
NULL license plate not such a bright idea - dublin
https://knrs.iheart.com/content/2019-08-12-clever-vanity-license-plate-backfires-on-man-winds-up-with-tons-of-tickets/
======
kens
I read years ago in comp.risks about a similar story. A guy in 1979(!)
requested a personalized plate "SAILING", with second choice "BOATING". He
didn't want a customized plate if he couldn't get those, so for his third
choice he put down "NO PLATE". Of course, he ended up with "NO PLATE". He
ended up getting 2500 parking tickets, since cars with no plate had "NO PLATE"
written on the ticket.

References:
[http://www.mekabay.com/overviews/risks/risks03_1986_06-04-19...](http://www.mekabay.com/overviews/risks/risks03_1986_06-04-1986-10-30.pdf)

[https://www.snopes.com/fact-check/licensed-to-
bill/](https://www.snopes.com/fact-check/licensed-to-bill/)

~~~
sieabahlpark
I remember a different story where the guy had to fight every ticket in court

~~~
3wolf
On the plus side, he could also contest legitimate tickets unless they
recorded other information.

~~~
DecoPerson
I managed to do this at my university. I had vanity plates with a design made
by my local Australia shire, which had the shire emblem between two parts of
the plate. The plate was something like "123ABC" but I'm guessing emblem read
as an O, so their scanners saw "123OABC", which was not a plate registered
with the uni.

Each day there was a 10-20% chance I would get a ticket on my windshield. I
would collect them and take them to the uni security office once a fortnite to
have them cancelled in bulk. I actually got pretty friendly with some of the
staff there.

At least 4 of them were legitimate tickets because I parked overtime, over a
line, etc, but the staff cancelled them anyway (:

------
linker3000
A colleague used an app's "generate secure password" feature to change their
ISP's web portal login - which then also became the WAN router's password -
which they didn't realise.

It was about a week before the router dropped its connection and needed to re-
authenticate - and that's when I was called in to investigate the loss of
connectivity - which Windows 10 very unhelpfully reported as the network cable
disconnected and was resetting or power-saving on the NIC so the "link active"
LED on the switch was going out for about 2 secs every 10 sec. Cue a round of
cable and switch swapping to no benefit. The LEDs for all other devices on the
switch (running Linux and mostly internal servers) were behaving normally.

I finally backtraced to the router and a useful error message. We put two-and-
two together and my colleague called up the auto-saved details in their
password manager; it was long, and ALL non-alpha numeric characters - starting
with a backtick, which the router would not accept. I tethered my phone to my
laptop and tried to login to the Web account portal - which would NOT accept
the passphrase. I tried it without the backtick "just in case" \- nope.

We had to do a "lost password" reset on the portal..and wait for the email
with link.

Lessons learned:

The ISP's password change page did not seem to validate input, but the login
page did.

Avoid backticks in passwords.

~~~
gruez
>Avoid backticks in passwords.

Is there even a reason to include special characters in passwords? They add
10% more security[1] but cause all sorts of issues with systems. Just use an
alphanumeric password that's 10% longer, and if special characters are
mandatory, use a safe character at the end like _ or -.

[1] 6.55 bits per character (all printable ascii characters) rather than 5.95
(only alphanumeric)

~~~
mehrdadn
> 10% more security (6.55 vs. 5.95 bits per character)

That's not how this works. By your logic having a password consisting of
1,2,3,4 is only twice as secure as having just 1,2.

~~~
monocasa
That's absolutely how bits of entropy work.

~~~
mehrdadn
That's most definitely not how security works. The strength of your password
is _not_ proportional to the number of bits of entropy it has.

~~~
dredmorbius
The way you're phrasing this may be misleading.

The strength of a password / passphrase increases with the power of 2 raised
to the bits of entropy.

That's an exponential proportion, rather than a linear one. But a proportion
all the same.

Example:

Given mixed-case alphanumeric (62 characters) and an 8-character password
length, the number of combinations is:

    
    
        62^8 = 218,340,105,584,896 (keyspace -- 218 quadrillion)
        l(62^8)/l(2) = 47.6 (bits of entropy)
    

A 10 character password (if randomly chosen from the same character set) has
10^17 possibly combinations (about 4,000x more), and 59.4 bits of entropy,
11.8 bits more. 2^11 = 2048.

------
pardavis
When I was a foolhardy college student I figured out that if the cited vehicle
make on my city parking ticket didn’t match my registration, I could get
appeal the ticket via a web form very easily and succeed every time.

Naturally I removed the badges from my car and put on different badges from
another manufacturer. After a while they started to cite me as “other” and the
trick no longer worked.

~~~
cronix
All we had to do was register our cars in each others names. When I was
married, my car was registered to her and vice versa. The redlight/photoradar
laws in my state required that the company operating the devices had to match
the pic of the driver violating the law, to the pic of the registered owner
via the license plate. If they couldn't match them, no ticket was issued as
you can't prove who was driving. That's probably changed now that a lot of
DMV's are doing facial scans with datapoints. They probably just scan the
whole DMV DB now to find the driver. Wear a mask.

