once you spoof the value, no further server-side validation happens and no one at the centre will check it. I wanted to book a restaurant a couple of weeks ago. As I was discussing options with a friend, the booking provider already forced a refresh and our desired time slot was gone. Again, taking a look in the Network tab of the browser and spoofing a value led to a confirmation at the desired time. I expected a call saying that they were overbooked, though strangely enough the place was not packed (I guess they kept some tables open for social distancing / walk-ins / phone reservations). This is really security 101 on the same level as SQL injection. Strange how every dev seems to know how to hook up something to an API but still makes the same mistakes.
GOATS- 5y ago
I did the same as well. https://github.com/GOATS2K/nhs-vaccination-checker https://github.com/GOATS2K/nhs-vaccination-checker

sergiomattei 5y ago

I did the same. When vaccinations opened up for the elderly, I wrote a script to check open slots and get my grandparents a vaccine appointment. They patched it up, but similar to the author, I managed to get them one soon after through their website. I’m wondering if we’re even talking about the same website. Wild days.

melling 5y ago

“This didn’t turn out to be necessary (more appointments opened up pretty soon anyway), but it was fun.”

kinduff 5y ago

Have done the same but using a scrapper, not for COVID, but for an impossible to schedule appointment I had to do in a government website. I still think it could be monetized but I don't feel like doing it. I heard a friend that there is a lot of people doing this manually and they charge you a considerable rate.

mr_mitm 5y ago

This was done with a lot of collaborative effort in Germany: https://github.com/iamnotturner/vaccipy https://github.com/iamnotturner/vaccipy

bhaak 5y ago

It's always been this way. But advantages aren't always that obvious. In my case, it was just "don't reload the page while waiting for the server to respond" as the servers were DDOSed on the first day they opened the appointments. Obvious to many programmers, not so obvious to the general public that you might lose your position in the queue if you reload the page and not wait for a proper error page before reloading. Another advantage was getting my PS5. I wrote a simple web scraper that just looked if the shops had any PS5 in stock and wrote that into a static RSS I uploaded to my webserver and stuck this into my regular RSS reader. Over the last year, this way I could provide myself and 3 friends/acquaintances the opportunity to get a PS5. Other people can build tables and shelves. I'm a programmer.

Macuyiko 5y ago

We had a similar governmentally organized system in our country during the first vaccination round where people could book an appointment. The website fell over and the devs introduced a queuing system and had you waiting in line. Except that it was badly implemented and only enforced client-side (through JavaScript) and hence very easy to circumpass. It also had a similar API which could be polled to see when a slot freed up. This actually happens quite often. As another example, there is a particular country visa centre which requires you to make an appointment and is typically fully booked for weeks on end. The calendar info is loaded in through an API call and the selected date then form POSTed with a hidden field's value set to an identifier representing the date and time. Not in plaintext, but easy enough so that it can be guessed. Once you spoof the value, no further server-side validation happens and no one at the centre will check it. I wanted to book a restaurant a couple of weeks ago. As I was discussing options with a friend, the booking provider already forced a refresh and our desired time slot was gone. Again, taking a look in the Network tab of the browser and spoofing a value led to a confirmation at the desired time. I expected a call saying that they were overbooked, though strangely enough the place was not packed (I guess they kept some tables open for social distancing / walk-ins / phone reservations). This is really security 101 on the same level as SQL injection. Strange how every dev seems to know how to hook up something to an API but still makes the same mistakes.

GOATS- 5y ago

I did the same as well. https://github.com/GOATS2K/nhs-vaccination-checker https://github.com/GOATS2K/nhs-vaccination-checker