NULL license plate not such a bright idea • Hacker News Board

Re: NULL license plate not such a bright idea

#241

Post by mikehollinger » Mon, Aug 12, 2019, 7:05 PM UTC

dhosek wrote: post #24

sparrish wrote: post #4

This is funny. I wonder what would happen if you could put a 'NOT ' in front of your plate number... would everyone but you get a ticket?

Nah, because it's not unsanitized SQL at fault, but people writing a literal NULL in the license plate field when there isn't one.

A colleague’s name is “True.” When we ran some reports to generate a check in list for an event - it was converted to either “TRUE” or “1” depending on the script.

I was amused.

Even without sql doing odd things certain strings will just cause problems.

Re: NULL license plate not such a bright idea

#242

Post by kevinmchugh » Mon, Aug 12, 2019, 7:11 PM UTC

gruez wrote: post #184

linker3000 wrote: post #132

A colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which they didn't realise. It was about a week before the router dropped its connection and needed to re-authenticate - and that's when I was called in to investigate the loss of connectivity - which Windows 10 very unhelpfully reported as the network cable disconnec…

>Avoid backticks in passwords. Is there even a reason to include special characters in passwords? They add 10% more security[1] but cause all sorts of issues with systems. Just use an alphanumeric password that's 10% longer, and if special characters are mandatory, use a safe character at the end like _ or -. [1] 6.55 bits per character (all printable ascii characters) rather than 5.95 (only alphanumeric)

Special characters in passwords were highly recommended when rainbow tables were an effective way to attack password hashes. See this old Coding Horror blogpost for an idea what it was like at the time: https://blog.codinghorror.com/rainbow-hash-cracking/

Salted hashes have made rainbow tables less effective. Password managers have made single-use passwords more tenable.

Not knowing how a system will store my password, I still prefer to include special characters where available. Anecdotally, I tend to see the systems that are most averse to special characters are also strict about character limits, so simply increasing password length is not possible.

Re: NULL license plate not such a bright idea

#243

Post by mdorazio » Mon, Aug 12, 2019, 7:11 PM UTC

ancarda wrote: post #235

I never understand how these sorts of bugs happen - is the database something like: plate VARCHAR(8) NOT NULL DEFAULT "NULL" Or rather the type is actually Option : plate VARCHAR(8) NULL DEFAULT NULL In which case, how is it the software can't tell the difference between Some("NULL") and None()? The only thing I can think of is the software (or it's database driver) handles everything in strings; so None() and Some("…

Based on the description in the article, it's a separate system that is actually entering "NULL" in the license plate string field, probably for things like red light camera violations. Chances are it's a human doing this according to a procedure or the system is setup to require entry of some text in the field, so they have to enter something and opted for "NULL" if the actual plate is unreadable / unreliable / not present. This is unfortunately how a lot of things in the real world work, especially on legacy systems.

Re: NULL license plate not such a bright idea

#244

Post by ceejayoz » Mon, Aug 12, 2019, 7:14 PM UTC

ancarda wrote: post #235

I never understand how these sorts of bugs happen - is the database something like: plate VARCHAR(8) NOT NULL DEFAULT "NULL" Or rather the type is actually Option : plate VARCHAR(8) NULL DEFAULT NULL In which case, how is it the software can't tell the difference between Some("NULL") and None()? The only thing I can think of is the software (or it's database driver) handles everything in strings; so None() and Some("…

There's a good chance it's some text file in CSV or fixed-width format being shipped around.

  JOHN,DOE,NULL,08-12-1983
  JANE,DOE,FX9-80Z,01-23-1960

Re: NULL license plate not such a bright idea

#245

Post by mikeash » Mon, Aug 12, 2019, 7:19 PM UTC

rebuilder wrote: post #168

yongjik wrote: post #141

Reminds me of the story of Ireland's worst Polish driver who never got caught: http://news.bbc.co.uk/2/hi/uk_news/northern_ireland/7899171....