~~~
tooop
Where i am from the ticket is issued to the vehicle owner, doesn't matter who
was driving. On the plus side it means that you can get a photoradar ticket
for driving 300km/h and not lose your licence, just pay the fine.

P.S. If the driver must be recognized does it mean that motorcyclists are
exempt from photoradar fines?

~~~
monocasa
I thought that motorcycles already didn't really show up on the photoradar
scanners. That's the way it is here, but I can totally see that being a
jurisdiction by jurisdiction thing.

~~~
tooop
Here it is easier to avoid getting a photo with motorcycle because there are
places where it targets front plate. If photoradar targets back plate then you
will get a ticket for a motorcycle just like any car.

------
indianSummer
I own a rare collector car with a three-digit VIN. This has caused endless
hassles at the DMV as well as the insurance office. Sometimes we find success
by prepending the necessary number of zeros, before the VIN. Other instances
in the same system require appending zeros after the VIN. The true VIN has a
hyphen but that never makes it into the DMV's system. One time I got stuck in
a particularly nasty loop where the DMV mailed over thirty notices claiming
the register would expire on 01/01/0000.

~~~
checktheorder
>I own a rare collector car with a three-digit VIN. This has caused endless
hassles at the DMV as well as the insurance office.

I have a similar problem with my own identity. I was born in Canada's smallest
province, PEI, and now live in its largest, Ontario. Some Ontario government
software seems to have problems recognizing the relatively low numbers on PEI
birth certificates.

~~~
edisondotme
Which numbers?

------
hn_throwaway_99
Tangentially related somewhat-common bug: YAML files will interpret the
literal 'no' as boolean false if it's not quoted, instead of as a string.

Many developers have wondered why, when they stuck country-specific
configurations in a YAML file, that things suddenly stopped working when they
expanded support for Norway.

~~~
strenholme
I always felt Yaml is far too complicated of a format for storing hierarchical
data. JSON is too simple (no comments; hard to store multi-line strings).

HCL, the hierarchical data storage language used by Terraform, is the closest
thing I’ve seen to a happy medium between JSON and Yaml.

Another option, if the string values are not multi-line, is CommentJSON (use
the Python module or write 10 lines of code that strips out comments from JSON
if using another language).

~~~
marcosdumay
Both a bare > and a sequence of 3 quotes are invalid in JSON, so it should be
really simple to add multi-line strings wither Python or Perl style.

~~~
roryokane
The Hjson format does this: [https://hjson.org/](https://hjson.org/). It’s
just JSON plus syntax sugar such as // comments and '''multiline strings'''.

------
yongjik
Reminds me of the story of Ireland's worst Polish driver who never got caught:
[http://news.bbc.co.uk/2/hi/uk_news/northern_ireland/7899171....](http://news.bbc.co.uk/2/hi/uk_news/northern_ireland/7899171.stm)

~~~
rebuilder
I've also heard a similar story of a Finnish man who got a ticket in the UK,
and on closer inspection found his name on the ticket listed as Mr. Ajokortti
Körkort. Thats "driver's licence", first in Finnish, then Swedish, and is
written at the top of the driver's license card.

That said, I find these stories a little hard to credit, since you'd expect
police officers in the EU to be fairly familiar with the standard EU driver's
license layout.

~~~
diatribattical
I once had a BevMo cashier in California ask me, “Massachusetts? Is that in
Canada?”

Very little faith left.

~~~
madcaptenor
I once had a cab driver take me to MIT. Cab driver: "what is this place?" Me:
"MIT" Cab driver: "what's MIT?" Me: "the Massachusetts Institute of
Technology." Cab driver: "what's Massachusetts?"

~~~
foldr
I had a cab driver in New York who was unable to take me to the Brooklyn
Bridge.

~~~
et2o
Possibly didn't want to take you into Brooklyn. The Manhattan side isn't
really walkable.

~~~
foldr
I was already on the Brooklyn side. But the issue was literally that he had no
idea what the Brooklyn Bridge was, not the precise drop-off location. (We just
wanted to look around Dumbo for a bit.)

~~~
et2o
Wow! Hard to think of a more iconic landmark in that case.

~~~
madcaptenor
Someone else is probably out there complaining a cab driver wouldn't give them
a ride to the Statue of Liberty.

------
ldoughty
I have a family member who's license plate started with "&". The DMV accepts
it, plates were ordered online fine, but police systems can't handle it
apparently, to my family members ultimate discomfort. I commonly joke it
probably gets the individual out of automated tickers for speeding and red
lights, but when an officer pulls them over we sometimes need to explain that
the "&" is dropped in the system (or so we've been told) and that seems to
clear up issues

~~~
reaperducer
I sometimes see California tags with a heart character in them. Does anyone
know if those considered part of the number, or are they just ignored as
decoration?

~~~
tdiggity
They're a special vanity style plate in CA. They probably just are ignored/not
entered when searching.
[https://www.dmv.ca.gov/portal/dmv/detail/online/elp/elp](https://www.dmv.ca.gov/portal/dmv/detail/online/elp/elp)

------
cortesoft
I love when people double down out of principle, when the only person getting
hurt is themselves.

He refuses to change it because he did nothing wrong...sure, but you are also
the only one being hurt by it. Is this really the hill to die on?

