Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your last name is Null, nothing works

wsj.com

Post reply on HN
Print view View original

241–250 of 310 posts

Re: When your last name is Null, nothing works

#241

Post by makeitdouble »

jwr wrote: post #223

This is terrifying, because it implies that so many computer systems interpret user-supplied data as what should be out-of-band values. No computer system should ever interpret what is in the "last name" field, it should be a sequence of characters only. Every attempt at interpretation is an exploit waiting to happen.

This is the idealistic approach. Then reality comes knocking at the door.

It's sad people get collateral damage and it should be fixed, but the world turns around with millions of these workarounds everywhere.

The most interesting I remember is stock management software: at 3 different places I had the employees dealing with stock explain how they set outrageous prices (like 9999999.99 EUR for a toothbrush) to keep an item in the inventory system but mark it as unavailable for a day or less until it gets restocked again.

I'm sure there is an official way to put something out of stock and restock it again, but it's just painful for an operation that happens basically everyday, for dozens of items.

Re: When your last name is Null, nothing works

#242

Post by voidUpdate »

kstrauser wrote: post #109
impossiblefork wrote: post #78

Earlier quoted context omitted.

or people whose middle name is their first name.

Hey, that's also relevant to me! I've checked my local laws, and where I live, your legal name is the one you consistently present yourself as. If you're Joe Frank Smith, and you go by Frank everywhere, that's your legal name . I've gotten so tired of having this argument. Inevitably some clerk will insist on calling me by my first name, "you know, your legal name ". No. My middle name is my legal name. It's what my…

Re banks: My bank refused to update my name on my accounts after I authenticated with my card, showed them my passport, name change form and deed poll, as, and I quote, "anyone could have done that". Like yes, I believe that's the point of a deed poll? And what more evidence did they want to prove it was me trying to change the details on my own account?

Re: When your last name is Null, nothing works

#243

Post by yason »

rco8786 wrote: post #104

My last name is a popular Irish name with an apostrophe in it. I have tons of issues with my name in forms. I'm basically a walking SQL injection detector. But also I've started to drop the apostrophe in most of my online profiles and things. So I think we're starting to see the end of apostrophes in people's names, thanks to some fun oddities of the internet and common database technologies.

Suppose your name was "Néill" then you could just change it to b"N\xc3\xa9ill".

Re: When your last name is Null, nothing works

#244

Post by pbmonster »

zeroonetwothree wrote: post #182
detourdog wrote: post #71

Earlier quoted context omitted.

I set-up a directory system for a small school. The students logins were a combination or initials and date of birth. When I created the scheme I knew that a set of twins would break the system. Somewhere between 3 and 5 years we finally got a set of twins that needed to modify the system. I called them to my office and found out which one came out first and appended 1 their usernames and 2.

I’m a twin and my parents never told us who was ‘first’.

They probably don't know. If you're identical, babies are mixed-up for sure during the stressful first couple of days.

There's probably a medical document somewhere with the exact time of birth, but no way of knowing who's it really is.

Re: When your last name is Null, nothing works

#245

Post by skissane »

genewitch wrote: post #116
EvanAnderson wrote: post #91

Earlier quoted context omitted.

I knew a Steve Penington who broke a user id scheme.

Bob Matt Derrick once told me of a facility whose maintenance supervisor was named Stuart Pedaso and he nearly had an aneurism from laughter. Secretary there didn't get it.

You know, it took me ages to finally get this… first three letters of first name plus first three letters of surname. Does that mean I’m his login?

(And the last three letters of his surname sound a bit like another word, but adding that to his login as well ruins my dad joke.)

Re: When your last name is Null, nothing works

#246

Post by arkh »

robertlagrant wrote: post #3

Who's checking if a string matches "null" rather than is null!?

I'd guess some data transferred between systems as a homemade CSV. Empty field = empty string, but some field is nullable so someone decided that Null would be a way to declare a null field.

20 years later and multiple systems depending on each others, random hidden CRONs in the middle and now people called Null have a problem.

Re: When your last name is Null, nothing works

#247

Post by hsbauauvhabzb »

notarealllama wrote: post #224
jwr wrote: post #223

This is terrifying, because it implies that so many computer systems interpret user-supplied data as what should be out-of-band values. No computer system should ever interpret what is in the "last name" field, it should be a sequence of characters only. Every attempt at interpretation is an exploit waiting to happen.

Typed data?! What's next, unit tests? Memory safety? Where will it stop?

I’m still convinced unit tests are a Santa clause type situation where it takes. While to figure out it’s really just a story told to naïve juniors

Re: When your last name is Null, nothing works

#248

Post by Aaargh20318 »

wodenokoto wrote: post #193
halper wrote: post #181

Earlier quoted context omitted.

It drives me mad when various forms sternly requires me to enter my name "as it is spelled in the passport" only to tell me that my name is "invalid" or "incorrect" or "not allowed". Then we have the systems that have non-standard transliteration rules … I have never been known by more than one name, but the spelling sure differs.

It's annoying that airlines writes "as spelled in passport", when what they really need is an upper case alpha-only version of your name. But it is also equally annoying that passports don't clearly spell out a "international and systems compatible" version of your name. We've had Airlines for way over half a century, and visas for about as long as we have had passports and people still walk around with international…

What they probably mean is the name as it’s spelled in the MRZ (the ‘Machine Readable Zone’, the two lines at the bottom of the passport), which is also stored in data group 1 in the embedded chip. Passports can also contain the full name in UTF-8 in data group 11, but this is an optional field.

The MRZ can only contain the characters A-Z (uppercase), 0-9 and <. ICAO document 9303-3 describes conventions for transliteration of other characters into this limited character set.

Re: When your last name is Null, nothing works

#249

Post by mike_hearn »

Ironically, this article is full of the sort of semantic confusions that cause the problem in the first place. The reporter clearly hasn't run the article past an actual programmer as she seems to think this outcome is a deliberate design choice rather than a bug:

> Null was first programmed 60 years ago by a British computer scientist named Tony Hoare ... Hoare probably wasn’t thinking about people with the 4,910th most common surname. He later called it his billion-dollar mistake, given the amount of programmer time it has used up and the damage it has inflicted on the user experience.

Obviously Hoare's statement wasn't about this problem at all. She's also giving readers the impression Microsoft has some sort of policy against using null values:

> “It’s a difficult problem to solve because it’s so widespread,” said Daan Leijen, a researcher at Microsoft, who says the company avoids use of null values in its software.

Whatever Leijen said, I'm pretty sure it wasn't that.

I really don't get why journalists so rarely do basic fact checking of their own articles by asking an independent source for a final read-through. Many of them actually have policies against doing this, which leads to an endless stream of garbled articles that undermines their credibility without them even noticing.

Post reply on HN