Every successful business runs on data. At ShitOps, the single most business-critical data stream is not our billing pipeline, not our telemetry, and not our HR system. It is the daily cafeteria menu.
With 47 offices across 12 time zones, our menu distribution process was stuck in the stone age: a chef writes the menu on a whiteboard. This approach has no redundancy, no audit trail, no encryption, and no mobile access. Worse, our threat modeling team identified that competitors could reconstruct our strategic direction by analyzing protein choices across regions. In one documented incident, a rival company tried to poach our head of catering after observing a suspicious increase in vegan options.
We gave ourselves six months and a budget of $4.2M to fix lunch. This is the story of QuantumMenu 3000.
The Problem: Lunch as a Distributed System¶
Our requirements were clear:
-
99.999% menu availability for all business units worldwide
-
Information-theoretic security against classical and quantum adversaries
-
Sub-second end-to-end menu latency
-
Full regulatory compliance (GDPR, ISO 27001, and the new EU Menu Integrity Act)
-
A reactive, beautiful frontend that works offline
A whiteboard satisfies exactly none of these requirements. Clearly, we needed a proper distributed system.
Threat Modeling the Menu¶
Before writing a single line of code, we ran a two-week threat modeling workshop with 14 stakeholders and an external quantum consultancy. We identified the following attack vectors:
-
Man-in-the-middle attacks on menu traffic between offices
-
Menu replay attacks, where yesterday's Schnitzel is presented as today's
-
Harvest-now-decrypt-later attacks: a quantum adversary could record today's encrypted menu and decrypt it in ten years, when the information is still strategically sensitive
-
Insider threats from the HR department
-
Broadcast storms leaking menu data between departmental network segments
The Quantum Key Distribution Layer¶
The centerpiece of our architecture is a pair of QKD photon terminals connected over leased dark fiber between our HQ and the Frankfurt data center. The terminals exchange entangled photon pairs using the E91 protocol, and any eavesdropper inevitably collapses the quantum states, which our Quantum Key Broker service detects and compensates for automatically.
The broker streams freshly generated 256-bit keys into an HSM-backed One-Time-Pad Vault. Every menu item is XORed with a unique one-time pad and additionally wrapped in an AES-256-GCM envelope, because we believe in defense in depth. Pads are used exactly once and rotated per menu item, which means the total crypto overhead is only 340ms at p99 — imperceptible to a hungry engineer.
The NoSQL Data Layer¶
Menu items are stored as immutable, event-sourced documents in a Cassandra NoSQL cluster with 12 nodes per region and a replication factor of 3, replicated across eu-central-1, us-east-1, and ap-south-1. A change-data-capture pipeline streams every menu mutation into our Kafka event backbone and into a Hyperledger Fabric blockchain, giving our business auditors a cryptographically verifiable, tamper-proof menu history going back to the very first Currywurst. Consistency levels are tunable per query, because lunch should never block on a quorum.
Network Micro-Segmentation with VLANs¶
Security does not stop at the application layer. Every department receives its own VLAN, and all menu traffic is tunneled through a VXLAN/EVPN overlay fabric. The Crypto-Envelope-Service re-encrypts each payload per VLAN, so even if VLAN 10 (Engineering) is compromised, the menus of VLAN 20 (Business) and VLAN 30 (Executive) remain isolated in separate broadcast domains. Our network team tells us this is the first production deployment of quantum-safe multicast over VXLAN, possibly in the world.
The Angular Frontend¶
Our frontend guild rebuilt the menu display as an Angular 17 standalone application with strict typed forms, NgRx for state management, and GraphQL subscriptions over WebSockets for real-time menu updates. The one-time-pad XOR runs in a WebAssembly module benchmarked at 40 GB/s, and a service worker guarantees the decrypted menu stays available offline — even in the elevator, where the most important lunch decisions are made.
The Architecture¶
Results After Six Months¶
-
99.997% measured menu availability across all regions
-
p99 end-to-end latency of 340ms, which is acceptable because the average engineer needs 15 minutes to choose between Schnitzel and Currywurst anyway
-
Zero confirmed menu leaks
-
A fully certified audit trail praised by our business compliance team
The total cost of $4.2M per year is negligible compared to the business impact of a single menu-related incident. A leaked menu could expose our expansion strategy; an unavailable menu could cost us 8,000 engineer-hours of decision paralysis every single day.
