483 comments

[ 3.4 ms ] story [ 289 ms ] thread
The interesting question this article poses is whether there's a system in place for the government to revoke vanity plates it's already approved. Can they force him to change the plate?
They just wouldn't let him renew his vehicle registration unless he changes his vanity plate or goes back to the a random number.
Ontario Canada has an anesthesiologist with a “FENTANYL” license plate.

Was funny in 1995, not so much now.

So he went to the DMV and asked them to change it, and they wanted to charge him to do that.

He’s like, no, i’m not paying.

Eventually he writes a letter to his politician saying “please revoke my license plate” and eventually he gets a letter saying they got a complaint (ie: his) and the DMV wants to revoke his plate.

But he had to wait 30 days For the appeal clock to run out, just in case he wanted to appeal his own complaint.

Kinda funny, but kinda sad that someone paid $400k+ per year by the government wasted thousands more because he didn’t want to pay the $100 plate change fee.

* some details/numbers estimated from memory.

My state has legislation about denying / revoking vanity plates and 'It inconveniences our computers' is not a valid reason.
NULL strikes again, this time IRL!
This is funny. I wonder what would happen if you could put a 'NOT ' in front of your plate number... would everyone but you get a ticket?
(comment deleted)
Nah, because it's not unsanitized SQL at fault, but people writing a literal NULL in the license plate field when there isn't one.
I wonder, what will "DROP *;" license plate do?
Nah, because it's not unsanitized SQL at fault, but people writing a literal NULL in the license plate field when there isn't one.
Nothing because it's not unsanitized SQL at fault.
Most states do not allow special characters in the plate text.
Depends on how you define "special." I've seen hearts on California tags, and I think some glyphs on Virginia tags, but I might not be remembering that correctly.
That's just part of the design. They are ignored when you type it in, etc. and you can't have ABC<heart>123 and ABC123 simultaneously existing because they're the same to the DMV.
Probably can’t do special characters, but maybe ASCII (0x23) will let you get around it.
Should be

    "; DROP *;
Lic. plates are entered into thousands of systems, so yeah it can have an effect somewhere.
Actually, I think it's doubtful the folks at the private processing facility are actually writing 'NULL', but my guess is the DB field is just not set (i.e. left as NULL), and then when the info is read out somewhere it's just printed as the string literal value.
Wouldn't their license plate be in quotes, though? 'NULL' != NULL
As my other comment points out, this is probably systems talking to systems talking to systems talking to systems to the nth degree. So even if the first system did in fact distinguish the NULL case from the string case, it only takes one system in the chain to be incapable of representing the difference to permanently and unrecoverably wreck it for all downstream systems.

What are the odds at least one system silently filters out apostrophes as invalid characters in license plate fields? Pretty good. These systems are often unattended, unmonitored processes often maintained by people who either can't fix errors upstream, or don't even want to, so these conversions are often written extremely permissively, trying to get through the data with whatever heuristics are necessary for the process to just Keep Working.

That makes perfect sense, and seems like those most likely explanation. Thanks.
I'd guess that there is a CSV step involved.
I doubt that. Normal people do not tend to use the word NULL at all.

What this usually is is the result of systems that talk to systems that talk to systems that talk to systems, all in different legacy formats never written to be interchange formats. One system has true SQL NULLs, the next system down the chain only accepts strings for that field, NULL gets written as the most sensible string, and then from that point on all downstream systems can't tell the difference between the original system having had an SQL NULL or having had the string NULL.

Did you read the article? It literally says people at a private citation outfit put NULL in the license plate field when there is no number available.
And I still expect my story is more accurate, with theirs being a reasonable expectation of what you'd get when some techie tells their manager what happened, who tells their manager, who tells the reporter.

To be clear, I'm not denying that what you say is literally true, just that by the time I'm done filtering that particular fact through my personal belief network and personal experiences, I still end up saying that my story is more likely. It's true enough that they put a "NULL" in, it's just that the way the private firm does that is most likely that the field agents leave it blank, some software somewhere puts a NULL in some database, and the report that comes out for the enforcing authority has NULL in it. For a reporter, it's not a false statement, it's just not all the technical details.

