13 ms·
Can’t use iCloud with “true” as the last name
- arthurcolle 6y agoHow can a string of "true" be treated like the boolean value of true? Makes no sense
- adult_spinach 6y agoThis is probably not the cause, but XML allows using the string "true" and "false" to represent booleans. https://www.w3.org/TR/2004/REC-xmlschema-2-20041028/datatypes.html#boolean https://www.w3.org/TR/2004/REC-xmlschema-2-20041028/datatype...
- fbelzile 6y agoEspecially if it was written in a type safe language like Swift.
- jb1991 6y agoHighly unlikely that Swift is being used to write any backend iCloud services at this point.
- userbinator 6y agoMy guess is there is something "stringly typed" somewhere in the system. A sibling comment mentions Swift, but I doubt all components of iCloud are written in it.
- valleyer 6y agoSwift has "stringly-typed" enumerations (enumerations with backing "raw values" of string type), but it does not treat the enumerations as equal to the strings. Explicit conversion is required. https://docs.swift.org/swift-book/LanguageGuide/Enumerations.html https://docs.swift.org/swift-book/LanguageGuide/Enumerations... 1> let _: Bool = "true" error: repl.swift:1:15: error: cannot convert value of type 'String' to specified type 'Bool' let _: Bool = "true" ^~~~~~
- jjnoakes 6y agoI don't think I'd consider it stringly-typed then. To me, stringly-typed means the type system treats strings and non-strings as convertible to each other implicitly. Strings backing enums seems more like an implementation detail and not a type system feature.
- valleyer 6y agoI see what you're saying, but it's not 100% an implementation detail. The raw values are accessible through the `rawValue` property, which can be useful for serialization, for example. (That could of course be abused to create bugs like the one here.) The reason I say Swift "has" stringly-typed enums is that Objective-C has them (typedefs of NSString where the values are actually strings, and are of course implicitly convertible), and Swift imports them as enums with string-typed raw values. Anyway, I mostly just meant to suggest that this particular iCloud bug is probably not Swift-related.
- dangwu 6y agoI'm pretty sure Apple uses Java for their backend services
- comex 6y agoGoogling the beginning of the error message, "Type error: cannot set value", suggests it's coming from JavaScript code.
- ulucs 6y agoJs doesn't really care about types, and doesn't seem to convert a string "true" into a boolean true: > temp0.innerHTML = true // no error > "true" == true false > true == "true" false
- Izkata 6y agoThe javascript matches are "TypeError" not "Type error", and the more important part of those are "...of null" or "...of undefined". They refer to this: var foo = null; foo.lastName = "anything"; // TypeError, cannot set property "lastName" of null
- rachelbythebay 6y agoHave you seen what happens with YAML when you try to do something like country: xx ... and get to Norway?
- lstamour 6y agoHuh. TIL, thanks! https://yaml.org/type/bool.html https://yaml.org/type/bool.html
- junon 6y agoCongratulations, this is the first actual argument I've seen that has actually made me seriously consider never using YAML again.
- 411111111111111 6y agoThe only thing this should tell you is that unquoted string literals are dangerous in yml.
- kyberias 6y agoAnd because they are dangerous in yaml, the format in itself is dangerous to use. That's why any sane person should seriously consider whether using the format makes sense.
- throwawayboise 6y agoI didn't like YAML from day 1, for this and many other reasons. I never understood why it caught fire like it did.
- pindab0ter 6y agoTOML seems to be catching steam. Would you say that’sa better alternative?
- 6y ago
- sbr464 6y agoI agree. I’ve also noticed the string “[]” breaks random things recently, graphql input values etc (but not a common name thankfully).
- bombcar 6y agoThis becomes amazingly annoying when you’re trying to deal with IPv6 addresses.
- throwawayboise 6y agoEval is evil like that.
- pindab0ter 6y agoWelcome to the wondrous world of dynamically typed languages like PHP and Ruby that are common in backend development. True as you know it can by any of true, “true”, 1, “1”, >0 and most likely more.
- berkes 6y agoNot Ruby, but Rails. And there, it is handled by a clear and dedicated layer: ActiveModel::Type::Boolean.new.cast(value) The only thing you can complain about is that Rails loves implicit magic, which will call this layer for you. Without you needing to set it up, or call it yourself. Many people love this about Rails. (I prefer explicitness over magic.)
- rorykoehler 6y agoOnce you learn rails well enough it all becomes explicit because you can simply read the source code.
- berkes 6y agoExplicit, for me, means that I determine in the model the `published_at` is a DateTime. Not merely in the DB, and never magically derived from the name (_at=datetime, _on=date). But explicitely defined. E.g. `attribute(:published_at, DateTime, default: ->{DateTime.now})` Rails does not do this entirely "magic", though: it derives it from the database. And true: you can follow the logic along: the magic can be researched easily. But still: I really prefer a system in which I write all that boilerplace (my IDE/vim can do this for me really well) instead of relying on convention, heuristics and magic.
