90 ms·
NULL license plate not such a bright idea
- Causality1 7y agoThe interesting question this article poses is whether there's a system in place for the government to revoke vanity plates it's already approved. Can they force him to change the plate?
- Aloha 7y agoThey usually can, and various states have before.
- sokoloff 7y agoMy favorite such revocation: https://jalopnik.com/virginia-dmv-revokes-worlds-greatest-license-plate-5724684 https://jalopnik.com/virginia-dmv-revokes-worlds-greatest-li... (Virginia's "EATTHE" Children First plate) I think they should have been allowed to keep it, frankly.
- moftz 7y agoThey just wouldn't let him renew his vehicle registration unless he changes his vanity plate or goes back to the a random number.
- kens 7y agoYes, of course they can revoke vanity plates. For example, the story (2002-2004) of the Washington software engineer who spent a couple of years fighting to keep his "GOTMILF" license plate and ended up having it canceled. Ref: http://www.thesmokinggun.com/documents/crime/end-road-gotmilf-license-plate http://www.thesmokinggun.com/documents/crime/end-road-gotmil...
- Scoundreller 7y agoOntario Canada has an anesthesiologist with a “FENTANYL” license plate. Was funny in 1995, not so much now. So he went to the DMV and asked them to change it, and they wanted to charge him to do that. He’s like, no, i’m not paying. Eventually he writes a letter to his politician saying “please revoke my license plate” and eventually he gets a letter saying they got a complaint (ie: his) and the DMV wants to revoke his plate. But he had to wait 30 days For the appeal clock to run out, just in case he wanted to appeal his own complaint. Kinda funny, but kinda sad that someone paid $400k+ per year by the government wasted thousands more because he didn’t want to pay the $100 plate change fee. * some details/numbers estimated from memory.
- tbyehl 7y agoMy state has legislation about denying / revoking vanity plates and 'It inconveniences our computers' is not a valid reason.
- visarga 7y agoNULL strikes again, this time IRL!
- dkarl 7y agoThis time?
- sparrish 7y agoThis is funny. I wonder what would happen if you could put a 'NOT ' in front of your plate number... would everyone but you get a ticket?
- deleted 7y ago[deleted]
- dhosek 7y agoNah, because it's not unsanitized SQL at fault, but people writing a literal NULL in the license plate field when there isn't one.
- baybal2 7y agoI wonder, what will "DROP *;" license plate do?
- desas 7y agoNah, because it's not unsanitized SQL at fault, but people writing a literal NULL in the license plate field when there isn't one.
- delinka 7y agoNothing because it's not unsanitized SQL at fault.
- SamuelAdams 7y agoMost states do not allow special characters in the plate text.
- reaperducer 7y agoDepends on how you define "special." I've seen hearts on California tags, and I think some glyphs on Virginia tags, but I might not be remembering that correctly.
- SteveNuts 7y agoSeems like a brilliant idea to me, hopefully it forces them to fix their shitty software. I would chip in to crowdfund this guy's battle for sure.
- pardavis 7y agoWhen I was a foolhardy college student I figured out that if the cited vehicle make on my city parking ticket didn’t match my registration, I could get appeal the ticket via a web form very easily and succeed every time. Naturally I removed the badges from my car and put on different badges from another manufacturer. After a while they started to cite me as “other” and the trick no longer worked.
- RcouF1uZ4gsC 7y agoRelevant xkcd comic https://xkcd.com/1105/ https://xkcd.com/1105/
- Iv 7y agoIn the Starcraft 2 community it is called barcoding. Basically, I 1 | l are all accepted characters for a name and I think some do look actually identical on most fonts used in the game. So yeah, one person doing that you call "barcode", 2 persons doing that, you already have deniability. Be more than 10, and that's a crowd.
- amyjess 7y agoBack when I used to play Ingress, that was really common. The Enlightened in Dallas had a ton of barcode names.
- BryantD 7y agoThe new client makes it much easier to distinguish the characters, but there are still plenty of barcodes in the game.
- Retric 7y agoYou can reuse names in SCII, so it’s more a convention than anything else. The important bit is to have many accounts with similar names.
- knd775 7y ago
- mieseratte 7y agoGuess I should FOIA the DMV to find out what my state's default value is.
- astura 7y agoThese tickets were issued by a privately operated citation processing center.
- mieseratte 7y agoMy state doesn't allow for private companies to automatically mail you a ticket but requires an officer pull you over and cite you.
- entropicdrifter 7y agoIn any state private companies' tickets don't count since they aren't issued by an officer of the court. You can just straight up ignore red light camera tickets.
- mieseratte 7y ago> You can just straight up ignore red light camera tickets. How does that work? They send you a ticket you're under no obligation to pay or otherwise respond to? What's the incentive?
- EliRivers 7y agoRelated, for those who missed it the last time it was here on HN, the tales of Christopher Null, who has an unfortunate surname: https://www.wired.com/2015/11/null/ https://www.wired.com/2015/11/null/ , and Jennifer Null , http://www.bbc.com/future/story/20160325-the-names-that-break-computer-systems http://www.bbc.com/future/story/20160325-the-names-that-brea... , likewise.