With this story, the responsibility ends up distributed in a very plausible manner I've seen many times over; HN readers could fill in a dozens of similar stories no problem. It's a problem characteristic of these sorts of systems and the way they tend to communicate with each other.

People use the word NULL and in all caps as well, in particular in bureaucratic processes like those you would encounter at the DMV.

NULL & VOID, etc.

It is entirely reasonable that the system would not accept an empty string for the plate so the process folks worked around that by instructing all employees to write NULL if they couldn't read the plate.

Many people who are not programmers per se come into contact with databases that use SQL enough that they might absorb a few random concepts or names for things.

So, some bureaucrat might in fact know "NULL" because they type a command into a database every Tuesday to run a report.

As per HN guidelines, please don't ask or insinuate that someone's not read the article, instead just quote the relevant part.
Maybe NULL is the default value if you don't enter anything
A colleague’s name is “True.” When we ran some reports to generate a check in list for an event - it was converted to either “TRUE” or “1” depending on the script.

I was amused.

Even without sql doing odd things certain strings will just cause problems.

Seems like a brilliant idea to me, hopefully it forces them to fix their shitty software. I would chip in to crowdfund this guy's battle for sure.
When I was a foolhardy college student I figured out that if the cited vehicle make on my city parking ticket didn’t match my registration, I could get appeal the ticket via a web form very easily and succeed every time.

Naturally I removed the badges from my car and put on different badges from another manufacturer. After a while they started to cite me as “other” and the trick no longer worked.

Relevant xkcd comic https://xkcd.com/1105/
In the Starcraft 2 community it is called barcoding. Basically, I 1 | l are all accepted characters for a name and I think some do look actually identical on most fonts used in the game. So yeah, one person doing that you call "barcode", 2 persons doing that, you already have deniability. Be more than 10, and that's a crowd.
Back when I used to play Ingress, that was really common. The Enlightened in Dallas had a ton of barcode names.
The new client makes it much easier to distinguish the characters, but there are still plenty of barcodes in the game.
You can reuse names in SCII, so it’s more a convention than anything else. The important bit is to have many accounts with similar names.
There was a time where call of duty ghosts was exploitable, and people could wipe/delete the accounts of anyone whose username/gamertag they knew. Streamers and pro players had to use barcode usernames to avoid getting their accounts deleted.
Google's AlphaStar StarCraft bot did just this under different accounts. Along with some other fingerprinting, many of the accounts and replays were found by the SC2 community.
To my knowledge, it played with only one account. It played exactly 50 games with every race. It was outed mainly because of two things: A very high win rate (above 80% IIRC) and the fact that as a zerg it produced units by selecting larvas directly, which no one ever does (someone explains that it uses control groups but they are hidden and dont show up in replays, I dont know how accurate it is)
this goes back at least as far as the original Unreal Tournament, I even saw a player using it in the fairly obscure Shogo: MAD multiplayer community. Never knew why it was done back then, I assumed it was just to be cute, but it did make it troublesome to mention them in ingame chats.
I actually saw a car with a license plate like this last week. Some combination of I's and 1's. White Ford Mustang driving around Santa Clara.
I've seen something similar in New Zealand. Probably wouldn't be fooling anyone given the size of the country and how distinctive the car was.
In UK number plates I and 1 are the same character, as are O and 0:

https://www.dafont.com/uk-number-plate.font?text=O0I1l

Number plates existed for decades before ASCII was invented. Before computers, people often used mechanical typewriters which didn't have keys for 0 and 1: you typed 0 as O and 1 as l. I threw away one such typewriter recently. It was in good working condition, with its instruction manual. It had been made in a country that no longer exists. You may imagine how sad and nostalgic I felt.

Saw a similar one on the road in front of me with a combination of N's, M's and I think a W ... man it was impossible to get straight while moving.
All we had to do was register our cars in each others names. When I was married, my car was registered to her and vice versa. The redlight/photoradar laws in my state required that the company operating the devices had to match the pic of the driver violating the law, to the pic of the registered owner via the license plate. If they couldn't match them, no ticket was issued as you can't prove who was driving. That's probably changed now that a lot of DMV's are doing facial scans with datapoints. They probably just scan the whole DMV DB now to find the driver. Wear a mask.
Is it true that in England, the person sitting next to the driver IS the driver?