~~~
xxs
Die on?

But how - he can challenge the fines in a court of law. Since it's a vanity
plate, adding an extra notoriety won't hurt.

~~~
exfed
On top of that, if anything, forcing the government to fix it's bad code (
_insert snarky ambiguity between software code and legal code_ ) can't be a
bad thing. I'd buy the guy a beer.

~~~
jspash
The problem is it's a "a privately operated citation processing center" that's
causing the problem. They might even be instructed to hand-enter a NULL for
these cases.

I'm don't really see an incentive for the govt agency to do anything about it.
It's no skin off their nose. They'll just keep sending the tickets.

~~~
Grollicus
Don't you have some kind of illegal prosecution laws? In my home country
people could go to jail for that.

------
dhosek
There was a similar issue in California where, in the days before on-line
choosing of vanity plates, you would give three choices. One guy couldn't come
up with a third option so he wrote "NO PLATE" and ended up with that as his
plate with similar results. Snopes has the story:

[https://www.snopes.com/fact-check/licensed-to-
bill/](https://www.snopes.com/fact-check/licensed-to-bill/)

------
tbyehl
Earlier this summer I decided that I'd found a loophole and ordered 'N0 TAG'
and 'N0NE' (zeros) for my motorcycles. The license plate font doesn't
distinguish between 0 and O but the computers seem to account for visually
similar characters -- I could not order the same plates with Os after they'd
issued.

Haven't caught anyone else's tickets so far. SunPass won't accept 'N0 TAG'
being associated with my transponder tho (have not tried 'N0NE' yet).

I did get pulled over on my very first ride with 'N0 TAG' and the first words
out of the cop's mouth were 'Is that tag legit?' That may or may not have been
a factor in catching a warning instead of a ticket that I absolutely earned.

~~~
throwaway3627
Lol. Third vehicle should have _N0 L1C_

~~~
TomK32
P0L 1CE

~~~
dfeojm-zlib
FUZZ 5 0

------
EliRivers
Related, for those who missed it the last time it was here on HN, the tales of
Christopher Null, who has an unfortunate surname:
[https://www.wired.com/2015/11/null/](https://www.wired.com/2015/11/null/) ,
and Jennifer Null , [http://www.bbc.com/future/story/20160325-the-names-that-
brea...](http://www.bbc.com/future/story/20160325-the-names-that-break-
computer-systems) , likewise.

~~~
MaxBarraclough
Much-needed Outline.com of the wired.com article:
[https://outline.com/WMzjYK](https://outline.com/WMzjYK)

~~~
efreak
It seems meaningful to me that the wired website works (sort of; the left
margin is 1/3 of my screen) with JavaScript disabled, and outline doesn't work
at all.

~~~
MaxBarraclough
If there were a better alternative I'd gladly use it.

------
the-dude
I once had a product owner for a student/university web app who complained
that for a particular user, their lastname was displayed as 'None'.

This was a Python project and the product owner apparently already had learned
'None' equals NULL.

I dug into the file which we used to import the users from and discovered the
user's lastname actually was 'None'.

~~~
jgtrosh
Maybe it could be added to the list of falsehoods programmers believe about
names: [https://shinesolutions.com/2018/01/08/falsehoods-
programmers...](https://shinesolutions.com/2018/01/08/falsehoods-programmers-
believe-about-names-with-examples/)

~~~
Izkata
Now, was it a case of number 20 and they were required to enter _something_ ,
or was it actually legally None?

[https://www.houseofnames.com/none-family-
crest](https://www.houseofnames.com/none-family-crest)

~~~
the-dude
Maybe the case. However, this was an international student org and the student
was from Africa.

We assumed it was correct and did not dig to the bottom.

Whatever the truth was, I could close the ticket.

------
_nickwhite
Years ago (in the late 90's or early aughts) when ordering vanity plates
online became a thing, I got approved for the plate "127.0.0.1". This was a
California or NC plate- can't remember as I lived in both states. I checked
the mailbox excitedly every day like Ralphie from A Chrismas Story for my uber
cool plate. When I finally did get something from the DMV, it was too small to
be a license plate and was simply a note that said "Sorry, your requested
plate conflicts with a motorcycle plate, so we have to deny your request."
Huge bummer, but I guess 127.0.0.1 becomes 127001 in their systems.