- MaxBarraclough 7y agoMuch-needed Outline.com of the wired.com article: https://outline.com/WMzjYK https://outline.com/WMzjYK
- efreak 7y agoIt seems meaningful to me that the wired website works (sort of; the left margin is 1/3 of my screen) with JavaScript disabled, and outline doesn't work at all.
- MaxBarraclough 7y agoIf there were a better alternative I'd gladly use it.
- cortesoft 7y agoI love when people double down out of principle, when the only person getting hurt is themselves. He refuses to change it because he did nothing wrong...sure, but you are also the only one being hurt by it. Is this really the hill to die on?
- xxs 7y agoDie on? But how - he can challenge the fines in a court of law. Since it's a vanity plate, adding an extra notoriety won't hurt.
- xeromal 7y agoCourt isn't cheap. You're paying for it with a lawyer or with your own time
- giancarlostoro 7y ago> Droogie contacted the DMV who told him to change his plate. He refused because he didn't do anything wrong. While they wiped the fines off his record, unfortunately for him, they didn't fix the problem in the system so once again, Droogie has accrued another $6,000 in tickets that he had nothing to do with. He says he won't be paying those either. Except he just contacted the DMV. No lawyers necessary.
- jedberg 7y agoKnowing the California DMV, that contact probably took at least two hours.
- dawnerd 7y agoNumber of years ago I was frustrated because they never sent me my renewed card and it turned out they never updated my address even though I did the paperwork. Took it to twitter and tagged @CA_DMV and they responded pretty quickly and took care of it. Got my new card pretty much next day.
- exfed 7y agoThis kind of thing makes me question how tightly we couple (or fail to couple) the "code of Law" to the "code of Computers".
- tsss 7y agoShout out to all the Python programmers from the other frontpage thread who are responsible for bugs like this with their crappy scripting languages.
- thomasjudge 7y agoIf you want to throw darts at someone, I think database systems with three-valued logic would be a better target. This criticism (not for these reasons) has been leveled...
- SEJeff 7y agoCrappy code can be written in any language, see all of the CVEs in C code, even when written by experts. As surprising as it may be, bad code is often written by bad programmers. It doesn't matter what language you use if you write bad code.
- tsss 7y agoBut scripting languages make it especially easy to do so. That doesn't mean people who use them are bad programmers. They just chose a bad tool.
- SEJeff 7y agoAnd php makes it easier than python, but it isn't a scripting language. Your original point is still invalid. Alternatively, some amazing tooling has been written in these "terrible" scripting languages. Instagram was sold for a billion dollars and was a glorified Python Django webapp ontop of a Postgres database. I got in a similar debate with a coworker recently over some go code he wrote. He told me that go code didn't need full unit tests because the compiler checked for bugs. Amusingly, he swapped the order of two int arguments in a pull request literally an hour after our discussion. I pointed out how a unit test would have prevented the production regression he caused, and then he started writing tests for his changes. So yet again, scripting languages have nothing to do with "good" or "bad" code. It is all about good vs bad developers.
- 7y ago
- jeffdavis 7y agoIt sounds like a bright idea to me.
- oarabbus_ 7y ago>Apparently, when they didn't have the right data for a vehicle, a privately operated citation processing center used the word NULL in the license plate field for many tickets. >used the word NULL Oh god, I feel faint.
- astura 7y agoSee also, the person who had the personalized license plate "NO PLATE" (and similar). https://www.snopes.com/fact-check/licensed-to-bill/ https://www.snopes.com/fact-check/licensed-to-bill/
- listenallyall 7y agoThis is clearly an entirely fake anecdote. Show me a pic and change my mind.
- ceejayoz 7y agoIt's been blogspammed. There's photo evidence in the much better article at https://mashable.com/article/dmv-vanity-license-plate-def-con-backfire/ https://mashable.com/article/dmv-vanity-license-plate-def-co... from the DEFCON talk.
- listenallyall 7y agoOK, a screenshot of a list of tickets. An 8-year old could create that in Excel. A photo of the license plate?
- dhosek 7y agoThere was a similar issue in California where, in the days before on-line choosing of vanity plates, you would give three choices. One guy couldn't come up with a third option so he wrote "NO PLATE" and ended up with that as his plate with similar results. Snopes has the story: https://www.snopes.com/fact-check/licensed-to-bill/ https://www.snopes.com/fact-check/licensed-to-bill/
- 27182818284 7y agoIf I recall correctly, this comes up a lot with null.com too with respect to emails, etc. I think there was even an HN post about all the null@null.com emails collected by someone.
- willis936 7y agoThis reminds me of the bit that mentions that St. Peter has a list of questions he asks people at the Pearly gates. Among them he asks, “Did you have a vanity plate?”
- joering2 7y agoThere are ways to properly sanitize inputs these days so NULL becomes "NULL" (string), BUT also tons of systems moved into JSON format assuming its safe. It is not. JSON is not binary safe and there are tons of unicode chars that will break JSON. I was once overseeing system that people would bring down all the time by registering usernames that the app could not properly sanitize and they in return were breaking JSON format to the halt of the whole system. I should not admit but using same chars I myself broke few youtube channels when comments and votes were working in JSON format themselves without properly removing unsafe char codes. Good times.
