Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We have an employee whose last name is Null. He kills our employee lookup (2012)

stackoverflow.com

Post reply on HN
Print view View original

221–230 of 245 posts

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#221

Post by jasonkolb »

tracker1 wrote: post #74
patio11 wrote: post #53

A Japanese company once made the decision that they needed "virtual" employees in a particular system, for example to support e.g. adding a job to the org chart before that position had been filled (and another dozen use cases), so they had the clever idea "Hey, if we need to do this, we'll just input their 'name in Japanese' as one of a dozen status flags, like XX_JOB_REQUEST or XX_INCOMING_TRANSFER." One developer…

I worked in a security software development department where the primary security request application had to allow a request from anyone, for anyone (Approval was more stringent). I personally found several bugs in the system in my first few months, because I, personally, conflicted with the various "uniqueness" constraints in the system... like lastname + ssn-last-four, or dob + firstname, etc. The org had 380K acti…

Your DOB and last 4-5 of your SSN matched someone else?

The reason I ask is because rules like this are often used to de-duplicate records. It's not perfect but it is useful, especially when trying to integrate data from more than one system. It's also used quite a bit in fraud detection etc. to find connections in the data.

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#222

Post by jameshart »

neilk wrote: post #176
jerf wrote: post #169

Earlier quoted context omitted.

No. That completely doesn't work. This is really important: You CAN'T "sanitize" for every possible use. You can not correctly figure out in advance how to represent an input, because the different possibilities are numerous and actively self-contradictory. To "sanitize" for "every possible use" is pretty much to remove everything that isn't an ASCII letter. Even unexpected spaces can cause crazy behavior. Commas can…

Perhaps I was unclear, but I did not claim that there could be one single sanitized version of the data, safe for all use cases. I was saying that you have to do different sanitization for every output.

That's not called 'sanitizing', it's called 'escaping' and 'encoding'.

The byte sequence I need to store to communicate the name "Kei$ha O'Shaughnessey, Jr." in a UTF-8 JSON string literal, a UTF-8 HTML attribute, a UTF-16 bigendian CSV file, or an ISO-8859 SQL parameter, are going to be different - but so long as all the characters I need to pass are representable in all of those domains all I have to do is perform the correct escaping and encoding. At no point do I need to 'sanitize' the name. It's a name, it's not dirty.

If there are characters there that I can't represent in the target domain, then I need to handle the loss of information.

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#223

Post by IanChiles »

jameshart wrote: post #152
jerf wrote: post #77

Earlier quoted context omitted.

"Just make sure it's valid UTF-8 (or whatever encoding you're using) and escape it when you display it." I've lately been coming around to the belief that anyone who uses the term "sanitize" in this domain, as in, "sanitize user input" really doesn't know what they are talking about (at least on average). The approach you describe is the generally correct approach; you need to ensure that the proper levels of escapin…

It's a shame there's such a proximity in terminology between 'sanitize' and 'sanity check'. I wonder if that's where this whole confusion began in the first place. Yes, it is extremely unlikely that a user's given name contains a tag, but there are few reasons why your sofware should really care about it on a technical level - least of all if the way you choose to care about it leads to it also complaining when someo…

Relevant XKCD - http://xkcd.com/327/

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#224

Post by Mvandenbergh »

Piskvorrr wrote: post #217
Mvandenbergh wrote: post #214

Earlier quoted context omitted.

You don't need to explicitly support them if you just treat "name" as a freeform, unicode text field.

Well, you can still get bitten by "11. People’s names are all mapped in Unicode code points," as well as the sets 1-8 and 32-36 (people have exactly X names at a given point in time, where X>0); that's not to mention ordering and collation (12,13,18,30). But it's definitely the easiest option, and avoids many common pitfalls (if I had a nickel for every database using latin1 + latin1_swedish_ci because that's the fir…

I can see 11, but as long as you're not using the name as a unique key but just as a label then the mutability, non singularity, and non-orderedness aren't such problems.

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#225

Post by tracker1 »

jasonkolb wrote: post #221
tracker1 wrote: post #74

Earlier quoted context omitted.

I worked in a security software development department where the primary security request application had to allow a request from anyone, for anyone (Approval was more stringent). I personally found several bugs in the system in my first few months, because I, personally, conflicted with the various "uniqueness" constraints in the system... like lastname + ssn-last-four, or dob + firstname, etc. The org had 380K acti…

Your DOB and last 4-5 of your SSN matched someone else? The reason I ask is because rules like this are often used to de-duplicate records. It's not perfect but it is useful, especially when trying to integrate data from more than one system. It's also used quite a bit in fraud detection etc. to find connections in the data.

There were about 380K users in the various systems... so conflict chances were pretty high... I can't imagine what it would be like to have a name like "John Smith" or "Adam Jones" ... even more common...