- Izkata 6y agoAll inputs in PHP start as strings because you can't tell for certain if a form input was supposed to be 1 or "1", so the language opts to not convert until you trigger it somehow. Combined with PDO for parametrized database queries, if this is PHP this error still should not happen.
- 6y ago
- emsy 6y agoThat’s one of the most common types of errors, it’s literally the number one risk factor according to OWASP: https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/
- trav4225 6y agoWelcome to the wonderful world of implicit/dynamic typing. ;-)
- appwiz 6y agoAlso https://news.ycombinator.com/item?id=26364569 https://news.ycombinator.com/item?id=26364569
- Gibbon1 6y agoI'm going to change my last name to FileNotFound.
- kirktrue 6y agoI haven’t had an issue with iCloud and use it everyday. I wonder if it’s specific to a certain product or workflow. But I’ve used other services (Facebook, for example) that interpret my last name as a boolean and throw errors.
- mplanchard 6y agoThe tweet author seems to suggest it only causes issues if lowercase
- deleted 6y ago[deleted]
- blinkingled 6y agoYou're holding the wrong last name. I will show myself out.
- chrisweekly 6y agoObligatory xkcd: https://xkcd.com/327/ https://xkcd.com/327/
- kwhitefoot 6y agoIt's about time that Randall Munroe (or someone else) made a new injection attack strip. Little Bobby Tables is getting a bit repetitive.
- vntok 6y agoMaybe this is a symptom of the world we live in?
- jmchuster 6y agoThere was a PM i worked with that had the last name "Null". Every few months, she'd be deleted out of the HR system.
- junon 6y agoNot for technical reasons, someone I knew had the last name Nieffenegger (pronounced "NEF-en-jur") and got banned from Playstation as well as a few other services quite frequently.
- mc32 6y agoThat looks more like /neef en ekah/ where does the /dzhur/ come from?
- userbinator 6y agoSchwarzenegger would probably fare no better at the Scunthorpe problem.
- fortran77 6y agoThis could be serious. If strings in some cases are interpreted as keywords, there may be a way to get an SQL injection into iCloud.
- xyst 6y ago bois - just run your application through the BLNS list and you would have caught this at the 9th entry: https://github.com/minimaxir/big-list-of-naughty-strings/blob/894882e7d1f3f2383aa472fdce4a80b8cd256df4/blns.json#L10 https://github.com/minimaxir/big-list-of-naughty-strings/blo...
- dang 6y ago> bois Please don't do that here. The rest of your comment is just fine.
- kwhitefoot 6y agoI'm curious: what is it that he has done? What does the odd glyph mean?
- dang 6y agoVisual gimmicks like "" (an apple character to designate Apple) are not in keeping with the text-based nature of this site, and "bois" is presumably short for "fanboys" which is flamebaity. These are markers of low-quality discussion which is a different band of the spectrum from what we want on HN.
- alfu 6y agoIt shows the apple logo on some fonts. See: https://codepoints.net/U+F8FF?lang=en https://codepoints.net/U+F8FF?lang=en
- Findeton 6y agoDamn dang you're omniscient.
- chewxy 6y agoA constant reminder that code is data but data is not code.
- robbywashere_ 6y agoMy money is on a poorly implemented json parser. Especially by the wording in the error message
- nelox 6y agoI suppose Not True wouldn’t work either?
- minikomi 6y agoThere was a bug (maybe still is) in airbnb where setting your name to include a certain character would brick your login to the web app because it broke header parsing. Reported it but was deemed 'non critical'.. Edit, just looked up the mail - It was an 'equals' sign - the reply was: " It sounds like you cannot cause someone else's account to be in this state, only your own account. Is this correct? How would you get someone else to change their account name so that it includes an equals sign? It appears that there's no way to cause another user's account to get into this state, and in this case, I do not see a security implication here. "
- avree 6y agoThat does indeed sound non-critical, how many names do you run into with equal signs in them?
- imgabe 6y agoLittle Bobby Tables’ cousin, Jenny =true
- mpol 6y agoThe name is just a string, right? If some character in the string is causing havoc, maybe there is something funky going on. This is just one symptom coming up at the surface. It might require a bit of extra investigation to see what is really the underlying problem and if that might cause more and different symptoms elsewhere.
- hannob 6y agoThis is a key issue I see with bugbounty programs. They tend to react with "either you can show us that this is a real danger or we'll ignore it". It seems pretty clear that this bug shows something is terribly wrong and probably dangerous. But the reporter might have limits in analyzing the bug, while the company could easily figure out what's going on and fix it.
- 6y ago
- barbarbar 6y agoSo I have at least read one true story today. It reminded me of the guy who had null as last name.
- Camillo 6y agoI'm curious: if Apple decides not to fix this bug, does Ms. True have any recourse? It seems that in America businesses have the right to refuse service at their pleasure, except for specific forms of discrimination which are explicitly banned. Could Apple, legally, decide that fixing the bug would cost more than they expect to make from her as a customers, and simply reject her business?