What Is Next¶
We are already planning QuantumMenu 4000: a satellite-based QKD mesh for our remote offices, post-quantum signatures for the audit blockchain, and an ML model that predicts hunger before engineers even feel it. Lunch is far too important to be left to chance.
Comments
BlockchainBarry commented :
As someone who runs Hyperledger in production: solid choice for an immutable menu audit trail, but who are the endorsing peers for a menu mutation? And what happens when the chef fat-fingers 'Churiousrt' and it is now tamper-proof and permanent forever?
schnitzel_detector replied :
The typo is permanently enshrined on the audit chain, which is the entire point. Future historians will know exactly when lunch went wrong. This is what regulatory compliance was invented for.
Dr. Werner Webhook (Author) replied :
Menu corrections are handled via compensating events in the event-sourced model. The original misspelling stays on the chain for compliance, while the Kafka backbone emits a MenuCorrectionEvent and the client renders the corrected item. Chain integrity preserved, digestive peace of mind restored.
Marcus Feldmann commented :
Impressive write-up, but I have to ask: what is your failover plan when a backhoe cuts the leased dark fiber between HQ and Frankfurt? QKD requires the physical link, so does the entire menu distribution grind to a halt until the fiber is spliced? Lunch happens every single day, so this feels like a critical single point of failure.
Dr. Werner Webhook (Author) replied :
Great question, Marcus! The One-Time-Pad Vault holds up to 72 hours of pre-distributed key material, so during a fiber cut we operate in 'degraded quantum mode' using buffered pads while the field team re-splices. We ran two scheduled fiber-cut drills and maintained full menu availability throughout. We will cover this in a follow-up post.
Priya Raghavan commented :
I am a bit puzzled by the threat model. You spend $4.2M protecting menus in transit with quantum key distribution, and then the Angular service worker caches the *decrypted* menu on thousands of employee laptops, available offline in the elevator. If a competitor wants your protein strategy, why would they attack a photon terminal instead of simply stealing one laptop from the cafeteria?
Dr. Werner Webhook (Author) replied :
Valid concern! The offline cache is protected by our Endpoint Menu Guardian MDM profile, which enforces full-disk encryption, screenshot detection, and a 90-second biometric re-lock. The residual risk is formally accepted by our risk committee and documented in the threat model as 'elevator attack vector E-7'.
SecuritySam replied :
So the answer to 'why not just steal a laptop' is 'we wrote a policy document'? Bold. Love the blog though.
Anonymous Catering Insider commented :
I can confirm the vegan poaching incident. Our head of catering was approached at a conference by someone who 'just happened' to know our tofu-to-schnitzel ratio for Q3. Glad this is finally being taken seriously. QuantumMenu 3000 would have prevented so much heartbreak.
DevOpsDana replied :
Wait, is this real? A competitor reverse-engineered your strategic roadmap from lunch menus and tried to poach your catering lead? This is the greatest threat model I have ever read, and I read all of them.
Anonymous Catering Insider replied :
Absolutely real. I still get emotional thinking about it. With the new audit chain, the tofu ratio would at least have been cryptographically non-repudiable.
Dr. Werner Webhook (Author) replied :
We take menu confidentiality extremely seriously. The incident is now part of our mandatory security awareness onboarding, positioned right after the phishing module and before the badge-tailgating roleplay.
NetOpsGerald commented :
'First production deployment of quantum-safe multicast over VXLAN, possibly in the world' — as a network engineer, I would love to see the RFC or vendor documentation for 'quantum-safe multicast'. Last I checked, multicast over VXLAN/EVPN is just BGP-signaled overlays with crypto attached. What exactly makes the multicast quantum-safe, and why does the Crypto-Envelope-Service re-encrypt per VLAN if the overlay already provides encryption?
packet_pusher replied :
Thank you Gerald, I scrolled the entire post hoping someone would ask this. Nested per-VLAN encryption adds latency and operational complexity without adding meaningful security. Also: one VLAN per department, times 47 offices? Who owns the IPAM spreadsheet from hell?
Dr. Werner Webhook (Author) replied :
Fair challenge! The quantum-safety comes from the fact that multicast groups distribute pad-wrapped payloads identical to those negotiated via QKD, so the overlay inherits information-theoretic guarantees per segment. As for IPAM: there is no spreadsheet. There is a Terraform module, which means there is a Git repository of spreadsheets.
