Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your last name is Null, nothing works

wsj.com

Post reply on HN
Print view View original

261–270 of 310 posts

Re: When your last name is Null, nothing works

#261

Post by DC-3 »

js2 wrote: post #96
DC-3 wrote: post #16

I have my own mildly amusing story of breaking systems with my name. I have a twin with the same first initial. Any time we had to use a system at school which constructed usernames from some combination of first initial, surname, and date of birth, only one account would be provisioned between the two of us. It became almost a ritual in the first term of the school year for us to make a visit to IT Support and reque…

In Severance S2E1, Mark W says to Mark S: "Would you be open to using a different first name to avoid confusion?" Did anyone ever ask that of you or your twin?

No one ever asked us that which is good because I don't think either of us would have been much impressed by the suggested :p

Re: When your last name is Null, nothing works

#263

Post by EduardoBautista »

ProllyInfamous wrote: post #219
worik wrote: post #167

I have a space in my last name - no problems so far. My email is root@... (thank you Neil Stephenson for the idea) that is rejected sometimes.

What exactly was Stephenson's idea? What am I missing about root@... ?

Probably because some programs filter it out because of the risk of the "root" user such as `root@localhost`

Re: When your last name is Null, nothing works

#264

Post by Walf »

sensanaty wrote: post #256
progre wrote: post #226

Earlier quoted context omitted.

In YAML (the gift that keeps on giving, see the False/Norway debacle) the last name of Null would have to be quoted, otherwise it would signify the null value.

I will forever curse whoever thought YAML was a good idea and spread it everywhere.

Let's all just pretend YAML is simply JSON with comments.

Re: When your last name is Null, nothing works

#265

Post by jwr »

jwr wrote: post #223

This is terrifying, because it implies that so many computer systems interpret user-supplied data as what should be out-of-band values. No computer system should ever interpret what is in the "last name" field, it should be a sequence of characters only. Every attempt at interpretation is an exploit waiting to happen.

I revisited this discussion after 3h and now I'm even more terrified, because most (if not all) replies totally miss the point.

Again: no computer system should ever interpret anything in the "last name" field. It should always be handled "in gloves", as an opaque value. It's not about typing, it's not about "paying for clear code", it's not about HTTP, I guess it might be about "best practices", but come on — this should be obvious!

I'm thinking about my systems now and I'm having a hard time coming up with a scenario where interpreting something inside a string value is even POSSIBLE (I use Clojure), unless you explicitly try to read from the string and interpret the results, and even then it's not easy.

I know that in the olden days we used to just feed user-supplied values into shells, with no regard for in-band vs out-of-band distinction. I also know that the HN-beloved SQL makes no distinction of in-band vs out-of-band, which causes a load of problems with proper escaping, hence Little Bobby Tables. But aren't we past that? Does anybody still construct SQL queries by concatenating user-supplied and app-supplied strings?

Re: When your last name is Null, nothing works

#266

Post by jwr »

progre wrote: post #226
jwr wrote: post #223

This is terrifying, because it implies that so many computer systems interpret user-supplied data as what should be out-of-band values. No computer system should ever interpret what is in the "last name" field, it should be a sequence of characters only. Every attempt at interpretation is an exploit waiting to happen.

In YAML (the gift that keeps on giving, see the False/Norway debacle) the last name of Null would have to be quoted, otherwise it would signify the null value.

Why in the world would anyone EVER want to stick user-supplied data into YAML to be interpreted?

(setting aside the very relevant question of why would anyone ever want to use YAML at all)

Re: When your last name is Null, nothing works

#267

Post by mrkeen »

munchler wrote: post #47
lores wrote: post #10

Earlier quoted context omitted.

Any time "$var" is interpolated without check into an INSERT, and any maintainer finds it easier to just check for null as a string rather than ask a DB admin or committee to update the DB after a lot of red tape and risk assessment. So... very often.

I don't buy that. The string "Null" is different from the keyword null in programming, so `if $var = null` would be false when $var is the string "Null". Note that when interpolated into SQL, the contents of $var must be surrounded by single quotes, so you end up with `insert into Table (Name) values ('Null')`, which correctly inserts the string "Null" into the table. If you were to leave off the quotes, you'd get a…

I don't buy that type-checkers would look at the value null, and say "Yep, that's a String/Integer/User". But here we are.

Re: When your last name is Null, nothing works

#268

Post by detourdog »

zeroonetwothree wrote: post #182
detourdog wrote: post #71

Earlier quoted context omitted.

I set-up a directory system for a small school. The students logins were a combination or initials and date of birth. When I created the scheme I knew that a set of twins would break the system. Somewhere between 3 and 5 years we finally got a set of twins that needed to modify the system. I called them to my office and found out which one came out first and appended 1 their usernames and 2.

I’m a twin and my parents never told us who was ‘first’.

Do you think it was an equality thing?

Re: When your last name is Null, nothing works

#269

Post by rco8786 »

layman51 wrote: post #111
rco8786 wrote: post #104

My last name is a popular Irish name with an apostrophe in it. I have tons of issues with my name in forms. I'm basically a walking SQL injection detector. But also I've started to drop the apostrophe in most of my online profiles and things. So I think we're starting to see the end of apostrophes in people's names, thanks to some fun oddities of the internet and common database technologies.

Do you also get the apostrophe get mangled into something like `'` ?

All the time!

Re: When your last name is Null, nothing works

#270

Post by jpc0 »

CivBase wrote: post #147
WantonQuantum wrote: post #92

Earlier quoted context omitted.

C definitely does not represent null as a string.

No, but it also doesn't let you store null in a string variable. Well... it does, but that would just be an empty string.

In C, and many other languages at that, strings are just arrays of bytes.

So you absolutely could store null in a string... It is even a valid ascii and UTF character. Now most string handling functions treat it as the end of a string in C but that is only by convention.

How you would display null to a user is a different story all together but representing it in a string is not an unsolved programming problem, generally its when you need to actually display null that it becomes a hard problem because how do you display the absence of something, specifically when a space is not an absence.

How do you serialise a string... Well it's already serialised given your specific endianness... So you just indicate that... This is 280 bytes of UTF8 data... It can contain as many nulls as you like, until you get 280 bytes of data you don't have all of it.

Post reply on HN