- heavenlyblue 7y agoNo, it’s not the JSON format that is broken - it’s the parser you use for JSON that is broken.
- joering2 7y agoWell not me. More like large vast of websites used to or still have. The assumption was all I need is JSON and it will properly format data during exchange.
- heavenlyblue 7y agoThen you would be surprised it also doesn’t handle big integers well in JavaScript, too!
- ryanseys 7y agoPlay stupid games, win stupid prizes.
- ldoughty 7y agoI have a family member who's license plate started with "&". The DMV accepts it, plates were ordered online fine, but police systems can't handle it apparently, to my family members ultimate discomfort. I commonly joke it probably gets the individual out of automated tickers for speeding and red lights, but when an officer pulls them over we sometimes need to explain that the "&" is dropped in the system (or so we've been told) and that seems to clear up issues
- vinay427 7y agoAny word on whether the plate without the preceding '&' is in circulation? I'd be curious if your records in the police systems would be merged with the records of the owner of that plate.
- toast0 7y agoThe rules for california are the special symbols (which don't include &) are non-significant. Everything but the plate itself ignores them. Washington doesn't have special symbols, but does have an optional dash, which is also not significant.
- netsharc 7y agoI guess it doesn't happen a lot, but they'd have a crazy time if they had to deal with Arabic license plates..
- reaperducer 7y agoI sometimes see California tags with a heart character in them. Does anyone know if those considered part of the number, or are they just ignored as decoration?
- tdiggity 7y agoThey're a special vanity style plate in CA. They probably just are ignored/not entered when searching. https://www.dmv.ca.gov/portal/dmv/detail/online/elp/elp https://www.dmv.ca.gov/portal/dmv/detail/online/elp/elp
- Scoundreller 7y agoThere’s a lot of interesting options. How about NaN NaN?
- strictfp 7y agoOr "[object Object]"
- in_hindsight 7y agoCan you have brackets in license plate?
- vinay427 7y agoThis isn't an issue with the program lacking a valid input. The 'NULL' was hardcoded as a default value by a private processing company. (See the third paragraph in the article.)
- antisemiotic 7y agoBobby Tables started school in 2007, so he'd be around 17 today, seems about right.
- djyaz1200 7y agoLOL! Can we have a new subcategory on HN for comic relief stuff like this! :)
- kens 7y agoI read years ago in comp.risks about a similar story. A guy in 1979(!) requested a personalized plate "SAILING", with second choice "BOATING". He didn't want a customized plate if he couldn't get those, so for his third choice he put down "NO PLATE". Of course, he ended up with "NO PLATE". He ended up getting 2500 parking tickets, since cars with no plate had "NO PLATE" written on the ticket. References: http://www.mekabay.com/overviews/risks/risks03_1986_06-04-1986-10-30.pdf http://www.mekabay.com/overviews/risks/risks03_1986_06-04-19... https://www.snopes.com/fact-check/licensed-to-bill/ https://www.snopes.com/fact-check/licensed-to-bill/
- sieabahlpark 7y agoI remember a different story where the guy had to fight every ticket in court
- 3wolf 7y agoOn the plus side, he could also contest legitimate tickets unless they recorded other information.
- DecoPerson 7y agoI managed to do this at my university. I had vanity plates with a design made by my local Australia shire, which had the shire emblem between two parts of the plate. The plate was something like "123ABC" but I'm guessing emblem read as an O, so their scanners saw "123OABC", which was not a plate registered with the uni. Each day there was a 10-20% chance I would get a ticket on my windshield. I would collect them and take them to the uni security office once a fortnite to have them cancelled in bulk. I actually got pretty friendly with some of the staff there. At least 4 of them were legitimate tickets because I parked overtime, over a line, etc, but the staff cancelled them anyway (:
- deleted 7y ago[deleted]
- 7y ago
- the-dude 7y agoI once had a product owner for a student/university web app who complained that for a particular user, their lastname was displayed as 'None'. This was a Python project and the product owner apparently already had learned 'None' equals NULL. I dug into the file which we used to import the users from and discovered the user's lastname actually was 'None'.
- jgtrosh 7y agoMaybe it could be added to the list of falsehoods programmers believe about names: https://shinesolutions.com/2018/01/08/falsehoods-programmers-believe-about-names-with-examples/ https://shinesolutions.com/2018/01/08/falsehoods-programmers...
- Izkata 7y agoNow, was it a case of number 20 and they were required to enter something, or was it actually legally None? https://www.houseofnames.com/none-family-crest https://www.houseofnames.com/none-family-crest
- the-dude 7y agoMaybe the case. However, this was an international student org and the student was from Africa. We assumed it was correct and did not dig to the bottom. Whatever the truth was, I could close the ticket.
- wcoenen 7y agoI think this example falls under falsehood 31, where None would be considered a "bad word" that can't appear in names.
- jgtrosh 7y agoThat describes making some "bad" values illegal, where I believe the problem here was that they didn't expect the value.
- 7y ago
- mherrmann 7y agoIs this actually possible? Aren't strings at least surrounded by quotation marks ('NULL') while NULL isn't?
- vinay427 7y agoThe 'NULL' string was being entered by the private company: > Apparently, when they didn't have the right data for a vehicle, a privately operated citation processing center used the word NULL in the license plate field for many tickets.