------
hammock
Could someone devise a SQL injection attack using a custom-made license plate?
I'm imagining someone printing up

    
    
      x'; DROP TABLE drivers; --
    

on a plate, and driving up and down the highway past automated license-plate
readers.

~~~
growt
Ah little Bobby drivers ...

~~~
HenryBemis
It always makes me so happy to see a "little Bobby tables we call him"
reference when data inputs are discussed!!!

I will assume that we are all aware of the Exploits of a Mom, but just in case
we have anyone reading this that doesn't already appreciate XKCD:
[https://www.xkcd.com/327/](https://www.xkcd.com/327/)

------
sparrish
This is funny. I wonder what would happen if you could put a 'NOT ' in front
of your plate number... would everyone but you get a ticket?

~~~
dhosek
Nah, because it's not unsanitized SQL at fault, but people writing a literal
NULL in the license plate field when there isn't one.

~~~
baybal2
I wonder, what will "DROP *;" license plate do?

~~~
Scoundreller
Probably can’t do special characters, but maybe ASCII (0x23) will let you get
around it.

~~~
entropicdrifter
0x3b so your plate is just ";" in some systems, maybe?

------
lifeisstillgood
I presume this is already on thread but Irish police conducted a manhunt for
serial traffic offender "Prawo Jazdy" \- till they realised that was "Driving
License" in Polish

[https://www.telegraph.co.uk/news/worldnews/europe/ireland/47...](https://www.telegraph.co.uk/news/worldnews/europe/ireland/4732923/Prawo-
Jazdy-Identity-of-Irelands-most-notorious-driver-uncovered.html)

~~~
jacobush
I need to change my name to that

~~~
lifeisstillgood
Guarenteeing you get chased for hundreds of other people's Traffic violation
fines?

------
harryh
I recently saw a car with a license plate of B8B88BB8 (or something to that
effect) that I am almost certain the owner chose to make it hard to read and
transcribe correctly by either humans or computer vision systems.

I was honestly kind of impressed.

~~~
cpeterso
I read that someone tried to register a license plate with a random sequence
of Os and zeros (e.g. "OO0O00"). Unfortunately, it worked too well because the
person doing data entry at the DMV ordered him a plate with all Os. :)

~~~
throwaway3627
Or all 1's, L's and I's with a license plate frame that "accidentally" covers
up the differentiating marks. >:)

PS: Reminds me, I should get one of those LPR T-shirts with license plates all
over it.

~~~
everfree
[https://xkcd.com/1105/](https://xkcd.com/1105/)

------
zrobotics
"Droogie contacted the DMV who told him to change his plate. He refused
because he didn't do anything wrong. While they wiped the fines off his
record, unfortunately for him, they didn't fix the problem in the system so
once again, Droogie has accrued another $6,000 in tickets"

So wait, after he knew this was the outcome from using this plate he just
decided 'nope, the DMV will definitely rectify this error'? Maybe he has a
much higher tolerance for dealing with the DMV than I do, but surely there are
far more productive ways to spend your time than constantly battling against
invalid tickets. Additionally, I would be concerned about not being able to
waive some of these tickets at some point and actually having to pay them,6k
isn't exactly an insignificant amount and could also really impact insurance
rates.

~~~
lucideer
Its a matter of principle though. Droogie hasn't done anything wrong, and is
receiving fines due to errors made by the DMV.

You're right that when faced with a choice between acting on principle vs
acting pragmatically/for one's own benefit/convenience/need, people often
don't have the luxury of (or patience for) choosing the former. But it's nice
to see when someone does.

~~~
ajross
> Droogie hasn't done anything wrong

That's arguable, actually. The article states, but doesn't provide evidence,
that Droogie "hoped it might confuse automatic license plate readers or the
DMV's ticketing system".

If this was done in an attempt to evade enforcement of existing laws, then
sorry: that's a crime, folks. You aren't allowed to pen test live systems!

~~~
sloum
Why would that be a crime? Intent is irrelevant. The crime is that the DMV is
running shit code that is wrongly accusing people of crimes.

~~~
ajross
Intent is absolutely relevant in criminal law. The phrase "with the intent of"
or "for the purposes of" appears everywhere in the field. Go browse through
the quoted text of the CFAA here and see what you can find:
[https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act](https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act)

I'm not interested in getting involved in a philosophical discussion about
whether anarchic hacking "should" be a crime. I'm saying that given the text
of that article, an enterprising prosecutor could probably get a conviction
for one.

Don't fuck with other people's systems. Even (and especially) when they're
running shit code.

------
natch
This post has way too much traction to flag now but I wish we didn’t have
sites like this that take a bit of admittedly interesting content from
elsewhere and repost it with an infinite scroll of spammy ads.

Seems to be a clever technique here too, ending the article with what seems
like a non-ending, so the user will keep scrolling.

If I remembered where the original content was I’d post it, or had a
desktop/laptop browser to search with right now, I’d post a link, but I don’t.
I just remember having read a much better article about this in the past.

------
DJBunnies
Stan, are you in here?

My buddy Stan registered for null@verizon.com back in the early 2000s so you
could link sms to email delivery. Wound up with so. many. text messages.
Reminders to take medicine, personal convos, sports results, everything.

Was great fun to read while waiting for class.

------
dpcan
Similarly I used to wonder how awful it would have been to own example.com ...
until I found out it was an IANA special-use domain.

But someone still owns test.com, and I can't imagine what that mail server
goes through.

