Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your last name is Null, nothing works

wsj.com

Post reply on HN
Print view View original

271–280 of 310 posts

Re: When your last name is Null, nothing works

#271

Post by schnable »

jwr wrote: post #265
jwr wrote: post #223

This is terrifying, because it implies that so many computer systems interpret user-supplied data as what should be out-of-band values. No computer system should ever interpret what is in the "last name" field, it should be a sequence of characters only. Every attempt at interpretation is an exploit waiting to happen.

I revisited this discussion after 3h and now I'm even more terrified, because most (if not all) replies totally miss the point. Again: no computer system should ever interpret anything in the "last name" field. It should always be handled "in gloves", as an opaque value. It's not about typing, it's not about "paying for clear code", it's not about HTTP, I guess it might be about "best practices", but come on — this s…

I agree with you within a single data domain.

But is a smart comment buried in there about ETL systems and data exchange where it's pretty easy, and arguably correctly in some cases, to get "null" in an exported field. Then the importing system, again arguable correctly, needs to handle the null case as a true null, not "null." I'm not sure there is a very easy fix for this or an obvious best practice.

Re: When your last name is Null, nothing works

#272

Post by schnable »

AndrewDavis wrote: post #188
rco8786 wrote: post #104

My last name is a popular Irish name with an apostrophe in it. I have tons of issues with my name in forms. I'm basically a walking SQL injection detector. But also I've started to drop the apostrophe in most of my online profiles and things. So I think we're starting to see the end of apostrophes in people's names, thanks to some fun oddities of the internet and common database technologies.

Reminds me of the story of the French politician with a forward slash in their name. https://en.wikipedia.org/wiki/Emeline_K%2FBidi?wprov=sfla1 I can't find a reference anywhere, but I remember reading that when their child was born they couldn't process a birth certificate with the name containing a slash, so it was changed to a dash for the kid.

Reading the article, I'd guess the introduction of the slash was introduced because the actual letter (Ꝃ) wasn't available on earlier technology like a typewriter. Funny that the "fix" caused problems with the next generation of tech.

Re: When your last name is Null, nothing works

#273

Post by unyttigfjelltol »

teddyh wrote: post #259
mike_hearn wrote: post #249

Ironically, this article is full of the sort of semantic confusions that cause the problem in the first place. The reporter clearly hasn't run the article past an actual programmer as she seems to think this outcome is a deliberate design choice rather than a bug: > Null was first programmed 60 years ago by a British computer scientist named Tony Hoare ... Hoare probably wasn’t thinking about people with the 4,910th…

> I really don't get why journalists so rarely do basic fact checking It takes time and effort with no discernable upside. In fact, knowing the true facts would make it harder for journalists to bias the story in the way they want to without them feeling a bit bad for lying. It’s easier for them if they don’t know. > that undermines their credibility without them even noticing. Not really. Even the vanishingly small…

> It takes time and effort with no discernable upside.

The true answer is incentives, opportunity and aptitude. Incentives are skewed to writing something that will engage readers, the human version of the social media algorithm. Opportunities are short because reporting is done on deadline without the luxury of time to deeply ponder intermediate drafts. And reporters are writing around the edge of their expertise and training all the time. That specific reporter specializes in "personal finance" so it's a wonder the article even begins to make sense. And writers have to be good at two things at the same time, journalism and whatever they are trying to write about. It's hard to be excellent at multiple disciplines.

When you put it together, it's sort of magical when a news room works at all.

Re: When your last name is Null, nothing works

#274

Post by sensanaty »

DC-3 wrote: post #16

I have my own mildly amusing story of breaking systems with my name. I have a twin with the same first initial. Any time we had to use a system at school which constructed usernames from some combination of first initial, surname, and date of birth, only one account would be provisioned between the two of us. It became almost a ritual in the first term of the school year for us to make a visit to IT Support and reque…

I never know whether to use the ć in my name when signing up for systems that require full legal names (banks et al.). Even my own country's gov't sites break when I input my real name, but refuses to accept the name without the ć. It was a real pain in the ass when I had to make an appointment and go in to some dingy office at 6am because their system doesn't support one of the most common letters in Serbian names. There's like a 90% chance the dude who made the system has a similar name with a ć or č in it even!

Surprisingly this has never broken for me in either Indonesia or the Netherlands though, whenever I've put the ć in it just converted it to a regular C which is perfectly acceptable for me (for context, it's pretty easy to guess which C is actually a ć or č in Serbian, similarly for s/š or z/ž, so seeing text without the proper diacritics doesn't really matter in most cases). My Dutch ID even correctly has the ć!