- tempestn 7y agoIt's not a database sanitization issue. The problem is that for cars that don't have a plate or the plate wasn't entered for whatever reason, in some cases people were entering "NULL" (the string). That then ended up matching his plate.
- dec0dedab0de 7y agoThis isn't even a coding error, NULL is apparently valid license plate, and for some reason there is a private processing center typing it in to the government system. First of all they are accidentally committing fraud (libel?) against this guy. But more importantly, why is there a private processing center? Don't the officers type this in as they fill out the ticket? or even just scan the plates? If there aren't plates on the vehicle it should be towed or booted. What is the point of recording tickets with no plates? Is the processing center paid per ticket recorded?
- delinka 7y agoBrand new cars don't yet have plates. Granted, most states now have dealer-printed labels with an identifier on them, but still, new cars don't immediately have plates when they roll off the lot.
- reaperducer 7y agoWhen I lived in West Virginia, recently sold cars did not have temporary tags. It was very common to see hand-scrawled signs "TAF" in the back windows. TAF stood for "Tags Applied For." I'm not sure if that's still happening.
- dtech 7y agoIt's not fraud or libel, it's an unavoidable problem with in-band signalling [1]. I assume the government entry system doesn't have an explicit way to set the data as missing, so they work around it like this. [1] https://en.wikipedia.org/wiki/In-band_signaling https://en.wikipedia.org/wiki/In-band_signaling
- voldacar 7y agoGuess they should have used the Maybe monad!
- quickthrower2 7y agoThey'd type in: Just "NULL"
- lordnacho 7y agoThat's a bit curious though. If the code relies on a magic value, you'd think it's in order to skip trying to get data it doesn't have, like the address of the unidentifiable cars. Even if NULL then does have this address attached, why does it take the branch where it looks for the data? I suppose it would be in a relational DB, perhaps there's a join that drops missing entries, but if they aren't missing they show up?
- delinka 7y agoThe code doesn't rely on a magic value, the humans have decided that an empty value will be typed, by hand, into their terminals as the characters "NULL". The problem is that the employees with access to the system are required to enter a 'valid' value. But in some cases there is no value. So the 'valid' value they've come up with is the string "NULL" - they can't use "~~NULL~~" because ~ isn't allowed on a license plate. So because A) anyone can request a valid value on a plate, and B) nonce values must also be "valid" within the system, the tax payer is capable of ordering a nonce value on a plate.
- rory096 7y ago>the humans have decided that an empty value will be typed, by hand, into their terminals as the characters "NULL" Almost certainly because of software constraints, like the form not allowing the plate number field to be blank.
- otterley 7y agoSource article: https://mashable.com/article/dmv-vanity-license-plate-def-con-backfire/ https://mashable.com/article/dmv-vanity-license-plate-def-co...
- lgeorget 7y agoWell that's what happen when you use a special value that's actually not that special and is part of the valid values domain. If they had to use a string (and I doubt they had to), they could at least have used the empty string.
- indianSummer 7y agoI own a rare collector car with a three-digit VIN. This has caused endless hassles at the DMV as well as the insurance office. Sometimes we find success by prepending the necessary number of zeros, before the VIN. Other instances in the same system require appending zeros after the VIN. The true VIN has a hyphen but that never makes it into the DMV's system. One time I got stuck in a particularly nasty loop where the DMV mailed over thirty notices claiming the register would expire on 01/01/0000.
- technothrasher 7y agoHmm, is this just because it is so few digits? I've had plenty of classic cars that have commission numbers with between six and twelve digits instead of VINs, and haven't ever had any issue with the DMV here in MA.
- CydeWeys 7y agoWhat car is it?
- jle17 7y agoReminds me of a recent groceries delivery to my home. I had ordered online the day before and had some trouble filling in the form but managed to validate it anyway. The delivery man called to tell me my address was incorrect. When I asked him what was wrong, he told me it said 'Null Null Null Null'.
- DJBunnies 7y agoStan, are you in here? My buddy Stan registered for null@verizon.com back in the early 2000s so you could link sms to email delivery. Wound up with so. many. text messages. Reminders to take medicine, personal convos, sports results, everything. Was great fun to read while waiting for class.
- kev009 7y agoThe case for stronger type systems for layman programmers in an easily understood parable.
- hn_throwaway_99 7y agoTangentially related somewhat-common bug: YAML files will interpret the literal 'no' as boolean false if it's not quoted, instead of as a string. Many developers have wondered why, when they stuck country-specific configurations in a YAML file, that things suddenly stopped working when they expanded support for Norway.
- strenholme 7y agoI always felt Yaml is far too complicated of a format for storing hierarchical data. JSON is too simple (no comments; hard to store multi-line strings). HCL, the hierarchical data storage language used by Terraform, is the closest thing I’ve seen to a happy medium between JSON and Yaml. Another option, if the string values are not multi-line, is CommentJSON (use the Python module or write 10 lines of code that strips out comments from JSON if using another language).
- marcosdumay 7y agoBoth a bare > and a sequence of 3 quotes are invalid in JSON, so it should be really simple to add multi-line strings wither Python or Perl style.