~~~
pugworthy
Not unlike whoever gets all the email at foo@bar.com

------
otterley
Source article: [https://mashable.com/article/dmv-vanity-license-plate-def-
co...](https://mashable.com/article/dmv-vanity-license-plate-def-con-
backfire/)

------
ChuckMcM
Similarly don't get 'none', 'no plate', or 'na' :-)

It would be cool if you could do punctuation so you cloud get "'; drop table;"
alas little Bobby Droptables will likely never get that plate. :-)

I did see a plate "I<heart>0X45" which was a cute nerd joke, I expect that
would be more difficult to get these days.

------
_bxg1
I recently bought a *.ninja domain name and started using it for my personal
email address. Probably 20% of the time, when I try to sign up for a service
it gets rejected by web forms that have been hardcoded to check for
traditional top-level domains.

~~~
repolfx
Oh you think that's bad? My email address ends in that most exotic of domains,
.net

I find websites that won't accept it because they think it's an invalid
address all the time. I have no idea what logic they're using, would love to
find out.

~~~
im3w1l
Interesting. I have a country topdomain email and never had problems.

------
27182818284
If I recall correctly, this comes up a lot with null.com too with respect to
emails, etc. I think there was even an HN post about all the null@null.com
emails collected by someone.

------
logicallee
Let's talk about one specific thing from the article:

>Things started to go awry when he first registered the tags. He tried typing
in his license plate but the DMV website wouldn't accept it.

Let's talk about the fact that the DMV website wouldn't accept it. Do you
think this is all right behavior on the part of the DMV website?

It's really interesting because if you're coding up the DMV web site, it makes
sense to disallow NULL just as a preventative measure, like not allowing '\--
in a query (to prevent SQL injection attacks.)

I would generally think that on the whole you should accept -- as a substring
in a password. But is it wrong programming if you don't allow that substring?

Disallowing it could cause someone's chosen password to fail, so they have to
change it for you to accept the password they want, but if you know for sure
that you use sql as part of processing passwords you might well decide that it
is acceptable to make people have to try a new password before you'll accept
theirs, in case you are not confident that you are escaping everything
correctly.

So from my end it seems okay to do something like disallow NULL.

If you consider the choice of the programmer on DMV's web site, what do you
think about their choice to reject this input, even though in fact it turned
out to be legitimate? Is it acceptable programming practice?

~~~
dylz
I don't believe this is acceptable. By any modern sane best practice, the word
NULL in a string from a web form (where your input is basically by definition
a string) is a string like any other

Blocking -- in a string does not prevent SQL injection attacks. Using proper
parameterised queries does. This might sound mildly hostile but "you are not
confident that you are escaping everything correctly" \- when this is a well
defined and solved problem - means you should not be building this application
as you're too incompetent to. For the millions of taxpayer money wasted on
this kind of thing, it is absurd.

Blacklisting keywords used in XSS is also completely futile, pointless,
useless, and does nothing but piss off users that can no longer use anything
containing the word log or window or whatever.

------
antisemiotic
Bobby Tables started school in 2007, so he'd be around 17 today, seems about
right.

------
lordnacho
That's a bit curious though. If the code relies on a magic value, you'd think
it's in order to skip trying to get data it doesn't have, like the address of
the unidentifiable cars.

Even if NULL then does have this address attached, why does it take the branch
where it looks for the data?

I suppose it would be in a relational DB, perhaps there's a join that drops
missing entries, but if they aren't missing they show up?

~~~
delinka
The code doesn't rely on a magic value, the humans have decided that an empty
value will be typed, by hand, into their terminals as the characters "NULL".

The problem is that the employees with access to the system are required to
enter a 'valid' value. But in some cases there is no value. So the 'valid'
value they've come up with is the string "NULL" \- they can't use "~~NULL~~"
because ~ isn't allowed on a license plate. So because A) anyone can request a
valid value on a plate, and B) nonce values must also be "valid" within the
system, the tax payer is capable of ordering a nonce value on a plate.

~~~
rory096
>the humans have decided that an empty value will be typed, by hand, into
their terminals as the characters "NULL"

Almost certainly because of software constraints, like the form not allowing
the plate number field to be blank.

~~~
delinka
Yeah, I addressed that:

>employees with access to the system are required to enter a 'valid' value.

~~~
rory096
... did you edit that second line in after the fact, or am I losing it?

