Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NULL license plate not such a bright idea

knrs.iheart.com

Post reply on HN
Print view View original

341–350 of 484 posts

Re: NULL license plate not such a bright idea

#341

Post by lucideer »

hn_throwaway_99 wrote: post #273
lucideer wrote: post #261

Earlier quoted context omitted.

Its a matter of principle though. Droogie hasn't done anything wrong, and is receiving fines due to errors made by the DMV. You're right that when faced with a choice between acting on principle vs acting pragmatically/for one's own benefit/convenience/need, people often don't have the luxury of (or patience for) choosing the former. But it's nice to see when someone does.

TBH it's a very silly principle to fight for: "I DEMAND YOU HAVE NO BUGS!" And the DMV could just as well argue "Sorry, the bug is that we never should have accepted your NULL plate application in the first place, so we'll send you a non-vanity plate".

He's not demanding they have no bugs, he's merely refusing to provide a workaround for their bugs at his own expense and inconvenience (sure refusing to may actually involve other greater expense and inconvenience but that's beside the point).

The suggestion in the latter half of your comment is notable in that that's not what they said or offered. They don't even seem to have offered any recompense, which could at least be seen as a reasonable middleground (though still a compromise for Droogie who is denied his vanity plate post facto)

Re: NULL license plate not such a bright idea

#342

Post by lucideer »

ajross wrote: post #275
lucideer wrote: post #261

Earlier quoted context omitted.

Its a matter of principle though. Droogie hasn't done anything wrong, and is receiving fines due to errors made by the DMV. You're right that when faced with a choice between acting on principle vs acting pragmatically/for one's own benefit/convenience/need, people often don't have the luxury of (or patience for) choosing the former. But it's nice to see when someone does.

> Droogie hasn't done anything wrong That's arguable, actually. The article states, but doesn't provide evidence, that Droogie "hoped it might confuse automatic license plate readers or the DMV's ticketing system". If this was done in an attempt to evade enforcement of existing laws, then sorry: that's a crime, folks. You aren't allowed to pen test live systems!

Fair, it could be argued. As you said in a deeper comment though, it would take an enterprising prosecutor (though they're hardly scarce) .

Within reason though, he hasn't technically done anything to warrant tickets.

Re: NULL license plate not such a bright idea

#343

Post by monocasa »

mehrdadn wrote: post #337
monocasa wrote: post #221

Earlier quoted context omitted.

That's absolutely how bits of entropy work.

That's most definitely not how security works. The strength of your password is not proportional to the number of bits of entropy it has.

In the context of randomly generated passwords, it's absolutely ok to think about it in terms of the logarithmic relationship between 1) entropy per symbol times number of symbols and 2) strength of the password.

He said 10% stronger (which I took to mean 10% more entropy), not 10% more time to crack.

Re: NULL license plate not such a bright idea

#344

Post by monocasa »

robocat wrote: post #260
monocasa wrote: post #221

Earlier quoted context omitted.

That's absolutely how bits of entropy work.

However symbol frequency is also significant for entropy. Do you think 1 in 25 four letter passwords contain a backtick? If you were brute forcing an ASCII password (no whitespace), would you naively cycle from ! up to ~ for each character?

The context is randomly generated passwords, so dictionary attacks (or other attacks that look at the plaintext from a Huffman encoding perspective) aren't really relevant.

Re: NULL license plate not such a bright idea

#345

Post by dylz »

logicallee wrote: post #293

Let's talk about one specific thing from the article: >Things started to go awry when he first registered the tags. He tried typing in his license plate but the DMV website wouldn't accept it. Let's talk about the fact that the DMV website wouldn't accept it. Do you think this is all right behavior on the part of the DMV website? It's really interesting because if you're coding up the DMV web site, it makes sense to…

I don't believe this is acceptable. By any modern sane best practice, the word NULL in a string from a web form (where your input is basically by definition a string) is a string like any other

Blocking -- in a string does not prevent SQL injection attacks. Using proper parameterised queries does. This might sound mildly hostile but "you are not confident that you are escaping everything correctly" - when this is a well defined and solved problem - means you should not be building this application as you're too incompetent to. For the millions of taxpayer money wasted on this kind of thing, it is absurd.