:)

It is true in Norway if someone is practice driving; the grown up in the passenger seat is the driver.
I took my motorcycle driving test with my licensed driver and the examiner following in the car behind me.
Only if your last name is Bucket.
LOL totally got that joke. Made my day, thanks!
Where i am from the ticket is issued to the vehicle owner, doesn't matter who was driving. On the plus side it means that you can get a photoradar ticket for driving 300km/h and not lose your licence, just pay the fine.

P.S. If the driver must be recognized does it mean that motorcyclists are exempt from photoradar fines?

I thought that motorcycles already didn't really show up on the photoradar scanners. That's the way it is here, but I can totally see that being a jurisdiction by jurisdiction thing.
Here it is easier to avoid getting a photo with motorcycle because there are places where it targets front plate. If photoradar targets back plate then you will get a ticket for a motorcycle just like any car.
It really depends. The newer traffic control bridges we have on our highways take a picture from both the front and back.
At least here in Finland, the cameras take pictures of speeding motorcycles, but they are not used. No front license plate.
Here I think you are asked to directly wire transfer the penalty amount or you can challenge the ticket, then you will be heard as a witness for who drove the car. If you refuse to tell that or don't know, the judge can order you to keep a log of all joruneys of your car that can be inspected for finding the culprit of a future offense.
Or use Juggolo face paint.
Here in AZ, they'll lookup and assume the spouse. Of course, they're also required to serve the ticket in person.
In the UK we fixed this by making it a legal requirement for the owner of the car to identify the driver (obviously unless there's a valid reason you can't, such as it being stolen).

Two MPs have actually been caught out by this law, convicted of perverting the course of justice and sent to prison:

- https://en.wikipedia.org/wiki/Fiona_Onasanya

- https://en.wikipedia.org/wiki/Chris_Huhne

> On 3 February 2012, Huhne resigned from the Cabinet when he was charged with perverting the course of justice over a 2003 speeding case. His wife at the time, Vicky Pryce, had claimed that she was driving the car, and accepted the licence penalty points on his behalf so that he could avoid being banned from driving. Huhne denied the charge until the trial began on 4 February 2013 when he changed his plea to guilty, resigned as a member of parliament, and left the Privy Council.[7][8][9] He and Pryce were sentenced at Southwark Crown Court on 11 March to eight months in prison for perverting the course of justice.

Going to prison for lying about speeding 10 years ago seems insane. Did they punish these MPs especially heavily just to make a point?

He didn't get sent to prison for speeding. He got sent to prison for having the audacity to think he could pull a fast one on them and the balls to actually try.
Generally the courts punish "crimes against justice" such as perjury very harshly as it is seen as an attack on the rule of law itself, something much more valuable than any amount of money. When I was a juror they made it clear that if we got caught talking about the case or did any independent research, we could and would be going to prison.
So, you were just running red lights, and you think this is a hack worth bragging about?
Typically, like they did here, they also lower the yellow light duration when they install these devices, causing more people to "run red lights" and collect $$$ for the jurisdiction. For nothing. This was proven in my state. Accidents have also gone up in these areas because now when the light turns yellow people have been trained to know they don't have enough time to make it through traveling at a normal speed, so they gun it to make it though. If you think I purposefully speed and use this to avoid red lights, you're assuming too much. I don't feel bad one bit circumventing a rigged system.

Edit: https://www.motorists.org/issues/red-light-cameras/yellow-li...

I knew a kid in college who would get a ticket, and then look around the parking lot for another Black Nissan Maxima. Most people don't actually look at the plate number, just the make model. I think he got one ticket paid this way ... guy was kinda an asshole.
Someone tried that on me on campus but I noticed. I wasn’t supposed to be parked there either and was skating by on a technicality that worked as long as no one looked too closely into it. Otherwise I’d have called security and made his life uncomfortable for awhile. As far as I’m concerned, it’s fraud.
I've had a friend do the reverse: parking in illegal spot, and borrowing a ticket from another car that already received one. Upon return some hours later, he returned the ticket to the correct windshield.

