121–130 of 484 posts
Earlier quoted context omitted.
Nah, because it's not unsanitized SQL at fault, but people writing a literal NULL in the license plate field when there isn't one.
I wonder, what will "DROP *;" license plate do?
"; DROP *;
This isn't even a coding error, NULL is apparently valid license plate, and for some reason there is a private processing center typing it in to the government system. First of all they are accidentally committing fraud (libel?) against this guy. But more importantly, why is there a private processing center? Don't the officers type this in as they fill out the ticket? or even just scan the plates? If there aren't pl…
It's not fraud or libel, it's an unavoidable problem with in-band signalling [1]. I assume the government entry system doesn't have an explicit way to set the data as missing, so they work around it like this. [1] https://en.wikipedia.org/wiki/In-band_signaling
I love when people double down out of principle, when the only person getting hurt is themselves. He refuses to change it because he did nothing wrong...sure, but you are also the only one being hurt by it. Is this really the hill to die on?
But it does actually work! He can never get any tickets. If he does he'll just claim it was a false one.
Earlier quoted context omitted.
Crappy code can be written in any language, see all of the CVEs in C code, even when written by experts. As surprising as it may be, bad code is often written by bad programmers. It doesn't matter what language you use if you write bad code.
But scripting languages make it especially easy to do so. That doesn't mean people who use them are bad programmers. They just chose a bad tool.
Alternatively, some amazing tooling has been written in these "terrible" scripting languages. Instagram was sold for a billion dollars and was a glorified Python Django webapp ontop of a Postgres database.
I got in a similar debate with a coworker recently over some go code he wrote. He told me that go code didn't need full unit tests because the compiler checked for bugs. Amusingly, he swapped the order of two int arguments in a pull request literally an hour after our discussion. I pointed out how a unit test would have prevented the production regression he caused, and then he started writing tests for his changes. So yet again, scripting languages have nothing to do with "good" or "bad" code. It is all about good vs bad developers.
Earlier quoted context omitted.
I doubt that. Normal people do not tend to use the word NULL at all. What this usually is is the result of systems that talk to systems that talk to systems that talk to systems, all in different legacy formats never written to be interchange formats. One system has true SQL NULLs, the next system down the chain only accepts strings for that field, NULL gets written as the most sensible string, and then from that poi…
Did you read the article? It literally says people at a private citation outfit put NULL in the license plate field when there is no number available.
I love when people double down out of principle, when the only person getting hurt is themselves. He refuses to change it because he did nothing wrong...sure, but you are also the only one being hurt by it. Is this really the hill to die on?
I recently saw a car with a license plate of B8B88BB8 (or something to that effect) that I am almost certain the owner chose to make it hard to read and transcribe correctly by either humans or computer vision systems. I was honestly kind of impressed.
- 1Iil
- B8
- 0Oo
Examples:
- i1lIil1I
- 8BBil8I1
I love when people double down out of principle, when the only person getting hurt is themselves. He refuses to change it because he did nothing wrong...sure, but you are also the only one being hurt by it. Is this really the hill to die on?
But it does actually work! He can never get any tickets. If he does he'll just claim it was a false one.
Seems to be a clever technique here too, ending the article with what seems like a non-ending, so the user will keep scrolling.
If I remembered where the original content was I’d post it, or had a desktop/laptop browser to search with right now, I’d post a link, but I don’t. I just remember having read a much better article about this in the past.