~~~
delinka
I did not edit that in. Sorry.

------
mkagenius
I bricked my profile page on Zomato, There is(was) a feature where you can
choose a custom URL for your profile page, I chose something which already was
a valid URL for them. Now when i click on "my profile", it goes to
"[https://www.zomato.com/genjs"](https://www.zomato.com/genjs") . I can't edit
anything in my profile now.

------
SteveNuts
Seems like a brilliant idea to me, hopefully it forces them to fix their
shitty software. I would chip in to crowdfund this guy's battle for sure.

------
SeanLuke
Danny White, a resident of Washington, DC, had a similar problem: his vanity
license plate read "NO TAGS", which happens to be what police there put down
in the license plate slot for missing plates.

[https://www.google.com/search?client=firefox-
b-d&q=danny+whi...](https://www.google.com/search?client=firefox-
b-d&q=danny+white+no+tags)

------
exfed
This kind of thing makes me question how tightly we couple (or fail to couple)
the "code of Law" to the "code of Computers".

------
muglug
The same issue is seen on social networks that identify users by their
usernames: - before it was suspended, twitter.com/null had just 2 tweets, but
over 70K followers: [http://archive.is/Dt6af](http://archive.is/Dt6af).

------
dulvac
I have a friend who told me his story enrolling in his university. He's a
German national who grew up in Spain. I'm going to call him Andres Schmidt, as
the actual name is not relevant.

In Spain, people normally have two surnames, one from the mother and one from
the father (no, it doesn't exponentially grow with generations :D). He had
issues enrolling in uni, as the system required two surnames so he ended up
with "Andres Schmidt Schmidt". He had issues down the road as well, having to
explain himself every time he needed to register for something. I think the
student id was also a hash which included the name and he hadn't been
consistent with his "full" name in all systems.

------
astura
See also, the person who had the personalized license plate "NO PLATE" (and
similar).

[https://www.snopes.com/fact-check/licensed-to-
bill/](https://www.snopes.com/fact-check/licensed-to-bill/)

------
atsushin
Moral of the story: Test at your own risk!

At least his story brings to light the poor quality of software the DMV is
using.

I'm curious about the other, unintended consequences of naming things null in
other web applications; maybe its time to explore ...

------
Causality1
The interesting question this article poses is whether there's a system in
place for the government to revoke vanity plates it's already approved. Can
they force him to change the plate?

~~~
Aloha
They usually can, and various states have before.

~~~
sokoloff
My favorite such revocation: [https://jalopnik.com/virginia-dmv-revokes-
worlds-greatest-li...](https://jalopnik.com/virginia-dmv-revokes-worlds-
greatest-license-plate-5724684) (Virginia's "EATTHE" Children First plate)

I think they should have been allowed to keep it, frankly.

------
ancarda
I never understand how these sorts of bugs happen - is the database something
like:

    
    
        plate VARCHAR(8) NOT NULL DEFAULT "NULL"
    

Or rather the type is actually Option<String>:

    
    
        plate VARCHAR(8) NULL DEFAULT NULL
    

In which case, how is it the software can't tell the difference between
Some("NULL") and None()?

The only thing I can think of is the software (or it's database driver)
handles everything in strings; so None() and Some("NULL") both get converted
to "NULL"?

~~~
mdorazio
Based on the description in the article, it's a separate system that is
actually entering "NULL" in the license plate string field, probably for
things like red light camera violations. Chances are it's a human doing this
according to a procedure or the system is setup to require entry of some text
in the field, so they have to enter something and opted for "NULL" if the
actual plate is unreadable / unreliable / not present. This is unfortunately
how a lot of things in the real world work, especially on legacy systems.

------
tathougies
It would seem to me that issuing frivolous citations to a man who has not
actually broken the law is a violation of the general prohibition against
unreasonable fines and punishment.

------
droogie1xp
For those interested, you can find the slides for the presentation here:
[https://media.defcon.org/DEF%20CON%2027/DEF%20CON%2027%20pre...](https://media.defcon.org/DEF%20CON%2027/DEF%20CON%2027%20presentations/DEFCON-27-droogie-
go-null-yourself.pdf)

This article is garbage and a lot of the discussion here revolves around the
spin and emphasis on facetious scenarios I mentioned in the presentation

------
rafaelvasco
I don't know how being able to put any random word in the plate can even work.
Always found it funny in movies and thought it was a joke.

------
peter303
Do any states allow emojis on plates. I saw a red heart recently. ButI don't
know if that was the license number or the background.

------
raviolo
I’ve seen several combinations of B’s and 8’s - like “8B88B8”. Wonder how
effective they are at confusing plate readers.

~~~
2_listerine_pls
It would be the same as having a single 8, but I guess it's not a problem or
plate readers wouldn't be in use.