- roryokane 7y agoThe Hjson format does this: https://hjson.org/ https://hjson.org/. It’s just JSON plus syntax sugar such as // comments and '''multiline strings'''.
- oever 7y ago{"comment": "JSON supports comments just fine. :-)"}
- foobiekr 7y agoYAML has tons of warts like this. https://yaml.org/type/bool.html https://yaml.org/type/bool.html This should be used in schools as an example to illustrate how not to do things.
- atsushin 7y agoMoral of the story: Test at your own risk! At least his story brings to light the poor quality of software the DMV is using. I'm curious about the other, unintended consequences of naming things null in other web applications; maybe its time to explore ...
- SeanLuke 7y agoDanny White, a resident of Washington, DC, had a similar problem: his vanity license plate read "NO TAGS", which happens to be what police there put down in the license plate slot for missing plates. https://www.google.com/search?client=firefox-b-d&q=danny+white+no+tags https://www.google.com/search?client=firefox-b-d&q=danny+whi...
- harryh 7y agoI recently saw a car with a license plate of B8B88BB8 (or something to that effect) that I am almost certain the owner chose to make it hard to read and transcribe correctly by either humans or computer vision systems. I was honestly kind of impressed.
- cj 7y agoThis thought had come to me a few years ago and I've always wanted to try it. Never got around to it, though. - 1Iil - B8 - 0Oo Examples: - i1lIil1I - 8BBil8I1
- entropicdrifter 7y agoMost states don't use lowercase, but otherwise a solid plan
- frankchn 7y agoRelevant xkcd: https://xkcd.com/1105/ https://xkcd.com/1105/
- rtkwe 7y agoI'm surprised more places don't do what Nintendo did with course ids in Super Mario Maker 2. They intentionally removed some characters that are visually similar to avoid confusion when writing out codes.
- retzkek 7y agobase32? "an alphabet of A–Z, followed by 2–7. 0 and 1 are skipped due to their similarity with the letters O and I (thus "2" actually has a decimal value of 26)." https://en.wikipedia.org/wiki/Base32 https://en.wikipedia.org/wiki/Base32
- rtkwe 7y agoNo they removed Z, I, & O from A-Z+0-9. They removed Z because it looks similar to 2 in some cases too I bet.
- sharadov 7y agoupdate Table set LicensePlate = 'NOPLATES' where LicensePlate = 'NULL';
- natch 7y agoThis post has way too much traction to flag now but I wish we didn’t have sites like this that take a bit of admittedly interesting content from elsewhere and repost it with an infinite scroll of spammy ads. Seems to be a clever technique here too, ending the article with what seems like a non-ending, so the user will keep scrolling. If I remembered where the original content was I’d post it, or had a desktop/laptop browser to search with right now, I’d post a link, but I don’t. I just remember having read a much better article about this in the past.
- linker3000 7y agoA colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which they didn't realise. It was about a week before the router dropped its connection and needed to re-authenticate - and that's when I was called in to investigate the loss of connectivity - which Windows 10 very unhelpfully reported as the network cable disconnected and was resetting or power-saving on the NIC so the "link active" LED on the switch was going out for about 2 secs every 10 sec. Cue a round of cable and switch swapping to no benefit. The LEDs for all other devices on the switch (running Linux and mostly internal servers) were behaving normally. I finally backtraced to the router and a useful error message. We put two-and-two together and my colleague called up the auto-saved details in their password manager; it was long, and ALL non-alpha numeric characters - starting with a backtick, which the router would not accept. I tethered my phone to my laptop and tried to login to the Web account portal - which would NOT accept the passphrase. I tried it without the backtick "just in case" - nope. We had to do a "lost password" reset on the portal..and wait for the email with link. Lessons learned: The ISP's password change page did not seem to validate input, but the login page did. Avoid backticks in passwords.
- stevekemp 7y agoSo many home-routers are run with horrid CGI-scripts on the back-end - I'd not be amazed to learn that submitting a form-field with `blah` in it would try to run the command blah (probably via busybox). If you have time/patience it might be worth exploring.
- hultner 7y agoI've actually rooted an Asus router owned by a relative, this was about 5 years back so it's hopefully fixed now. Noticed some strange behavior after a mistype and tried something like `whoami` (not exactly) and got root back so tried a reverse she'll with NC which worked perfectly. Googled it afterwards and found a ton of similar flaws on other home routers. Tried to do some kind of responsible disclosure but never got a reply or saw a fix then I forgot about it.
- kccqzy 7y ago
- deleted 7y ago[deleted]
- epx 7y agoShould use nullptr :P
- MichaelMoser123 7y agoi guess nil wouldn't work either - it probably worked because of sql NULL keyword. https://en.wikipedia.org/wiki/Null_(SQL) https://en.wikipedia.org/wiki/Null_(SQL)
- leonsmith 7y agoStories like these and the bobby droptables xkcd are the reason I ended up with this plate, https://i.imgur.com/O7KEFrn.jpg https://i.imgur.com/O7KEFrn.jpg It gets a lot of compliments and attention even if most people don't know what "null" is
- yongjik 7y agoReminds me of the story of Ireland's worst Polish driver who never got caught: http://news.bbc.co.uk/2/hi/uk_news/northern_ireland/7899171.stm http://news.bbc.co.uk/2/hi/uk_news/northern_ireland/7899171....