Quite brazen, and frankly a bit of an asshole thing to do.

(comment deleted)
Also pure genius. The worst kind, but hey! Gotta credit where some is due.
But what did he do if the other car had already left when he returned? It's much more than a bit of an asshole thing to do.
That, or received a second ticket. It all went to the plan that time, at least.
Creative... I've not done it, but it seems if I get a really good scan of a ticket, put my info on it, and use it as needed, they don't have a record of it. So I'd never get a fine.
Around my area they almost always open existing tickets to check for the time/date. In addition many parking enforcement people patrol the same area all day and remember whether or not they already ticketed that vehicle.
I did this once, too. YMMV based on meter maids in your city;

My own unpaid ticket from weeks ago should become an asset. protect my car from violations with cast Invisibility.

I put the decoy on windshield, under the wiper blade, and wandered off for a bit.

But this upset the coin gods. When I went to my car an hour later, neatly tucked above my original ticket was a fresh new one. Balls.

Maybe using 2 old tickets will work. :)

I’ve seen a parked car with 3+ tickets on the windshied (didn’t count but there was a small stack of them) in Austria. Had a foreign license plate though so probably just didn’t care and wasn’t gonna pay.
I really enjoyed my parkingservices@ email address at my university. Took them many years to catch up and take that alias away.
Guess I should FOIA the DMV to find out what my state's default value is.
These tickets were issued by a privately operated citation processing center.
My state doesn't allow for private companies to automatically mail you a ticket but requires an officer pull you over and cite you.
In any state private companies' tickets don't count since they aren't issued by an officer of the court. You can just straight up ignore red light camera tickets.
> You can just straight up ignore red light camera tickets.

How does that work? They send you a ticket you're under no obligation to pay or otherwise respond to? What's the incentive?

Related, for those who missed it the last time it was here on HN, the tales of Christopher Null, who has an unfortunate surname: https://www.wired.com/2015/11/null/ , and Jennifer Null , http://www.bbc.com/future/story/20160325-the-names-that-brea... , likewise.
Much-needed Outline.com of the wired.com article: https://outline.com/WMzjYK
It seems meaningful to me that the wired website works (sort of; the left margin is 1/3 of my screen) with JavaScript disabled, and outline doesn't work at all.
If there were a better alternative I'd gladly use it.
I love when people double down out of principle, when the only person getting hurt is themselves.

He refuses to change it because he did nothing wrong...sure, but you are also the only one being hurt by it. Is this really the hill to die on?

Die on?

But how - he can challenge the fines in a court of law. Since it's a vanity plate, adding an extra notoriety won't hurt.

Court isn't cheap.

You're paying for it with a lawyer or with your own time

> Droogie contacted the DMV who told him to change his plate. He refused because he didn't do anything wrong. While they wiped the fines off his record, unfortunately for him, they didn't fix the problem in the system so once again, Droogie has accrued another $6,000 in tickets that he had nothing to do with. He says he won't be paying those either.

Except he just contacted the DMV. No lawyers necessary.

Knowing the California DMV, that contact probably took at least two hours.
Number of years ago I was frustrated because they never sent me my renewed card and it turned out they never updated my address even though I did the paperwork. Took it to twitter and tagged @CA_DMV and they responded pretty quickly and took care of it. Got my new card pretty much next day.
Really I'm surprised they didn't just add NULL to the list of banned words and ban/refuse to renew the tag which seems eminently within their powers.
Perhaps they did and the renewal system just assumed that banned word was missing and silently skipped it.
... and then the second half of the parent's sentence (which you conveniently ignored) applies: he's paying with his own time.

I dunno about you, but I value my time way too highly to voluntarily use it to spend time on the phone with the DMV every month or three.

Yeah, we're on Hackernews so I assume most people on here make at least 50+ an hour. The CA DMV will cost $200+ at least.
> Court isn't cheap.

> You're paying for it with a lawyer or with your own time

At some point surely you can countersue for harassment?

For the first time or two, maybe. But you'll be paying for it with hours, possibly tens of hours, of your own free time. And the US legal system is a fickle beast; what seems to you like a slam dunk might not actually be so certain.

