Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When your last name is Null, nothing works

wsj.com

Post reply on HN
Print view View original

51–60 of 310 posts

Re: When your last name is Null, nothing works

#51

Post by juujian »

DC-3 wrote: post #16

I have my own mildly amusing story of breaking systems with my name. I have a twin with the same first initial. Any time we had to use a system at school which constructed usernames from some combination of first initial, surname, and date of birth, only one account would be provisioned between the two of us. It became almost a ritual in the first term of the school year for us to make a visit to IT Support and reque…

Meanwhile, friend of mine's last name was Li, and IDs were first initial + last name + #

Her number had three digits.

I'm guessing it's the birthday that really messed the system up though?

Re: When your last name is Null, nothing works

#52

Post by lores »

munchler wrote: post #47
lores wrote: post #10

Earlier quoted context omitted.

Any time "$var" is interpolated without check into an INSERT, and any maintainer finds it easier to just check for null as a string rather than ask a DB admin or committee to update the DB after a lot of red tape and risk assessment. So... very often.

I don't buy that. The string "Null" is different from the keyword null in programming, so `if $var = null` would be false when $var is the string "Null". Note that when interpolated into SQL, the contents of $var must be surrounded by single quotes, so you end up with `insert into Table (Name) values ('Null')`, which correctly inserts the string "Null" into the table. If you were to leave off the quotes, you'd get a…

> $req = "insert into people (name) ('$name')";

> $db.exec($req)

Now you have "null" as strings in the DB in any language that interpolates null as "null".

> select * from people where name is not null

"Why do we see nulls in testing? Damn, the DB has dirty data. Go through the trouble of fixing it, or...

> select * from people where name is not null and name != "null"

The end. Sorry Mr Null.

Re: When your last name is Null, nothing works

#53

Post by IggleSniggle »

hsbauauvhabzb wrote: post #19
robertlagrant wrote: post #3

Who's checking if a string matches "null" rather than is null!?

There’s a few condescending answers here. You will find this more common in weakly typed languages like PHP and VB and maaaaaybe JavaScript, where null == “null” will probably evaluate to true.

js doesn't have this particular problem, but it does have both `null` and `undefined`, which will have varying semantically different usages depending on local conventions.

For example, some will prefer to use `null` to mean that a value is _intentionally_ missing (for example, the db explicitly returned a null value), while `undefined` does not have any such connotation. These exist for frontend engineers to navigate decisions often far removed from their influence.

Anyway, `null != ''` and `null != 'null'`, but `null == undefined`. However, `null !== undefined`.

A lot has been made of js Truthy/Falsy equality operator, but most js programmers will take steps to actively avoid it coming into play. Probably the `void` operator is still under-used though in frontend code, though, since there's some pretty surprising legacy things that can happen when interacting with DOM APIs (like `checkbox.onclick = () => doSomething()` resulting in different checkbox behavior depending on whether or not `doSomething` returns a boolean or undefined).

Re: When your last name is Null, nothing works

#54

Post by lores »

hsbauauvhabzb wrote: post #41
lores wrote: post #30

Earlier quoted context omitted.

I don't disagree... In most cases, it's not your system, though, it's someone else's.

> You can make a good case to spend time sanitising requests > In most cases, it's not your system, though You can’t pick and chose whether you own a system or not when presented with an opposing argument. That’s not how this works.

"System owner, we need to spend $10K to sanitise requests or a kid can destroy our business overnight".

"System owner, we need to spend $10K to clean up the database and code so that null and "null" are not the same thing, even though it works 99.99% of the time".

Do you see the difference?

Re: When your last name is Null, nothing works

#56

Post by hsbauauvhabzb »

lores wrote: post #54
hsbauauvhabzb wrote: post #41

Earlier quoted context omitted.

> You can make a good case to spend time sanitising requests > In most cases, it's not your system, though You can’t pick and chose whether you own a system or not when presented with an opposing argument. That’s not how this works.

"System owner, we need to spend $10K to sanitise requests or a kid can destroy our business overnight". "System owner, we need to spend $10K to clean up the database and code so that null and "null" are not the same thing, even though it works 99.99% of the time". Do you see the difference?

If there are type confusion bugs related to SQL statements, I think SQL injection is likely to exist, if not some other super nasty bugs will eclipse it.

You can waste 10k paying someone to look at it or you could not waste your money, but I’d be fucked before I sign off on a system with those kinds of bugs as being secure, evidence or not. Someone higher up can accept that risk, but I’d rather not be liable when it’s breached or catastrophically damaged because some kid changed their last name to an SQL injection payload.

And yes, I’ve checked, in my country unpronounceable names are not permitted, otherwise I’d have one. There are existing case studies of this, iirc in the UK.

Re: When your last name is Null, nothing works

#58

Post by hsbauauvhabzb »

IggleSniggle wrote: post #53
hsbauauvhabzb wrote: post #19

Earlier quoted context omitted.

There’s a few condescending answers here. You will find this more common in weakly typed languages like PHP and VB and maaaaaybe JavaScript, where null == “null” will probably evaluate to true.

js doesn't have this particular problem, but it does have both `null` and `undefined`, which will have varying semantically different usages depending on local conventions. For example, some will prefer to use `null` to mean that a value is _intentionally_ missing (for example, the db explicitly returned a null value), while `undefined` does not have any such connotation. These exist for frontend engineers to navigat…

I would call myself a relatively good developer and I fully understood type checking occurred via ===, and compare by value caught me. In my defence, I assumed this was less of an issue in modern JS, but thou shall not break backward comparability, apparently.

Re: When your last name is Null, nothing works

#59

Post by dwaltrip »

drpossum wrote: post #57
Vilian wrote: post #8

Earlier quoted context omitted.

Mandatory https://xkcd.com/327/

Why is this mandatory? Who made the mandate?

It’s a bit. It’s quite popular to link an xkcd whenever it’s relevant, along with one of a few different catch phrases. “Mandatory” being one of those. For this phrase in particular, the joke is that there is usually an xkcd for most situations, and that it is our “duty” as nerds to link to the appropriate one. It’s an inside joke for nerds. I hope this explains the custom to you.

Re: When your last name is Null, nothing works

#60

Post by BonoboIO »

andrewmcwatters wrote: post #34

I think we should all embrace a future where legal names are just straight up binary streams. I can finally realize my true potential and be recognized as Mr. “:100 emoji:(Unicode zero-width joiner):fire emoji:(null character)(base64 encoding of a QR code that links to a website with a photo of my face),(vcard data, recursively referencing this last name somehow)”

Big Endian or Little Endian ;-)
Post reply on HN