Re: When your last name is Null, nothing works

#275

Post by sensanaty »

mike_hearn wrote: post #249

Ironically, this article is full of the sort of semantic confusions that cause the problem in the first place. The reporter clearly hasn't run the article past an actual programmer as she seems to think this outcome is a deliberate design choice rather than a bug: > Null was first programmed 60 years ago by a British computer scientist named Tony Hoare ... Hoare probably wasn’t thinking about people with the 4,910th…

> > “It’s a difficult problem to solve because it’s so widespread,” said Daan Leijen, a researcher at Microsoft, who says the company avoids use of null values in its software.

> Whatever Leijen said, I'm pretty sure it wasn't that.

I had a good lol when I read that, imagining some top-level decree to NEVER use null values in any context in all of Microsoft

Re: When your last name is Null, nothing works

#276

Post by 6LLvveMx2koXfwn »

AndrewDavis wrote: post #188
rco8786 wrote: post #104

My last name is a popular Irish name with an apostrophe in it. I have tons of issues with my name in forms. I'm basically a walking SQL injection detector. But also I've started to drop the apostrophe in most of my online profiles and things. So I think we're starting to see the end of apostrophes in people's names, thanks to some fun oddities of the internet and common database technologies.

Reminds me of the story of the French politician with a forward slash in their name. https://en.wikipedia.org/wiki/Emeline_K%2FBidi?wprov=sfla1 I can't find a reference anywhere, but I remember reading that when their child was born they couldn't process a birth certificate with the name containing a slash, so it was changed to a dash for the kid.

At least they had the excuse of being named - whoever came up with `/e/OS` as the name for a phone OS in the age of the internet needs a strong word!

1. https://e.foundation/e-os/

Re: When your last name is Null, nothing works

#277

Post by thefreeman »

jwr wrote: post #223

This is terrifying, because it implies that so many computer systems interpret user-supplied data as what should be out-of-band values. No computer system should ever interpret what is in the "last name" field, it should be a sequence of characters only. Every attempt at interpretation is an exploit waiting to happen.

pretty sure this is just the result of bad programmers trying to compare things against “null” (the string) and not whatever the null value is in their language. i don’t think they are evaling the the last name field or something.

Re: When your last name is Null, nothing works

#278

Post by joseda-hg »

jwr wrote: post #265
jwr wrote: post #223

This is terrifying, because it implies that so many computer systems interpret user-supplied data as what should be out-of-band values. No computer system should ever interpret what is in the "last name" field, it should be a sequence of characters only. Every attempt at interpretation is an exploit waiting to happen.

I revisited this discussion after 3h and now I'm even more terrified, because most (if not all) replies totally miss the point. Again: no computer system should ever interpret anything in the "last name" field. It should always be handled "in gloves", as an opaque value. It's not about typing, it's not about "paying for clear code", it's not about HTTP, I guess it might be about "best practices", but come on — this s…

NULL might be interpreted if you interpolate your strings directly to SQL instead of using parameters (Drilled into me in 1st year that you should avoid it like the plague, but for some reason surprisigly common in older systems I've encountered)

string name = null; $"INSERT INTO users (name) VALUES ('{name}')";

Basically an involuntary SQL Injection

Re: When your last name is Null, nothing works

#279

Post by sensanaty »

great_wubwub wrote: post #20
AlotOfReading wrote: post #14

For many years, my mother's proper legal name on her birth certificate was the empty string. This wasn't usually a problem before computers as she'd go by a given name instead, even on government paperwork. She started having issues with systems being unable to process her information in the late 90s and early 2000s. Background checks would fail, passports couldn't be issued, and so on. She eventually had it changed,…

There must be an interesting backstory here. Did her parents deliberately not name her? Did they forget?

A high school teacher of mine didn't have a last name, only a first name. Problem was when she moved (from India) she had to have a last name because a bunch of systems and people assume a last name as a fact, so her full name is just her first name twice because she didn't want to think of a different one :p

Re: When your last name is Null, nothing works

#280

Post by datavirtue »

tommica wrote: post #191
EvanAnderson wrote: post #84

Earlier quoted context omitted.

I anticipated twins with The school directory sync system I made for a small District (sub-5000 enrollment). I appended a random two digit number to first initial, last name (EAnderson96). So far none of the parents who have "weaponized"(1) the naming of their children have managed to break it since we brought it up in '99. (1) Hypothetical John Smith and his siblings Jane Smith, James Smith, Janet Smith, Jack Smith,…

I wonder if developers have a different naming convention for their children... Even on a subconscious level

Named after WOW characters.
Post reply on HN