------
TomMckenny
> He refused because he didn't do anything wrong.

Cool the DMV fixed it. Just try that with so called "identity theft"

------
4ntonius8lock
Reminds me of myself: when gmail came out I got my name@gmail

The name is my 6 letter last name.

I've received thousands of emails from random people. There are so many
letter.name or number.name similar addresses that I'm constantly getting very
personal emails of other people (deaths, marriages, invoices, business
reports, etc)

------
jle17
Reminds me of a recent groceries delivery to my home. I had ordered online the
day before and had some trouble filling in the form but managed to validate it
anyway.

The delivery man called to tell me my address was incorrect. When I asked him
what was wrong, he told me it said 'Null Null Null Null'.

------
senectus1
I've got AFK plates... makes it super easy to remember :-P

A couple of cars in my city have plates like "0O00OO" or "BB88B8B"

One guy that I've seen driving near my place has two cars both with variations
of "11ll11l" Both the same make and model and color.

I really dont think this will help him much.

------
urbanslug
This wouldn't be a problem if people wrote programs in languages that have
_proper type systems_ that can correctly classify failure.

I'm thinking of types such as Maybe/Option or Either.

I hate it for example when a C/C++ function has to return a -1 in case of
failure.

------
conradfr
The Wired article is better [https://www.wired.com/story/null-license-plate-
landed-one-ha...](https://www.wired.com/story/null-license-plate-landed-one-
hacker-ticket-hell/)

------
vallismortis
Actually, it was brilliant because it pointed out how flawed the system is,
that it can be passively broken or circumvented. This could be used to
invalidate all citations that were issued from agencies using that software.

------
lgeorget
Well that's what happen when you use a special value that's actually not that
special and is part of the valid values domain.

If they had to use a string (and I doubt they had to), they could at least
have used the empty string.

------
djyaz1200
LOL! Can we have a new subcategory on HN for comic relief stuff like this! :)

------
mirimir
I rather think that it _did_ work. Or, at least, if he continues being
successful having tickets for "NULL" dropped. Because any tickets he actually
gets will be to "NULL".

------
oarabbus_
>Apparently, when they didn't have the right data for a vehicle, a privately
operated citation processing center used the word NULL in the license plate
field for many tickets.

>used the word NULL

Oh god, I feel faint.

------
gwbas1c
I would think a cease and desist, followed by a lawsuit, would clear things up
very fast.

BTW, California has a problem with issuing both plates with 0 (zero) and O
(letter) in them. They both look the same.

------
gauravphoenix
I have named my phone "Null Pointer Excpetion" whenever I connect my phone to
friend's Bluetooth they immediately scream- "oh look! null pointer excpetion!"

------
mherrmann
Is this actually possible? Aren't strings at least surrounded by quotation
marks ('NULL') while NULL isn't?

~~~
tempestn
It's not a database sanitization issue. The problem is that for cars that
don't have a plate or the plate wasn't entered for whatever reason, in some
cases people were entering "NULL" (the string). That then ended up matching
his plate.

------
foobarbecue
I once saw a parked BMW and the plates were the current day of the week and
date. I am still scratching my head over that one.

------
sharadov
update Table set LicensePlate = 'NOPLATES' where LicensePlate = 'NULL';

------
kev009
The case for stronger type systems for layman programmers in an easily
understood parable.

------
tempodox
Great idea. Any cop writing you up and any traffic cam will suffer
segmentation fault.

------
codeisawesome
That’s the closest way yet that I’ve seen Little Bobby Tables come to life :D

------
josteink
Confusing the _value_ NULL for a non-null string-sequence which says “NULL”
shows the clear sign of a system where no data can be assumed to hold any
integrity.

These bugs and categories of errors should simply not be possible in sane
languages or frameworks.

~~~
rtkwe
That's not what's happening at all please reread.

> Apparently, when they didn't have the right data for a vehicle, a privately
> operated citation processing center used the word NULL in the license plate
> field for many tickets. Since that just happens to be Droogie's license
> plate, he got all of them.

So it's 'confusing' the string NULL used incorrectly (kind of, it's fine under
the assumption that no one will have the license plate NULL but that
assumption is wrong) with the string NULL.

------
yummypaint
Sounds like it worked. He can now accrue tickets without penalty.

------
Scoundreller
There’s a lot of interesting options. How about NaN NaN?

~~~
strictfp
Or "[object Object]"

~~~
in_hindsight
Can you have brackets in license plate?

------
throwaway3627
I like my new vanity license plate:

 _DROP DATABASE;_

------
leonsmith
Stories like these and the bobby droptables xkcd are the reason I ended up
with this plate,
[https://i.imgur.com/O7KEFrn.jpg](https://i.imgur.com/O7KEFrn.jpg) It gets a
lot of compliments and attention even if most people don't know what "null" is

------
epx
Should use nullptr :P

~~~
MichaelMoser123
i guess nil wouldn't work either - it probably worked because of sql NULL
keyword.
[https://en.wikipedia.org/wiki/Null_(SQL)](https://en.wikipedia.org/wiki/Null_\(SQL\))

------
RickJWagner
Hahahaha best thing I've read all day.

------
jeffdavis
It sounds like a bright idea to me.

------
visarga
NULL strikes again, this time IRL!