- rebuilder 7y agoI've also heard a similar story of a Finnish man who got a ticket in the UK, and on closer inspection found his name on the ticket listed as Mr. Ajokortti Körkort. Thats "driver's licence", first in Finnish, then Swedish, and is written at the top of the driver's license card. That said, I find these stories a little hard to credit, since you'd expect police officers in the EU to be fairly familiar with the standard EU driver's license layout.
- LanceH 7y agoI've been at some tournaments where a couple of the kids had the last name "Bye". They picked up a fair number of forfeits during the season.
- diatribattical 7y agoI once had a BevMo cashier in California ask me, “Massachusetts? Is that in Canada?” Very little faith left.
- impeachTheIdiot 7y agoYea, but it’s understandable an America sucks a geography (what do you expect with a shit education system). I expect better from the EU.
- josteink 7y agoConfusing the value NULL for a non-null string-sequence which says “NULL” shows the clear sign of a system where no data can be assumed to hold any integrity. These bugs and categories of errors should simply not be possible in sane languages or frameworks.
- rtkwe 7y agoThat's not what's happening at all please reread. > Apparently, when they didn't have the right data for a vehicle, a privately operated citation processing center used the word NULL in the license plate field for many tickets. Since that just happens to be Droogie's license plate, he got all of them. So it's 'confusing' the string NULL used incorrectly (kind of, it's fine under the assumption that no one will have the license plate NULL but that assumption is wrong) with the string NULL.
- deleted 7y ago[deleted]
- andrewclunn 7y agoShould have gone with NaN
- _nickwhite 7y agoYears ago (in the late 90's or early aughts) when ordering vanity plates online became a thing, I got approved for the plate "127.0.0.1". This was a California or NC plate- can't remember as I lived in both states. I checked the mailbox excitedly every day like Ralphie from A Chrismas Story for my uber cool plate. When I finally did get something from the DMV, it was too small to be a license plate and was simply a note that said "Sorry, your requested plate conflicts with a motorcycle plate, so we have to deny your request." Huge bummer, but I guess 127.0.0.1 becomes 127001 in their systems.
- hammock 7y agoCould someone devise a SQL injection attack using a custom-made license plate? I'm imagining someone printing up x'; DROP TABLE drivers; -- on a plate, and driving up and down the highway past automated license-plate readers.
- growt 7y agoAh little Bobby drivers ...
- HenryBemis 7y agoIt always makes me so happy to see a "little Bobby tables we call him" reference when data inputs are discussed!!! I will assume that we are all aware of the Exploits of a Mom, but just in case we have anyone reading this that doesn't already appreciate XKCD: https://www.xkcd.com/327/ https://www.xkcd.com/327/
- tapland 7y agoWith how these systems seem to be written, absolutely.
- close04 7y agohttps://hackaday.com/2014/04/04/sql-injection-fools-speed-traps-and-clears-your-record/ https://hackaday.com/2014/04/04/sql-injection-fools-speed-tr... Another picture (which I can't seem to find now) purportedly showed how one of the screens over the highway was displaying just an error message after triggering this exploit.
- tapland 7y agoAutomated its unlikely. I would guess they have a list of allowed characters to OCR to (right? Please!?) But if entered manually by someone?
- swissknife 7y agoOMG!
- vallismortis 7y agoActually, it was brilliant because it pointed out how flawed the system is, that it can be passively broken or circumvented. This could be used to invalidate all citations that were issued from agencies using that software.
- ChuckMcM 7y agoSimilarly don't get 'none', 'no plate', or 'na' :-) It would be cool if you could do punctuation so you cloud get "'; drop table;" alas little Bobby Droptables will likely never get that plate. :-) I did see a plate "I<heart>0X45" which was a cute nerd joke, I expect that would be more difficult to get these days.
- gwbas1c 7y agoI would think a cease and desist, followed by a lawsuit, would clear things up very fast. BTW, California has a problem with issuing both plates with 0 (zero) and O (letter) in them. They both look the same.
- tempodox 7y agoGreat idea. Any cop writing you up and any traffic cam will suffer segmentation fault.
- lmaophp 7y agoChange the fucking plate you muppet.
- muglug 7y agoThe same issue is seen on social networks that identify users by their usernames: - before it was suspended, twitter.com/null had just 2 tweets, but over 70K followers: http://archive.is/Dt6af http://archive.is/Dt6af.
- rafaelvasco 7y agoI don't know how being able to put any random word in the plate can even work. Always found it funny in movies and thought it was a joke.
- cryptonector 7y agoAh yes, we call him Bobby Nulls.
- dpcan 7y agoSimilarly I used to wonder how awful it would have been to own example.com ... until I found out it was an IANA special-use domain. But someone still owns test.com, and I can't imagine what that mail server goes through.
