>This site only worked for 4 hours until the SFMTA cut the data source I was using. This data is a snapshot of how it looked on Sept. 25, 2025 at noon.
Title: Built: Second City Citation — A Live Chicago Parking Ticket Tracker - Zayyan Faizal
Second City Citation is a project that tracks Chicago parking tickets by reverse-engineering the city's public payment and verification web portals.
The city's parking payment API was found to be insecure, as it fails to verify hCaptcha tokens on the backend, rendering the UI-based security ineffective.
Accessing the city's internal ticket data requires an authorization token obtained through a secondary security endpoint, which revealed poor implementation of RESTful standards.
Parking violation images provided by the city contain metadata, such as officer IDs and exact locations, which can be extracted using OCR technology.
Ticket distribution patterns are inconsistent because enforcement officers frequently skip ticket IDs during shifts, breaks, or when moving between zones.
Ticket ID allocation is not strictly sequential, as the API returns 422 errors when boundaries of assigned ticket blocks are reached.
The developer successfully mapped ticket data by using intelligent scanning algorithms that group active tickets into bands based on ID proximity and recency.
The project utilizes an automated scanner that manages hot, warm, and cold exploration intervals to identify and track new ticket ranges efficiently.
To manage infrastructure costs, the project was deployed on a self-hosted server using Debian and Coolify, secured by Cloudflare Tunnels and Access.
Despite the city attempting to block the server's IP and adding CAPTCHAs to image viewers, the developer maintains the tracker by bypassing these security measures.
If anyone is curious on how Chicago got robbed on their parking revenue: https://en.wikipedia.org/wiki/Chicago_Parking_Meters
You should share with
https://chihacknight.org/
seems like a very similar idea to a site made by walzr, previously posted to HN. i’ll find the link somewhere
It was this one: https://walzr.com/sf-parking/
>This site only worked for 4 hours until the SFMTA cut the data source I was using. This data is a snapshot of how it looked on Sept. 25, 2025 at noon.
What a shame! Still such a cool idea!
Is the motive to diaript police work?
To disrupt a pretty well-known racket. There's been tons of rulings like this[0] yet nothing ever gets done about it.
[0] https://www.ctmlegalgroup.com/resources/chicago-overcharged-...
Thank you for extra insight
One man's "disruption of police work" is another's protected First Amendment activity. https://www.reuters.com/article/world/us/top-new-hampshire-c...
Big. They paid the meters kindly?
Parking problem everywhere
https://www.taipeitimes.com/News/front/archives/2024/03/08/2...
omg, this is super cool... who the hell did they get that data?
Summary from the About page:
Title: Built: Second City Citation — A Live Chicago Parking Ticket Tracker - Zayyan Faizal
Second City Citation is a project that tracks Chicago parking tickets by reverse-engineering the city's public payment and verification web portals. The city's parking payment API was found to be insecure, as it fails to verify hCaptcha tokens on the backend, rendering the UI-based security ineffective. Accessing the city's internal ticket data requires an authorization token obtained through a secondary security endpoint, which revealed poor implementation of RESTful standards. Parking violation images provided by the city contain metadata, such as officer IDs and exact locations, which can be extracted using OCR technology. Ticket distribution patterns are inconsistent because enforcement officers frequently skip ticket IDs during shifts, breaks, or when moving between zones. Ticket ID allocation is not strictly sequential, as the API returns 422 errors when boundaries of assigned ticket blocks are reached. The developer successfully mapped ticket data by using intelligent scanning algorithms that group active tickets into bands based on ID proximity and recency. The project utilizes an automated scanner that manages hot, warm, and cold exploration intervals to identify and track new ticket ranges efficiently. To manage infrastructure costs, the project was deployed on a self-hosted server using Debian and Coolify, secured by Cloudflare Tunnels and Access. Despite the city attempting to block the server's IP and adding CAPTCHAs to image viewers, the developer maintains the tracker by bypassing these security measures.