- ghaff 6y agoHardly unique to the US. Not sure why they couldn't. It's not discriminating based on a protected class. They would need to stop billing her and refund any moneys for services not delivered. In practice, I assume there is some way to change a name on an account--although I'm told this is often harder than is seems it would be even within a company.
- Camillo 6y agoIn some countries, the rule is that if you make a public offer (e.g. advertise a price for a product or service), then you must accept all customers. I have no idea how common each system is, though.
- Tea418 6y agoSince I’m using a password manager, I’m generating >24 digit passwords, because I’ll never have to type them. You would be surprised how many websites cut everything after 24/32 digits during registration without notice, but suddenly allow more digits in the login form, leading to login issues.
- sircastor 6y agoThere have been more times than I care to count that I’ve needed to type my 32+ Long character password. Is unusual, but not never.
- danmur 6y agoUsing a tv remote is the worst
- nonameiguess 6y agoBig props here to Amazon Prime Video for allowing you to open an Amazon app you've already logged into on a device with a camera and scan a QR code on your television to log in, rather than requiring you to type a password using arrow keys to select from a virtual keyboard.
- blauditore 6y agoIt's even worse with Apple TV, where you have to swipe between characters on a single row. They completely butchered UX on that one, it's infuriating.
- amelius 6y agoWhy do you even have to use your real name on these services? A single "name" field would be so much friendlier for those who want to use a nickname.
- Meph504 6y agoI always baffles me when I encounter a service that uses a different validator for sign up than sign in. Firstly, why write this twice. Secondly, it can cause so many headaches. the one I run into a lot is a + in an email address. I like to use them on sites I think will likely sell my email address so I'll do something like "my.normal.email+websitename@gmail.com" I rarely have trouble signing up with this email address, nor verifying it, but then you go to login and splat. but not properly escaping the lastname of "true" just seems way to basic for a service as large as icloud.
- jakub_g 6y agoThe "+ is not valid character in email" is damn annoying indeed. Too many websites do this dumb "validation". Re: validating login/signup, I never had an issue immediately. However in practice it happens often when there's one validator but it changes over time during a big rewrite. So you sign up, all works, rewrite lands, can't log in anymore.
- Meph504 6y agoI've had it happen immediately a lot. Ubisoft and jimmyjohns both had issues with it. I love when people argue that it isn't valid even after you contact support. Generally a sign I don't want to do business with them.
- chadlavi 6y agoI think some companies might do this because they know they can't sell that email address as easily
- zaik 6y agoOr they could just strip of the part after the "+", especially with gmail addresses.
- trav4225 6y agoYeah, I run into validation issues all the time with hyphens in domain names... :-P
- sangeeth96 6y agoJust wondering, is there a source listing good practices when it comes to implementing how one should sanitize real-world, subjective fields like human names, gender, race etc.? And other gotchas while implementing similar things?
- bombcar 6y agohttps://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-... Long story short use a text field that takes UTF-8.
- shakna 6y ago> sanitize real-world, subjective fields like human names, gender, race etc.? The simple answer is _not to_. Use something you can stuff a bunch of arbitrary bytes into, that will fit the byte encoding that the system is currently using. Don't sanitise it. Have no expectations about what it can contain. Have a length, have some bytes, and don't ever dare to try and look inside it.
- hamilyon2 6y agoDepends on what kind of software do you write. When dealing with anything near banking and human life and anything regulated really, I strongly suggest heavily sanitizing all of inputs. No control characters, no invalid utf-8, no weird whitespace and white list characters you want to allow. Actual list is domain-specific, of course. Limiting input field to reasonable 20 characters will help defence in depth too.
- shakna 6y agoAnd that's how you end up with a bank unable to handle the existence of certain people because their legal names exceed character limits, contain unexpected characters, or surprise the programmer in other ways. The legal name must be an exact representation, and appear identically. Sanitising it will break things.
- ufmace 6y ago
- cannabis_sam 6y agoNothing as critical (the negative effects were mostly on my company’s side), but I have created problems for a lot of O’Briens, O’Tooles and other people with similar names. I am a lot more humble about handling people’s names when writing systems these days...
- soneil 6y agoHah, welcome to my life. Many, many moons ago, my employer generated an email address for me, first.o'last@example.com. This is technically valid, but yes, problems everywhere. I put in a ticket asking if I could change it, or at least alias it to first.olast@, for obvious reasons. They never replied. Over the years, I put in a few more tickets for this. Nada. Over a decade later, they got in touch and asked if they could change my email address. Turns out they never received my pleas. Turns out our ticket system was one of the systems I had issues with.
- dorianmariefr 6y agoMy last name is Marié and I smile every time I see write MARIE without the accent, maybe one day it will be a thing of the past and people will stop thinking I'm a girl named Marie
- ChrisArchitect 6y ago[dupe] further discussion here: https://news.ycombinator.com/item?id=26364569 https://news.ycombinator.com/item?id=26364569