- pugworthy 7y agoNot unlike whoever gets all the email at foo@bar.com
- tbyehl 7y agoEarlier this summer I decided that I'd found a loophole and ordered 'N0 TAG' and 'N0NE' (zeros) for my motorcycles. The license plate font doesn't distinguish between 0 and O but the computers seem to account for visually similar characters -- I could not order the same plates with Os after they'd issued. Haven't caught anyone else's tickets so far. SunPass won't accept 'N0 TAG' being associated with my transponder tho (have not tried 'N0NE' yet). I did get pulled over on my very first ride with 'N0 TAG' and the first words out of the cop's mouth were 'Is that tag legit?' That may or may not have been a factor in catching a warning instead of a ticket that I absolutely earned.
- throwaway3627 7y agoLol. Third vehicle should have N0 L1C
- TomK32 7y agoP0L 1CE
- dfeojm-zlib 7y agoFUZZ 5 0
- datenwolf 7y ago> The license plate font doesn't distinguish between 0 and O When the German license plates were redesigned in the mid 1990-ies, also a different font was incorporated, which was engineered explicitly to thwart similar-shape attacks: https://en.wikipedia.org/wiki/FE-Schrift https://en.wikipedia.org/wiki/FE-Schrift
- TomMckenny 7y ago> He refused because he didn't do anything wrong. Cool the DMV fixed it. Just try that with so called "identity theft"
- ancarda 7y agoI never understand how these sorts of bugs happen - is the database something like: plate VARCHAR(8) NOT NULL DEFAULT "NULL" Or rather the type is actually Option<String>: plate VARCHAR(8) NULL DEFAULT NULL In which case, how is it the software can't tell the difference between Some("NULL") and None()? The only thing I can think of is the software (or it's database driver) handles everything in strings; so None() and Some("NULL") both get converted to "NULL"?
- mdorazio 7y agoBased on the description in the article, it's a separate system that is actually entering "NULL" in the license plate string field, probably for things like red light camera violations. Chances are it's a human doing this according to a procedure or the system is setup to require entry of some text in the field, so they have to enter something and opted for "NULL" if the actual plate is unreadable / unreliable / not present. This is unfortunately how a lot of things in the real world work, especially on legacy systems.
- ceejayoz 7y agoThere's a good chance it's some text file in CSV or fixed-width format being shipped around. JOHN,DOE,NULL,08-12-1983 JANE,DOE,FX9-80Z,01-23-1960
- zrobotics 7y ago"Droogie contacted the DMV who told him to change his plate. He refused because he didn't do anything wrong. While they wiped the fines off his record, unfortunately for him, they didn't fix the problem in the system so once again, Droogie has accrued another $6,000 in tickets" So wait, after he knew this was the outcome from using this plate he just decided 'nope, the DMV will definitely rectify this error'? Maybe he has a much higher tolerance for dealing with the DMV than I do, but surely there are far more productive ways to spend your time than constantly battling against invalid tickets. Additionally, I would be concerned about not being able to waive some of these tickets at some point and actually having to pay them,6k isn't exactly an insignificant amount and could also really impact insurance rates.
- Operyl 7y agoIf it got to that point, I’m sure some tech savvy lawyer would have fun with these cases.
- lucideer 7y agoIts a matter of principle though. Droogie hasn't done anything wrong, and is receiving fines due to errors made by the DMV. You're right that when faced with a choice between acting on principle vs acting pragmatically/for one's own benefit/convenience/need, people often don't have the luxury of (or patience for) choosing the former. But it's nice to see when someone does.
- hn_throwaway_99 7y agoTBH it's a very silly principle to fight for: "I DEMAND YOU HAVE NO BUGS!" And the DMV could just as well argue "Sorry, the bug is that we never should have accepted your NULL plate application in the first place, so we'll send you a non-vanity plate".
- sloum 7y agoI agree with the outcome of your premise to some degree. But he did do nothing against their stated policies regarding vanity plates. They issued him the palte. I am of the opinion that if they have a flaw in their code, it is on them to fix it, not the 'customer' to change their situation after the fact...
- throwaway3627 7y agoI like my new vanity license plate: DROP DATABASE;
- mkagenius 7y agoI bricked my profile page on Zomato, There is(was) a feature where you can choose a custom URL for your profile page, I chose something which already was a valid URL for them. Now when i click on "my profile", it goes to "https://www.zomato.com/genjs" https://www.zomato.com/genjs" . I can't edit anything in my profile now.
- logicallee 7y agoLet's talk about one specific thing from the article: >Things started to go awry when he first registered the tags. He tried typing in his license plate but the DMV website wouldn't accept it. Let's talk about the fact that the DMV website wouldn't accept it. Do you think this is all right behavior on the part of the DMV website? It's really interesting because if you're coding up the DMV web site, it makes sense to disallow NULL just as a preventative measure, like not allowing '-- in a query (to prevent SQL injection attacks.) I would generally think that on the whole you should accept -- as a substring in a password. But is it wrong programming if you don't allow that substring? Disallowing it could cause someone's chosen password to fail, so they have to change it for you to accept the password they want, but if you know for sure that you use sql as part of processing passwords you might well decide that it is acceptable to make people have to try a new password before you'll accept theirs, in case you are not confident that you are escaping everything correctly. So from my end it seems okay to do something like disallow NULL. If you consider the choice of the programmer on DMV's web site, what do you think about their choice to reject this input, even though in fact it turned out to be legitimate? Is it acceptable programming practice?