After the second or third time, the judge will ask, "why didn't you just change your license plate to something else and avoid all this hassle?" And when you answer, "I've grown fond of the plate, and want the DMV to fix its systems", the judge will sigh, and rule against you for wasting his/her time instead of just changing your license plate.

What do you mean "after the second or third time"?

Are you suggesting that if this person were to sue for the repeated harassment and presumably prevail (with some kind of damages attached) that the behavior would persist?

I can image something more fun to do with my free time than sitting in court every few weeks...
On top of that, if anything, forcing the government to fix it's bad code (insert snarky ambiguity between software code and legal code) can't be a bad thing. I'd buy the guy a beer.
Except they won't fix it, and he will have to keep filing protests
The problem is it's a "a privately operated citation processing center" that's causing the problem. They might even be instructed to hand-enter a NULL for these cases.

I'm don't really see an incentive for the govt agency to do anything about it. It's no skin off their nose. They'll just keep sending the tickets.

At some point, can you not file some kind of harassment lawsuit? Is it legal to continue to send someone bills for which they aren't liable?
Don't you have some kind of illegal prosecution laws? In my home country people could go to jail for that.
(comment deleted)
That's assuming it's an error in their code.

For all you know, they have a list of too-clever license plates (null, no plate, etc), and they purposefully divvy up the no plate tickets among them.

"hand-enter a NULL for these cases" <-- should be a reserved word then.
> "a privately operated citation processing center"

In a way, this is the real bug - one that affects more areas of local government than most people know or understand.

Our local governments are constantly seeking - and usually getting - private companies to do what should be public. The potential (and actual) repercussions to the system are serious.

For instance, how do such arrangement affect FOIA requests? What about other forms of transparency? Are we really getting our money's worth as taxpayers? Is the money actually being used properly or are costs being inflated?

It's a form of government privatization "by a thousand cuts" - we already know of the problems inherent in the system of privatizing out and contracting of private prisons; plus the loop they cause because of recidivism rates, because a repeat "customer" is better for the bottom line than one reformed for society. Which may be better for the private company, but has huge costs to society itself.

I wouldn't doubt that similar issues are happening with the privatization of other parts of our local government. It is sickening to me, personally.

I'm pretty sure the government will continue to just waste money processing his appeals instead of making an effort to fix the system.

So in reality, this guy is indirectly wasting taxpayer money. Sure, the government is wrong in not fixing it, but knowing that the government won't fix it, but continuing to behave this way, is his fault.

Figure of speech... I just mean he is making a stand for something not that important but causes him (and only him, really) inconvenience
Maybe this particular bug inconveniences only him, but it exposed an improper practice that in general could have affected others too.
I know what "die on" is - it's just inappropriate in the context: nothing bad has actually happened to him.
You obviously still don’t know what the phrase “choosing to die on a hill” means.
Yeah, just b/c he is stubborn enough and doesn't wish to give up his vanity plate instead of folding. Pretty much nothing that hard/uphill battle has happened to him.
There are two options: die on the hill, or retreat. He is not retreating. Therefore he has chosen to die on the hill.
Those would be the options if there was an attack against him, but there's not any attack against him. Wrongly addressed tickets are hardly even a minor inconvenience. I think that's what the parent is saying.
> Wrongly addressed tickets are hardly even a minor inconvenience.

Now I wonder what you would consider a minor inconvenience. "Oh yeah that time they suspended my licence that was a minor inconvenience for me."

Wrongly addressed tickets are a real hassle. I'd assume that if you don't contest them in time, you have to pay them. And if you don't pay them, they will suspend your licence. (I don't really know. But I assume that's what would happen.)

You can be arrested for driving on a suspended license, and it can be either a misdemeanor or a felony.
It's a figure of speech; when used colloquially in this manner, it has nothing to do with any kind of attack.

It just means "argue a point on principle when you know you aren't going to affect change".

It's a figure of speech which means to argue on a point of principle without regard to the cost when you know you aren't going to affect change. It absolutely doesn't make sense in the context where there's no attack. Otherwise how does the dying come into play in the analogy?
(comment deleted)
>he can challenge the fines in a court of law.