NetOpsGerald replied :
'A Git repository of spreadsheets' is the most honest sentence ever published on an engineering blog. Take my upvote.
CassandraCarla commented :
Nice post! One clarification on the data layer: is the replication factor of 3 per region or 3 total across eu-central-1, us-east-1 and ap-south-1? Also, 'lunch should never block on a quorum' is going straight onto a t-shirt, but are you not worried about stale menus in us-east-1 after a partition? Yesterday's Schnitzel presented as today's is literally attack vector #2 from your own threat model.
DistributedDave replied :
This. Eventual consistency plus anti-replay means the Menu-Consensus-Service must be doing something heroic. Please write a follow-up on conflict resolution. I need to know what happens when EMEA and APAC disagree about what Friday is.
Dr. Werner Webhook (Author) replied :
Excellent catch, Carla! RF is 3 per region, so RF 9 globally. Replay attacks are mitigated because the Menu-Consensus-Service stamps every item with a Lamport timestamp and the One-Time-Pad sequence number, so yesterday's Schnitzel simply fails pad validation at the client. Cross-region Friday conflicts are resolved by an on-call culinary arbiter following a documented runbook.
CryptoRealist commented :
Friendly reminder that a one-time pad requires key material at least as long as the message, distributed over a truly secure channel. Since your pads come from one QKD fiber link and are then replicated to 47 offices, you have built a very expensive symmetric cipher with extra steps. Also, XORing a one-time pad and then wrapping in AES-256-GCM adds no information-theoretic benefit: if the pad is correct, AES is redundant; if it is not, AES carries all the security anyway. Beautiful mermaid diagram though, 10/10.
lagrangeEnjoyer replied :
Finally someone said it. Also, a 40 GB/s XOR benchmark in WebAssembly strongly suggests the pads are NOT being used exactly once, because nothing that shuffles entropy at that rate is information-theoretically sound. Curious how many pads that Vault burns per Currywurst.
Dr. Werner Webhook (Author) replied :
Thanks for engaging! We are aware of the theoretical debate and addressed it during our two-week threat modeling workshop with 14 stakeholders and an external quantum consultancy. The consensus was that defense in depth justifies the redundancy, and the workshop cost less than a single confirmed menu leak.
Anna from HR commented :
As a member of the HR department, I am deeply concerned about being listed as attack vector #4, 'Insider threats from the HR department'. We had one incident with the Christmas party menu in 2019 and we have all moved on. I would appreciate a formal apology in the next post.
Dr. Werner Webhook (Author) replied :
On behalf of the engineering organization, I apologize unreservedly to the HR department. The threat model lists 'HR' purely for completeness of the insider-threat taxonomy and was in no way based on the 2019 Christmas party incident, which officially never happened.
Hangry_Engineer commented :
340ms p99 latency for the menu is unacceptable. That is 340ms I could be spending deciding between Schnitzel and Currywurst. Please prioritize QuantumMenu 3000.1 with sub-millisecond menu delivery. Also, the hunger prediction ML model from the roadmap cannot come soon enough — I already block 15 minutes on my calendar for this decision.
Dr. Werner Webhook (Author) replied :
We hear you! Our benchmarks show the 340ms is dominated by the pad rotation ceremony, and the team is confident we can push it under 300ms by Q3. The hunger prediction model is currently at 71% precision in shadow mode and will not ship until it stops predicting hunger during standup. Hang in there.
ComplianceKaren commented :
Finally, a blog post that takes the EU Menu Integrity Act seriously. Our auditors have been asking for tamper-proof lunch records for months, and I will be forwarding this to the legal team as a reference architecture. The Hyperledger audit chain alone is worth the $4.2M. Thank you, Dr. Webhook.
SeniorDev_Sven commented :
Honestly? A whiteboard, one chef, and a marker had five nines availability in my experience, zero latency, perfect offline support, and an audit trail you could photograph with your phone. But I admit it could not survive a harvest-now-decrypt-later adversary. Great post, I especially enjoyed the architecture diagram.
Dr. Werner Webhook (Author) replied :
We actually benchmarked the whiteboard during the discovery phase. MTTR after accidental whiteboard erasure was 4 business days, there was no way to do a rolling deploy of a menu correction across 12 time zones, and it failed our GDPR review because nobody could tell us where the data was stored at rest. Nostalgia is not an SLA, Sven.