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#226

Post by R_Edward »

L_Rahman wrote: post #187
R_Edward wrote: post #107

Earlier quoted context omitted.

Growing up, my parents called me by my middle name, as I share a first name with my dad. (I'd rather be an Edward than a Ralph anyway.) When giving my name to someone, I tell them I'm Edward , as telling them I'm R. Edward just sounds pretentious. But if I'm beginning a relationship with a doctor's office or lawyer, or filling in a tax form, it's Ralph E. Lastname, because that's what's on my birth certificate and SS…

It's an annoying thing to have to deal with on a regular basis. I'm in the same boat, in that my father and I both have the same first and last names, so I've always gone by my middle name. Except now when I go to networking events or interviews, I tell people my middle name L * and then they point that out that my name tag or application says my first name is M * and I have to go through the whole song and dance of…

I've thought about it, but as soon as I do, I think about all the paperwork inevitably involved in making sure my medical history follows me, my pensions and other financial records get updated, and all that other nonsense, and, having nearly half a century of paperwork that ought to be updated, and being an essentially lazy old cuss, I decide that I can live with the annoyance.

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#227

Post by Semiapies »

Piskvorrr wrote: post #209
im3w1l wrote: post #141

Earlier quoted context omitted.

This list is useless, because trying to follow it is impossibly ambitious. Which of these do I need to support for my system to work for X% of users with X+Y % being able to work around the limitations?

Logical fallacy (bifurcation): either you correctly implement all of the requirements, or it makes no sense trying at all. Note that the article even explicitly says "try to make _fewer_ of these assumptions," not "you MUST explicitly support all this." Similar example: Do you lock your door, or does that make no sense to you? (Because if there's no absolute, perfect, 100% protection, there's apparently no difference…

Logical fallacy (non sequitur), as the comment you're responding to said nothing of the kind, and argued specifically for a middle point in the second of only two sentences.

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#228

Post by Dove »

jasonkolb wrote: post #221
tracker1 wrote: post #74

Earlier quoted context omitted.

I worked in a security software development department where the primary security request application had to allow a request from anyone, for anyone (Approval was more stringent). I personally found several bugs in the system in my first few months, because I, personally, conflicted with the various "uniqueness" constraints in the system... like lastname + ssn-last-four, or dob + firstname, etc. The org had 380K acti…

Your DOB and last 4-5 of your SSN matched someone else? The reason I ask is because rules like this are often used to de-duplicate records. It's not perfect but it is useful, especially when trying to integrate data from more than one system. It's also used quite a bit in fraud detection etc. to find connections in the data.

Well, there are 366 dates of birth, and 9999 last 4 digits in SSNs, so approximately 3.7M combinations.

If you drop 380k users into 3.7M buckets, that's only ten times as many buckets as users. A lot of the buckets will be shared.

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#229

Post by Dove »

Steko wrote: post #171
dublinben wrote: post #165

Earlier quoted context omitted.

When your father dies, and you've named your son Norman John Harman as well, don't you become senior? It's can't be an immutable part of your name if your junior/senior status changes.

He'd become NJH II.

Yup. I have a cousin whose initials are RLC3.

Re: We have an employee whose last name is Null. He kills our employee lookup (2012)

#230

Post by kstrauser »

L_Rahman wrote: post #187
R_Edward wrote: post #107

Earlier quoted context omitted.

Growing up, my parents called me by my middle name, as I share a first name with my dad. (I'd rather be an Edward than a Ralph anyway.) When giving my name to someone, I tell them I'm Edward , as telling them I'm R. Edward just sounds pretentious. But if I'm beginning a relationship with a doctor's office or lawyer, or filling in a tax form, it's Ralph E. Lastname, because that's what's on my birth certificate and SS…

It's an annoying thing to have to deal with on a regular basis. I'm in the same boat, in that my father and I both have the same first and last names, so I've always gone by my middle name. Except now when I go to networking events or interviews, I tell people my middle name L * and then they point that out that my name tag or application says my first name is M * and I have to go through the whole song and dance of…

Same here. I get around this by never mentioning my first name unless I'm in a situation where it's legally required, like at a doctor's office or the DMV. That groups down to a small number of cases:

1. If they're working for me, like at the doctor's office, I ask them to please call me by my middle name. They're generally respectful about it and are used to dealing with nicknames and other aliases anyway.

2. In the DMV and other situations, I just grit my teeth and answer by my first name. It's not worth the hassle of explaining and they don't care anyway.

3. If I'm being hired, I fill out my paperwork "officially" and give it to HR, with the explanation that I go by my middle name for all legal purposes.

4. Banks are kind of weird because they perform official government functions, but they're still ultimately working for me. I've only had one bank flat-out refuse to put my middle name on my debit card and checks, and I explained to the branch manager why I was walking out the door before we'd finished opening my account.

Post reply on HN