The Great Pizza Arbitrage Scheme Of 2020 Is Spotlighting The Strangeness Of Food Delivery Services

from the supply-and-gourmand dept

Food delivery services always felt a bit wonky to me. I'm usually not terribly old fashioned about most things, but I generally understood that some restaurants delivered and some did not and that that was mostly fine. Along came food delivery services to bring us food from places that didn't deliver and that was mostly fine, too. But lately it's starting to become clear that somewhere in the ecosystem of venture capitalist funding and food delivery services, something is broken. We'll explore the larger issues in a separate post, but one great example of how janky this is getting is how one pizzeria owner managed to make a nice profit by buying his own pizzas from DoorDash. Confused? Well, buckle up.

Yesterday, Ranjan Roy, a content strategist and writer, wrote about the latter in his newsletter The Margins; one of his friends who owns a few pizza restaurants suddenly got an influx of customers complaining about delivery when the restaurants didn’t offer delivery. “He realized that a delivery option had mysteriously appeared on their company’s Google Listing. The delivery option was created by Doordash,” Roy wrote.

Apparently, this is one way that DoorDash does customer acquisition — by bullying restaurants. But what’s funnier about Roy’s friend’s problem (and it was a real problem because of Yelp reviews and angry customers) is that DoorDash priced the pizzas incorrectly. “A pizza that he charged $24 for was listed as $16 by Doordash,” emphasis Roy’s. And then: “My third thought: Cue the Wall Street trader in me…..ARBITRAGE!!!!”

And so began the dumbest transaction plan in the modern history of business. The pizzeria owner placed some DoorDash orders, expecting that eventually DoorDash would catch on. It didn't. To date, even with journalists now asking the company direct questions, DoorDash hasn't commented as of the time of this writing. At $8 per pizza in pure profit, the owner went ahead and ordered an indeterminate, but more than 10, number of pizzas. It got fun enough as an experiment that eventually the owner just ordered pizza dough through DoorDash, alleviating the need to even turn on the ovens, at $75 in pure profit.

Are these huge numbers? No, except that when this sort of thing happens to the restaurant rather than the delivery service, the former operating under much smaller margins with real hard costs, it's a problem. Those problems mostly being what happens when DoorDash delivers crappy service that the customer thinks is from the restaurant as well as customers getting used to these very low prices when the owners of the business actually charge more for the product.

The answer isn’t clear because we’re very far from the old ways. By the magic of venture capital, some businesses don’t have to make money to survive. And that’s upended things for everyone. “Third-party delivery platforms, as they’ve been built, just seem like the wrong model, but instead of testing, failing, and evolving, they’ve been subsidized into market dominance,” as Roy puts it. “The more I learn about food delivery platforms, as they exist today, I wonder if we’ve managed to watch an entire industry evolve artificially and incorrectly.”

As Bloomberg put it last Halloween: “GrubHub Inc. just announced disappointing quarterly results and said that food delivery is only a means to an end, unlikely to ever be profitable on its own. The risk heading into 2020 is that the inevitable reckoning for the food-delivery businesses will spread to the broader restaurant industry.” And at the end of the first quarter of 2020, that looks more prescient than ever. According to its first quarter report, GrubHub, the only profitable restaurant delivery business, lost $33.4 million over the last 3 months. (In fairness: COVID-19.)

Yeah, but in other fairness, companies that cannot make a profit aren't supposed to survive in capitalist societies. That's sort of a cultural lodestone in our economy. And while venture capital can certainly prop up emerging businesses that otherwise would never launch into real profitability, it's worth considering whether the food delivery business has run out of runway.

On the question of why these food delivery service companies seem to almost universally lose money, more to come.

Filed Under: arbitrage, food delivery, pizza
Companies: doordash

Hey Doordash: Why Are You Hiding Your 'Security Notice' From Google Just Days After You Revealed A Massive Security Breach?

from the questions,-questions dept

As you might have heard, late last week, delivery company DoorDash admitted via a Medium post that there had been a large data breach exposing info on 4.9 million users of the service. The breach had actually happened months earlier, but was only just discovered earlier this month.

We take the security of our community very seriously. Earlier this month, we became aware of unusual activity involving a third-party service provider. We immediately launched an investigation and outside security experts were engaged to assess what occurred. We were subsequently able to determine that an unauthorized third party accessed some DoorDash user data on May 4, 2019. We took immediate steps to block further access by the unauthorized third party and to enhance security across our platform. We are reaching out directly to affected users.

The information accessed included names, emails, delivery addresses, order histories and phone numbers. Salted and hashed passwords were accessible too, but assuming Doordash didn't mess up the salting/hashing, those should still be safe. Some customers also had the last four digits of their credit cards revealed.

All in all a somewhat typical breach that happens these days. However, as TechCrunch cybersecurity reporter Zack Whittaker noticed, somewhere right around the time the breach went up, DoorDash told Google to stop indexing its "SecurityNotices" page via robots.text.

He also notes that DoorDash doesn't seem to be going out of its way to alert people to the breach -- pointing out that there's nothing on DoorDash's front page, or on its various social media accounts. Just the blog post on Medium (and, if I'm not mistaken, Medium posts can end up behind a paywall in lots of cases). That's pretty lame. My guess is that since DoorDash says it's "contacting" customers impacted by the breach, it felt it didn't need to do wider outreach. But... that seems like a huge cop out. Notifying people of such a breach is kind of important.

And, also, yanking your "securitynotices" directory from Google (even if it currently appears blank) seems super suspicious. Why do that except to hide information from people searching for info about your security issues? A breach of this nature is bad, but it happens to so many companies these days that I don't think this kind of breach leads to much trust lost from customers. However, proactively trying to keep things quiet about this... well... that's the kind of thing that raises eyebrows and destroys trust.

Of course, in a bit of perfect timing to distract from all of this, DoorDash happily announced today that it's now delivering for McDonald's, so get your Big Macs quick and ignore any lingering concerns about security...

Filed Under: breach notification, robots.txt, security, security breaches
Companies: doordash