My wife and I are traveling to Switzerland this fall for some bucket-list train rides, including the Glacier Express between Chur and Zermatt.
The Glacier Express requires seat reservations which can only be made 93 days in advance of travel. After checking other dates as they become available, I’m becoming concerned because the seats appear to disappear quickly and what remains are not together.
My planned date for travel is 93 days from tomorrow and I thought Hmmm, 5pm CDT today is midnight CET tomorrow, so I should be able to book now. Nope, tried multiple browsers, private tabs, other tricks but September 26 remains blocked.
Then I approach the problem technically: could the local browser’s date/time be what defines 93 days in advance?
To test the theory, I changed my Mac’s timezone. Immediately my desktop goes into night mode. I create a new private browser tab, and, happily, September 26 is now selectable!
As quickly as possible, I find a train, choose our seats, pay, and anxiously await a confirmation email. It arrives, I have confirmed seats, and now I can start building the rest of our itinerary.
Technically, and fortunately, this isn’t (apparently) a security hole, but definitely an application-logic hole: there’s no way that a local desktop should be able to affect functionality like that, and yet I could. No back-end validation – which is why I was looking at midnight CET – just accept and move on.
Perhaps after our trip I’ll let them know ….