If he sees spending time and effort expunging his record every few weeks as worth the trade-off for the 'extra notoriety', then power to him. I wouldn't do that.

I'd presume - the court decision may force the agency to fix their code.
He can challenge the fines but still has to pay court costs most likely.
But it does actually work! He can never get any tickets. If he does he'll just claim it was a false one.
Exactly! All he has to do is collect all the notices and deal with them every few months. Not to say there aren't other implications that might be more troublesome :P
“It made my tickets free (if my time is worth nothing)!”
Yeah he ends up paying all those tickets with his time though. And time is more valuable than money for a lot of people...
After the second go round or so he'll have a form letter. After the 4th or 5th time the DMV people will recognize it when it arrives. If it goes on long enough eventually all the employees will be aware of this edge case and he can probably appeal legitimate tickets.
Sure he did nothing wrong because it backfired like one of Wile E. Coyote's schemes but the article makes it clear he was hoping to confuse automatic ticketing systems. He was trying to get out of tickets. Sure he didn't break the letter of the law but he tried to break the spirit of the law and it bit him. Some might call that karma, I think he needs a better hobby than standing in line at the DMV which is ultimately what he has taken up. I wonder how long he'll keep going.
AKA he was attempting to commit fraud or rather obstruct justice. I don't particularly feel sorry for him.
It reminds me of the guy who owns nissan.com, who probably blew his life savings on lawyers defending himself from Nissan Motors lawyers for decades.
I wonder how much you could sell that to them for if you were really good at negotiating. Maybe as much as $100k?
Multiply that by a thousand or more if they had already accrued $10 million in "damages" by 1999 as they claimed. Apparently it would be extremely valuable to them.
Nissan treated that man very badly. I never owned a Nissan car, and never would because of this.

His family name was Nissan, and he registered the domain when Nissan still called itself "Datsun" in the U.S.A.

Yeah, pick your battles.

Sure, it would be nice if the systems where patched. But maybe he should just get a job at the DMVs IT department instead :)

In the end I would probably rather pay the fines than fix this bug, it's probably a lot of horrible systems barely held together..

> But maybe he should just get a job at the DMVs IT department instead :)

Ew.

The DMV made a mistake, they know it, and they aren't fixing it. In this case, the problem is relatively inconsequential but it is an institutional failure. The DMV is a government agency which is, at least in theory, somewhat indirectly accountable to the people. Which means that if they're treating one particular citizen unfairly, one option that citizen has is publicly shaming them. (Another option is to file a lawsuit. That's more work, though.)

As I see it, this person is performing a public service by not budging on this. It's nowhere near on the same level as Rosa Parks not going to the back of the bus, but sometimes we need people to not simply go with the flow because it's the easiest thing to do.

But they're only performing a public service if it gets fixed -- which there's no indication in the article is happening.

And frankly, why would it? Different government agencies likely have zero reason to cooperate on it. Especially if, say, the DMV is responsible for the error, but the courts are the ones dealing with the cost.

So unless this guy has a reason to think it will get fixed because of him... he's just wasting his time, no?

Considering that the DMV in most places already has a lot of shame heaped on it, I doubt this extra spoonful meaningfully moves the needle.

This guy is really just wasting his own time for no actual benefit to anyone. If he genuinely enjoys it, then sure, I guess each to their own, but if not...

This kind of thing makes me question how tightly we couple (or fail to couple) the "code of Law" to the "code of Computers".
Shout out to all the Python programmers from the other frontpage thread who are responsible for bugs like this with their crappy scripting languages.
If you want to throw darts at someone, I think database systems with three-valued logic would be a better target. This criticism (not for these reasons) has been leveled...
Crappy code can be written in any language, see all of the CVEs in C code, even when written by experts.

As surprising as it may be, bad code is often written by bad programmers. It doesn't matter what language you use if you write bad code.

But scripting languages make it especially easy to do so. That doesn't mean people who use them are bad programmers. They just chose a bad tool.
And php makes it easier than python, but it isn't a scripting language. Your original point is still invalid.

Alternatively, some amazing tooling has been written in these "terrible" scripting languages. Instagram was sold for a billion dollars and was a glorified Python Django webapp ontop of a Postgres database.

