[beachy]

> Unfortunately, you don't know where the QR code leads you before you scan it and then it is already too late

What are you so scared of? It isn't the 90s where by tricking someone into following a dodgy link their windows machine was instantly pwned.

[simon_acca]

Remote code execution vulns are still routinely discovered, for example: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4199...

[ianbutler]

Trust me when I say randos aren’t dropping modern 0days on restaurant menus. Not when a novel attack can fetch millions through brokers.

[simon_acca]

Not only do I agree with you, but I don’t think anyone would be able to tell an attack was imminent if they were to see the URL anyway. I was just providing facts to the comment above that didn’t seem to think RCE are a thing anymore.

[ianbutler]

Makes sense, my phrasing was poor I should have made that a more general statement not directed at you necessarily. I think the average techy has through some combination of general news like this and just enough technical know how formed an unrealistic threat model for themselves.

[simon_acca]

> the average techy has through some combination of general news like this and just enough technical know how formed an unrealistic threat model for themselves.

amen :)

[EduardoBautista]

I've never heard of this domain before, so I shouldn't click on it because vulnerabilities in the browser are still routinely discovered.

Sorry for the sarcasm, but if you trust clicking on links in a browser, QR codes should be fine as well.

[fiddlerwoaroof]

Yeah, if your threat model involves not trusting links, you should be disabling JavaScript and CSS by default and probably not browsing the web in the first place. Libpng and other libraries frequently have fairly critical bugs that are a bigger concern than MitM attacks.