7 ms·

I'm kinda relieved that it doesn't work on an iPhone. I often scan codes posted around to save the time typing URLs and running arbitrary code by just scanning

by Jerry2 1y ago

I'm kinda relieved that it doesn't work on an iPhone. I often scan codes posted around to save the time typing URLs and running arbitrary code by just scanning a QR code freaks me out.

kuberwastaken 1y ago
Ironically, I actually wrote a blog about how casually we do this and how dangerous it's become lol https://kuberwastaken.github.io/blog/Technology/QR-Codes-and-Malware---The-Hidden-Dangers-in-2025 https://kuberwastaken.github.io/blog/Technology/QR-Codes-and...
- deleted 1y ago
  [deleted]
- Valodim 1y ago
  The content is good, but fyi the last third or so had a distinct ai padding vibe
  - kuberwastaken 1y ago
    AI padding vibe?
    - poilcn 1y ago
      I kinda see that too. Basically, the way some authors use to increase content size with redundant words is the default behavior for Ai chats plus all the disclaimers to avoid possible litigations or negative public image.
Blikkentrekker 1y ago
It runs inside a web browser though. This is no different from visiting an arbitrary link and running whatever arbitrary code in the Javascript sandbox of that link and one already knows a q.r. code an take one to an arbitrary link.
- dylan604 1y ago
  This QR code does. But what about a QR using similar designed by someone less honorable? With QR codes, you have no idea what will happen until you scan it. At that point, it could be too late
  - Blikkentrekker 1y ago
    As far as I know the only form of code execution they support is by the URL datatype which carries the same risks as wel already mentioned anyway.
- Blikkentrekker 1y ago
  That said, I wouldn't mind an upgrade to the standard of say say if the link be printed above the code in human readable form in some way, the reader would refuse to open it, or at least be configurable to refuse to open it if they not match.
recursive 1y ago
Wait until you hear about javascript on web sites.
berkes 1y ago
How is this different from opening any website through a QR code, that will then run "arbitrary code"?

by Jerry2 1y ago

I'm kinda relieved that it doesn't work on an iPhone. I often scan codes posted around to save the time typing URLs and running arbitrary code by just scanning a QR code freaks me out.

kuberwastaken 1y ago

Ironically, I actually wrote a blog about how casually we do this and how dangerous it's become lol https://kuberwastaken.github.io/blog/Technology/QR-Codes-and-Malware---The-Hidden-Dangers-in-2025 https://kuberwastaken.github.io/blog/Technology/QR-Codes-and...

deleted 1y ago
[deleted]
Valodim 1y ago
The content is good, but fyi the last third or so had a distinct ai padding vibe
- kuberwastaken 1y ago
  AI padding vibe?
  - poilcn 1y ago
    I kinda see that too. Basically, the way some authors use to increase content size with redundant words is the default behavior for Ai chats plus all the disclaimers to avoid possible litigations or negative public image.

Blikkentrekker 1y ago

It runs inside a web browser though. This is no different from visiting an arbitrary link and running whatever arbitrary code in the Javascript sandbox of that link and one already knows a q.r. code an take one to an arbitrary link.

dylan604 1y ago
This QR code does. But what about a QR using similar designed by someone less honorable? With QR codes, you have no idea what will happen until you scan it. At that point, it could be too late
- Blikkentrekker 1y ago
  As far as I know the only form of code execution they support is by the URL datatype which carries the same risks as wel already mentioned anyway.
Blikkentrekker 1y ago
That said, I wouldn't mind an upgrade to the standard of say say if the link be printed above the code in human readable form in some way, the reader would refuse to open it, or at least be configurable to refuse to open it if they not match.

recursive 1y ago

Wait until you hear about javascript on web sites.

berkes 1y ago

How is this different from opening any website through a QR code, that will then run "arbitrary code"?