NULL license plate not such a bright idea • Hacker News Board

Re: NULL license plate not such a bright idea

#151

Post by the-dude » Mon, Aug 12, 2019, 5:41 PM UTC

Izkata wrote: post #137

jgtrosh wrote: post #56

Earlier quoted context omitted.

Maybe it could be added to the list of falsehoods programmers believe about names: https://shinesolutions.com/2018/01/08/falsehoods-programmers...

Now, was it a case of number 20 and they were required to enter something , or was it actually legally None? https://www.houseofnames.com/none-family-crest

Maybe the case. However, this was an international student org and the student was from Africa.

We assumed it was correct and did not dig to the bottom.

Whatever the truth was, I could close the ticket.

Re: NULL license plate not such a bright idea

#152

Post by stevekemp » Mon, Aug 12, 2019, 5:42 PM UTC

linker3000 wrote: post #132

A colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which they didn't realise. It was about a week before the router dropped its connection and needed to re-authenticate - and that's when I was called in to investigate the loss of connectivity - which Windows 10 very unhelpfully reported as the network cable disconnec…

So many home-routers are run with horrid CGI-scripts on the back-end - I'd not be amazed to learn that submitting a form-field with `blah` in it would try to run the command blah (probably via busybox).

If you have time/patience it might be worth exploring.

Re: NULL license plate not such a bright idea

#153

Post by hammock » Mon, Aug 12, 2019, 5:42 PM UTC

Could someone devise a SQL injection attack using a custom-made license plate? I'm imagining someone printing up

  x'; DROP TABLE drivers; --

on a plate, and driving up and down the highway past automated license-plate readers.

Re: NULL license plate not such a bright idea

#154

Post by [deleted] » Mon, Aug 12, 2019, 5:42 PM UTC

Grollicus wrote: post #102

jspash wrote: post #66

Earlier quoted context omitted.

The problem is it's a "a privately operated citation processing center" that's causing the problem. They might even be instructed to hand-enter a NULL for these cases. I'm don't really see an incentive for the govt agency to do anything about it. It's no skin off their nose. They'll just keep sending the tickets.

Don't you have some kind of illegal prosecution laws? In my home country people could go to jail for that.

[deleted]

Re: NULL license plate not such a bright idea

#155

Post by rtkwe » Mon, Aug 12, 2019, 5:42 PM UTC

josteink wrote: post #143

Confusing the value NULL for a non-null string-sequence which says “NULL” shows the clear sign of a system where no data can be assumed to hold any integrity. These bugs and categories of errors should simply not be possible in sane languages or frameworks.

That's not what's happening at all please reread.

> Apparently, when they didn't have the right data for a vehicle, a privately operated citation processing center used the word NULL in the license plate field for many tickets. Since that just happens to be Droogie's license plate, he got all of them.

So it's 'confusing' the string NULL used incorrectly (kind of, it's fine under the assumption that no one will have the license plate NULL but that assumption is wrong) with the string NULL.

Re: NULL license plate not such a bright idea

#156

Post by xxs » Mon, Aug 12, 2019, 5:43 PM UTC

jspash wrote: post #66

exfed wrote: post #42

Earlier quoted context omitted.

On top of that, if anything, forcing the government to fix it's bad code ( insert snarky ambiguity between software code and legal code ) can't be a bad thing. I'd buy the guy a beer.

The problem is it's a "a privately operated citation processing center" that's causing the problem. They might even be instructed to hand-enter a NULL for these cases. I'm don't really see an incentive for the govt agency to do anything about it. It's no skin off their nose. They'll just keep sending the tickets.

"hand-enter a NULL for these cases" <-- should be a reserved word then.

Re: NULL license plate not such a bright idea

#157

Post by vallismortis » Mon, Aug 12, 2019, 5:43 PM UTC

Actually, it was brilliant because it pointed out how flawed the system is, that it can be passively broken or circumvented. This could be used to invalidate all citations that were issued from agencies using that software.

Re: NULL license plate not such a bright idea

#158

Post by vageli » Mon, Aug 12, 2019, 5:43 PM UTC

CydeWeys wrote: post #115

indianSummer wrote: post #70

I own a rare collector car with a three-digit VIN. This has caused endless hassles at the DMV as well as the insurance office. Sometimes we find success by prepending the necessary number of zeros, before the VIN. Other instances in the same system require appending zeros after the VIN. The true VIN has a hyphen but that never makes it into the DMV's system. One time I got stuck in a particularly nasty loop where the…

What car is it?

It must be a car manufactured before VIN standardization in 1981, at the very least.

Re: NULL license plate not such a bright idea

#159

Post by growt » Mon, Aug 12, 2019, 5:44 PM UTC

hammock wrote: post #153

Could someone devise a SQL injection attack using a custom-made license plate? I'm imagining someone printing up x'; DROP TABLE drivers; -- on a plate, and driving up and down the highway past automated license-plate readers.

Ah little Bobby drivers ...

Re: NULL license plate not such a bright idea

#160

Post by dawnerd » Mon, Aug 12, 2019, 5:44 PM UTC

jedberg wrote: post #99

giancarlostoro wrote: post #50

Earlier quoted context omitted.

> Droogie contacted the DMV who told him to change his plate. He refused because he didn't do anything wrong. While they wiped the fines off his record, unfortunately for him, they didn't fix the problem in the system so once again, Droogie has accrued another $6,000 in tickets that he had nothing to do with. He says he won't be paying those either. Except he just contacted the DMV. No lawyers necessary.

Knowing the California DMV, that contact probably took at least two hours.

Number of years ago I was frustrated because they never sent me my renewed card and it turned out they never updated my address even though I did the paperwork. Took it to twitter and tagged @CA_DMV and they responded pretty quickly and took care of it. Got my new card pretty much next day.