I've also heard a similar story of a Finnish man who got a ticket in the UK, and on closer inspection found his name on the ticket listed as Mr. Ajokortti Körkort. Thats "driver's licence", first in Finnish, then Swedish, and is written at the top of the driver's license card. That said, I find these stories a little hard to credit, since you'd expect police officers in the EU to be fairly familiar with the standard…

You’d expect offices in the US to be familiar with US states and territories, but that doesn’t stop them from occasionally demanding a passport from people from New Mexico, or saying a license is fake because there’s no such state as “District of Columbia.”

Re: NULL license plate not such a bright idea

#246

Post by zrobotics » Mon, Aug 12, 2019, 7:24 PM UTC

"Droogie contacted the DMV who told him to change his plate. He refused because he didn't do anything wrong. While they wiped the fines off his record, unfortunately for him, they didn't fix the problem in the system so once again, Droogie has accrued another $6,000 in tickets"

So wait, after he knew this was the outcome from using this plate he just decided 'nope, the DMV will definitely rectify this error'? Maybe he has a much higher tolerance for dealing with the DMV than I do, but surely there are far more productive ways to spend your time than constantly battling against invalid tickets. Additionally, I would be concerned about not being able to waive some of these tickets at some point and actually having to pay them,6k isn't exactly an insignificant amount and could also really impact insurance rates.

Re: NULL license plate not such a bright idea

#247

Post by mikeash » Mon, Aug 12, 2019, 7:25 PM UTC

DenisM wrote: post #233

ninjinxo wrote: post #199

Earlier quoted context omitted.

*998

900 Numbers 0..99 are not three-digit.

Ah, but VINs aren’t numbers. (Never mind what the N stands for.) 000 would be perfectly valid.

Re: NULL license plate not such a bright idea

#248

Post by distances » Mon, Aug 12, 2019, 7:25 PM UTC

djsumdog wrote: post #186

_lo3k wrote: post #6

When I was a foolhardy college student I figured out that if the cited vehicle make on my city parking ticket didn’t match my registration, I could get appeal the ticket via a web form very easily and succeed every time. Naturally I removed the badges from my car and put on different badges from another manufacturer. After a while they started to cite me as “other” and the trick no longer worked.

I knew a kid in college who would get a ticket, and then look around the parking lot for another Black Nissan Maxima. Most people don't actually look at the plate number, just the make model. I think he got one ticket paid this way ... guy was kinda an asshole.

I've had a friend do the reverse: parking in illegal spot, and borrowing a ticket from another car that already received one. Upon return some hours later, he returned the ticket to the correct windshield.

Quite brazen, and frankly a bit of an asshole thing to do.

Re: NULL license plate not such a bright idea

#249

Post by ChainOfFools » Mon, Aug 12, 2019, 7:26 PM UTC

Iv wrote: post #60

RcouF1uZ4gsC wrote: post #33

Earlier quoted context omitted.

Relevant xkcd comic https://xkcd.com/1105/

In the Starcraft 2 community it is called barcoding. Basically, I 1 | l are all accepted characters for a name and I think some do look actually identical on most fonts used in the game. So yeah, one person doing that you call "barcode", 2 persons doing that, you already have deniability. Be more than 10, and that's a crowd.

this goes back at least as far as the original Unreal Tournament, I even saw a player using it in the fairly obscure Shogo: MAD multiplayer community. Never knew why it was done back then, I assumed it was just to be cute, but it did make it troublesome to mention them in ingame chats.

Re: NULL license plate not such a bright idea

#250

Post by dajonker » Mon, Aug 12, 2019, 7:26 PM UTC

cgriswald wrote: post #236

linker3000 wrote: post #132

A colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which they didn't realise. It was about a week before the router dropped its connection and needed to re-authenticate - and that's when I was called in to investigate the loss of connectivity - which Windows 10 very unhelpfully reported as the network cable disconnec…

Many, many websites will happily accept passwords of $X characters and then hash only $(X-Y) characters on registration, but try to hash all $X characters on login, so of course the hashes don’t match. And at no point do they tell you the maximum number of characters.

Yes, this is terribly annoying, often there is a minimum length but no mention of maximum length. I see this on many, many websites...