I got in a similar debate with a coworker recently over some go code he wrote. He told me that go code didn't need full unit tests because the compiler checked for bugs. Amusingly, he swapped the order of two int arguments in a pull request literally an hour after our discussion. I pointed out how a unit test would have prevented the production regression he caused, and then he started writing tests for his changes. So yet again, scripting languages have nothing to do with "good" or "bad" code. It is all about good vs bad developers.

Well - Python doesn’t use NULL, to be clear.
In the other notorious scripting language JavaScript it's also spelled

    null
Which makes for a bit of funny because

    NULL is not defined
Ignoring the lack of 'NULL' in Python for a moment, this wasn't even an issue with the code lacking an invalid input. If you read the article, you might have realized that.
I think if you want to blame scripting languages, you need a license plate that says "None" or "undefined".

What happened in this case was that people used the literal value "NULL" to mean "I don't know". They could have used the word "LOLCAT" and the effect would have been the same. Overuse of in-band signalling is a general design flaw not specific to any programming language. (Remember when people would whistle a 2600Hz tone to make free phone calls? Same thing as this.)

It sounds like a bright idea to me.
>Apparently, when they didn't have the right data for a vehicle, a privately operated citation processing center used the word NULL in the license plate field for many tickets.

>used the word NULL

Oh god, I feel faint.

There was a similar issue in California where, in the days before on-line choosing of vanity plates, you would give three choices. One guy couldn't come up with a third option so he wrote "NO PLATE" and ended up with that as his plate with similar results. Snopes has the story:

https://www.snopes.com/fact-check/licensed-to-bill/

If I recall correctly, this comes up a lot with null.com too with respect to emails, etc. I think there was even an HN post about all the null@null.com emails collected by someone.
This reminds me of the bit that mentions that St. Peter has a list of questions he asks people at the Pearly gates. Among them he asks, “Did you have a vanity plate?”
There are ways to properly sanitize inputs these days so NULL becomes "NULL" (string), BUT also tons of systems moved into JSON format assuming its safe. It is not. JSON is not binary safe and there are tons of unicode chars that will break JSON. I was once overseeing system that people would bring down all the time by registering usernames that the app could not properly sanitize and they in return were breaking JSON format to the halt of the whole system. I should not admit but using same chars I myself broke few youtube channels when comments and votes were working in JSON format themselves without properly removing unsafe char codes. Good times.
No, it’s not the JSON format that is broken - it’s the parser you use for JSON that is broken.
Well not me. More like large vast of websites used to or still have. The assumption was all I need is JSON and it will properly format data during exchange.
Then you would be surprised it also doesn’t handle big integers well in JavaScript, too!
Play stupid games, win stupid prizes.
I have a family member who's license plate started with "&". The DMV accepts it, plates were ordered online fine, but police systems can't handle it apparently, to my family members ultimate discomfort. I commonly joke it probably gets the individual out of automated tickers for speeding and red lights, but when an officer pulls them over we sometimes need to explain that the "&" is dropped in the system (or so we've been told) and that seems to clear up issues
Any word on whether the plate without the preceding '&' is in circulation? I'd be curious if your records in the police systems would be merged with the records of the owner of that plate.
The rules for california are the special symbols (which don't include &) are non-significant. Everything but the plate itself ignores them. Washington doesn't have special symbols, but does have an optional dash, which is also not significant.
I guess it doesn't happen a lot, but they'd have a crazy time if they had to deal with Arabic license plates..
I sometimes see California tags with a heart character in them. Does anyone know if those considered part of the number, or are they just ignored as decoration?
I recall the heart and plus symbols are being ignored in the system.
Looks like you can't have the character '&' on a personalized license plate in WA: https://fortress.wa.gov/dol/extdriveses/NoLogon/_/
I had a standard 8-digit Indiana TK series truck plate which would get flagged as "unregistered" by the broken ALPR systems in other states.
In Washington State, you can register period-correct plates for your car. The problem is that you can't register the actual digits that are printed on the plate. The cops and cameras can't pull up your information, and you get stopped and questioned all the time. Explaining how the plates work to the Police gets pretty tiring.
Well, in their credit, they're the ones whose system won't go down from an XSS payload on a plate.
There’s a lot of interesting options. How about NaN NaN?
This isn't an issue with the program lacking a valid input. The 'NULL' was hardcoded as a default value by a private processing company. (See the third paragraph in the article.)
Bobby Tables started school in 2007, so he'd be around 17 today, seems about right.
LOL! Can we have a new subcategory on HN for comic relief stuff like this! :)
I read years ago in comp.risks about a similar story. A guy in 1979(!) requested a personalized plate "SAILING", with second choice "BOATING". He didn't want a customized plate if he couldn't get those, so for his third choice he put down "NO PLATE". Of course, he ended up with "NO PLATE". He ended up getting 2500 parking tickets, since cars with no plate had "NO PLATE" written on the ticket.