~~~
dkarl
This time?

------
cryptonector
Ah yes, we call him Bobby Nulls.

------
mieseratte
Guess I should FOIA the DMV to find out what my state's default value is.

~~~
astura
These tickets were issued by a privately operated citation processing center.

~~~
mieseratte
My state doesn't allow for private companies to automatically mail you a
ticket but requires an officer pull you over and cite you.

~~~
entropicdrifter
In any state private companies' tickets don't count since they aren't issued
by an officer of the court. You can just straight up ignore red light camera
tickets.

~~~
mieseratte
> You can just straight up ignore red light camera tickets.

How does that work? They send you a ticket you're under no obligation to pay
or otherwise respond to? What's the incentive?

------
patrioticaction
So this guy doesn't have to pay parking tickets anymore right?

------
ryanseys
Play stupid games, win stupid prizes.

------
willis936
This reminds me of the bit that mentions that St. Peter has a list of
questions he asks people at the Pearly gates. Among them he asks, “Did you
have a vanity plate?”

------
listenallyall
This is clearly an entirely fake anecdote. Show me a pic and change my mind.

~~~
ceejayoz
It's been blogspammed.

There's photo evidence in the much better article at
[https://mashable.com/article/dmv-vanity-license-plate-def-
co...](https://mashable.com/article/dmv-vanity-license-plate-def-con-
backfire/) from the DEFCON talk.

~~~
listenallyall
OK, a screenshot of a list of tickets. An 8-year old could create that in
Excel. A photo of the license plate?

------
joering2
There are ways to properly sanitize inputs these days so NULL becomes "NULL"
(string), BUT also tons of systems moved into JSON format assuming its safe.
It is not. JSON is not binary safe and there are tons of unicode chars that
will break JSON. I was once overseeing system that people would bring down all
the time by registering usernames that the app could not properly sanitize and
they in return were breaking JSON format to the halt of the whole system. I
should not admit but using same chars I myself broke few youtube channels when
comments and votes were working in JSON format themselves without properly
removing unsafe char codes. Good times.

~~~
heavenlyblue
No, it’s not the JSON format that is broken - it’s the parser you use for JSON
that is broken.

~~~
joering2
Well not me. More like large vast of websites used to or still have. The
assumption was all I need is JSON and it will properly format data during
exchange.

~~~
heavenlyblue
Then you would be surprised it also doesn’t handle big integers well in
JavaScript, too!

------
dec0dedab0de
This isn't even a coding error, NULL is apparently valid license plate, and
for some reason there is a private processing center typing it in to the
government system.

First of all they are accidentally committing fraud (libel?) against this guy.
But more importantly, why is there a private processing center? Don't the
officers type this in as they fill out the ticket? or even just scan the
plates? If there aren't plates on the vehicle it should be towed or booted.
What is the point of recording tickets with no plates? Is the processing
center paid per ticket recorded?

~~~
dtech
It's not fraud or libel, it's an unavoidable problem with in-band signalling
[1].

I assume the government entry system doesn't have an explicit way to set the
data as missing, so they work around it like this.

[1] [https://en.wikipedia.org/wiki/In-
band_signaling](https://en.wikipedia.org/wiki/In-band_signaling)

~~~
voldacar
Guess they should have used the Maybe monad!

~~~
quickthrower2
They'd type in: Just "NULL"

------
tsss
Shout out to all the Python programmers from the other frontpage thread who
are responsible for bugs like this with their crappy scripting languages.

~~~
SEJeff
Crappy code can be written in any language, see all of the CVEs in C code,
even when written by experts.

As surprising as it may be, bad code is often written by bad programmers. It
doesn't matter what language you use if you write bad code.

~~~
tsss
But scripting languages make it especially easy to do so. That doesn't mean
people who use them are bad programmers. They just chose a bad tool.

~~~
SEJeff
And php makes it easier than python, but it isn't a scripting language. Your
original point is still invalid.

Alternatively, some amazing tooling has been written in these "terrible"
scripting languages. Instagram was sold for a billion dollars and was a
glorified Python Django webapp ontop of a Postgres database.

I got in a similar debate with a coworker recently over some go code he wrote.
He told me that go code didn't need full unit tests because the compiler
checked for bugs. Amusingly, he swapped the order of two int arguments in a
pull request literally an hour after our discussion. I pointed out how a unit
test would have prevented the production regression he caused, and then he
started writing tests for his changes. So yet again, scripting languages have
nothing to do with "good" or "bad" code. It is all about good vs bad
developers.