- dylz 7y agoI don't believe this is acceptable. By any modern sane best practice, the word NULL in a string from a web form (where your input is basically by definition a string) is a string like any other Blocking -- in a string does not prevent SQL injection attacks. Using proper parameterised queries does. This might sound mildly hostile but "you are not confident that you are escaping everything correctly" - when this is a well defined and solved problem - means you should not be building this application as you're too incompetent to. For the millions of taxpayer money wasted on this kind of thing, it is absurd. Blacklisting keywords used in XSS is also completely futile, pointless, useless, and does nothing but piss off users that can no longer use anything containing the word log or window or whatever.
- yummypaint 7y agoSounds like it worked. He can now accrue tickets without penalty.
- _bxg1 7y agoI recently bought a *.ninja domain name and started using it for my personal email address. Probably 20% of the time, when I try to sign up for a service it gets rejected by web forms that have been hardcoded to check for traditional top-level domains.
- repolfx 7y agoOh you think that's bad? My email address ends in that most exotic of domains, .net I find websites that won't accept it because they think it's an invalid address all the time. I have no idea what logic they're using, would love to find out.
- im3w1l 7y agoInteresting. I have a country topdomain email and never had problems.
- RickJWagner 7y agoHahahaha best thing I've read all day.
- lifeisstillgood 7y agoI presume this is already on thread but Irish police conducted a manhunt for serial traffic offender "Prawo Jazdy" - till they realised that was "Driving License" in Polish https://www.telegraph.co.uk/news/worldnews/europe/ireland/4732923/Prawo-Jazdy-Identity-of-Irelands-most-notorious-driver-uncovered.html https://www.telegraph.co.uk/news/worldnews/europe/ireland/47...
- deleted 7y ago[deleted]
- jacobush 7y agoI need to change my name to that
- lifeisstillgood 7y agoGuarenteeing you get chased for hundreds of other people's Traffic violation fines?
- mirimir 7y agoI rather think that it did work. Or, at least, if he continues being successful having tickets for "NULL" dropped. Because any tickets he actually gets will be to "NULL".
- codeisawesome 7y agoThat’s the closest way yet that I’ve seen Little Bobby Tables come to life :D
- senectus1 7y agoI've got AFK plates... makes it super easy to remember :-P A couple of cars in my city have plates like "0O00OO" or "BB88B8B" One guy that I've seen driving near my place has two cars both with variations of "11ll11l" Both the same make and model and color. I really dont think this will help him much.
- tathougies 7y agoIt would seem to me that issuing frivolous citations to a man who has not actually broken the law is a violation of the general prohibition against unreasonable fines and punishment.
- peter303 7y agoDo any states allow emojis on plates. I saw a red heart recently. ButI don't know if that was the license number or the background.
- 4ntonius8lock 7y agoReminds me of myself: when gmail came out I got my name@gmail The name is my 6 letter last name. I've received thousands of emails from random people. There are so many letter.name or number.name similar addresses that I'm constantly getting very personal emails of other people (deaths, marriages, invoices, business reports, etc)
- deleted 7y ago[deleted]
- gauravphoenix 7y agoI have named my phone "Null Pointer Excpetion" whenever I connect my phone to friend's Bluetooth they immediately scream- "oh look! null pointer excpetion!"
- foobarbecue 7y agoI once saw a parked BMW and the plates were the current day of the week and date. I am still scratching my head over that one.
- raviolo 7y agoI’ve seen several combinations of B’s and 8’s - like “8B88B8”. Wonder how effective they are at confusing plate readers.
- 2_listerine_pls 7y agoIt would be the same as having a single 8, but I guess it's not a problem or plate readers wouldn't be in use.
- droogie1xp 7y agoFor those interested, you can find the slides for the presentation here: https://media.defcon.org/DEF%20CON%2027/DEF%20CON%2027%20presentations/DEFCON-27-droogie-go-null-yourself.pdf https://media.defcon.org/DEF%20CON%2027/DEF%20CON%2027%20pre... This article is garbage and a lot of the discussion here revolves around the spin and emphasis on facetious scenarios I mentioned in the presentation
- patrioticaction 7y agoSo this guy doesn't have to pay parking tickets anymore right?
- urbanslug 7y agoThis wouldn't be a problem if people wrote programs in languages that have proper type systems that can correctly classify failure. I'm thinking of types such as Maybe/Option or Either. I hate it for example when a C/C++ function has to return a -1 in case of failure.
- conradfr 7y agoThe Wired article is better https://www.wired.com/story/null-license-plate-landed-one-hacker-ticket-hell/ https://www.wired.com/story/null-license-plate-landed-one-ha...
- dulvac 7y agoI have a friend who told me his story enrolling in his university. He's a German national who grew up in Spain. I'm going to call him Andres Schmidt, as the actual name is not relevant. In Spain, people normally have two surnames, one from the mother and one from the father (no, it doesn't exponentially grow with generations :D). He had issues enrolling in uni, as the system required two surnames so he ended up with "Andres Schmidt Schmidt". He had issues down the road as well, having to explain himself every time he needed to register for something. I think the student id was also a hash which included the name and he hadn't been consistent with his "full" name in all systems.