References: http://www.mekabay.com/overviews/risks/risks03_1986_06-04-19...

https://www.snopes.com/fact-check/licensed-to-bill/

I remember a different story where the guy had to fight every ticket in court
On the plus side, he could also contest legitimate tickets unless they recorded other information.
I managed to do this at my university. I had vanity plates with a design made by my local Australia shire, which had the shire emblem between two parts of the plate. The plate was something like "123ABC" but I'm guessing emblem read as an O, so their scanners saw "123OABC", which was not a plate registered with the uni.

Each day there was a 10-20% chance I would get a ticket on my windshield. I would collect them and take them to the uni security office once a fortnite to have them cancelled in bulk. I actually got pretty friendly with some of the staff there.

At least 4 of them were legitimate tickets because I parked overtime, over a line, etc, but the staff cancelled them anyway (:

(comment deleted)
Like Make, Model, Color, and VIN? The last time I got a parking ticket it certainly included those details in the citation. I can imagine being able to contest and win any citations issued to the same plate but with otherwise non-matching supporting information. But in the case where someone else has the same make, model, and color car, you might be out of luck if the VIN gets recorded as "CANNOT READ" or is left blank.
It has happened multiple times.

NULL, NV, XXX, MISSING, NO PLATE

I wonder if the system is also vulnerable to SQL injection via vanity plates.
I think this is unlikely since plates are alphanumeric. Although I suppose if you faked an image of a plate it's possible you could cause problems for a plate scanner.
[1');DROP TABLE tickets; --]

(Damn. Way too many letters...)

);Drop *

GREETINGS FROM HELL

There was someone who not too long ago fixed an SQL injecction to his front bumper and it managed to break the automated toll collection system.
I saw a car with that specific plate a year or two ago.

It seemed like it might work like humor in the TSA line.

Fine as long as you have extra time on your hands.

I wonder if it has even been towed/impounded?

> Fine as long as you have extra time on your hands.

And of course, in programmer humour, this translates to "while you're not busy with anything else, issue a fine." :)

Which, ironically, is what actually happens.
This reminds me about my own name. Everyone always gets it wrong (including people from where I am from). Except the Dutch. They always get it right, every single time!

There was also a meme about a person that wrote on her ID application "note the hat on the 'e'" and of course her name was Sarah Note The Hat On The E on the issued ID.

EDIT: Yes her name was not Sarah and there is no 'e' in Sarah.

I once had a product owner for a student/university web app who complained that for a particular user, their lastname was displayed as 'None'.

This was a Python project and the product owner apparently already had learned 'None' equals NULL.

I dug into the file which we used to import the users from and discovered the user's lastname actually was 'None'.

Maybe it could be added to the list of falsehoods programmers believe about names: https://shinesolutions.com/2018/01/08/falsehoods-programmers...
Now, was it a case of number 20 and they were required to enter something, or was it actually legally None?

https://www.houseofnames.com/none-family-crest

Maybe the case. However, this was an international student org and the student was from Africa.

We assumed it was correct and did not dig to the bottom.

Whatever the truth was, I could close the ticket.

I think this example falls under falsehood 31, where None would be considered a "bad word" that can't appear in names.
That describes making some "bad" values illegal, where I believe the problem here was that they didn't expect the value.
There was a manager i worked with whose last name was "Null". She complained that every few months her account would get wiped from the HR system.