Blacklisting keywords used in XSS is also completely futile, pointless, useless, and does nothing but piss off users that can no longer use anything containing the word log or window or whatever.

Re: NULL license plate not such a bright idea

#346

Post by FabHK »

gruez wrote: post #312
heeen2 wrote: post #297

Earlier quoted context omitted.

Due to missing or repeated characters from the set of the hex alphabet?

which doesn't make sense. I randomly generated an 8 character alphabetical (all lower case) password "jraxxhwr". According to keepass it has 32 bits of entropy, but the entropy should be 26^8 = 37.6 bits because the search space is all 8 character letter permutations. There's no way you can reduce the search space from 37.6 bits to 32 bits unless you have an oracle that says which characters I used.

It does make sense, because the keepass entropy estimate presumably (like the excellent zxcvbn) tries to approximate the empirical distribution, not the theoretical uniform one.

In theory, "68703649" and "12345678" are equally likely to be pulled from the hat, but in practice one is a much better password than the other. You can reduce the search space by trying the passwords with higher (empirical) probability first.

Re: NULL license plate not such a bright idea

#347

Post by retzkek »

rtkwe wrote: post #145
harryh wrote: post #119

I recently saw a car with a license plate of B8B88BB8 (or something to that effect) that I am almost certain the owner chose to make it hard to read and transcribe correctly by either humans or computer vision systems. I was honestly kind of impressed.

I'm surprised more places don't do what Nintendo did with course ids in Super Mario Maker 2. They intentionally removed some characters that are visually similar to avoid confusion when writing out codes.

base32? "an alphabet of A–Z, followed by 2–7. 0 and 1 are skipped due to their similarity with the letters O and I (thus "2" actually has a decimal value of 26)." https://en.wikipedia.org/wiki/Base32

Re: NULL license plate not such a bright idea

#348

Post by petee »

distances wrote: post #248
djsumdog wrote: post #186

Earlier quoted context omitted.

I knew a kid in college who would get a ticket, and then look around the parking lot for another Black Nissan Maxima. Most people don't actually look at the plate number, just the make model. I think he got one ticket paid this way ... guy was kinda an asshole.

I've had a friend do the reverse: parking in illegal spot, and borrowing a ticket from another car that already received one. Upon return some hours later, he returned the ticket to the correct windshield. Quite brazen, and frankly a bit of an asshole thing to do.

Around my area they almost always open existing tickets to check for the time/date. In addition many parking enforcement people patrol the same area all day and remember whether or not they already ticketed that vehicle.

Re: NULL license plate not such a bright idea

#349

Post by perl4ever »

lolc wrote: post #317
shawnz wrote: post #232

Earlier quoted context omitted.

Those would be the options if there was an attack against him, but there's not any attack against him. Wrongly addressed tickets are hardly even a minor inconvenience. I think that's what the parent is saying.

> Wrongly addressed tickets are hardly even a minor inconvenience. Now I wonder what you would consider a minor inconvenience. "Oh yeah that time they suspended my licence that was a minor inconvenience for me." Wrongly addressed tickets are a real hassle. I'd assume that if you don't contest them in time, you have to pay them. And if you don't pay them, they will suspend your licence. (I don't really know. But I ass…

You can be arrested for driving on a suspended license, and it can be either a misdemeanor or a felony.

Re: NULL license plate not such a bright idea

#350

Post by perl4ever »

crumpets wrote: post #300
jerf wrote: post #113

Earlier quoted context omitted.

And I still expect my story is more accurate, with theirs being a reasonable expectation of what you'd get when some techie tells their manager what happened, who tells their manager, who tells the reporter. To be clear, I'm not denying that what you say is literally true, just that by the time I'm done filtering that particular fact through my personal belief network and personal experiences, I still end up saying t…

People use the word NULL and in all caps as well, in particular in bureaucratic processes like those you would encounter at the DMV. NULL & VOID, etc. It is entirely reasonable that the system would not accept an empty string for the plate so the process folks worked around that by instructing all employees to write NULL if they couldn't read the plate.

Many people who are not programmers per se come into contact with databases that use SQL enough that they might absorb a few random concepts or names for things.

So, some bureaucrat might in fact know "NULL" because they type a command into a database every Tuesday to run a report.

Post reply on HN