Hacker News Reader

According to their Twitter it’s still ongoing: https://twitter.com/droogie1xp/status/1471653205733871619

Doesn't seem that hard to fix. I'm surprised they don't consider it a security-type issue.

Sounds a lot like 'undefined behaviour', certainly unexpected at least.

I guess somewhere along the line a passed 'null' value is getting converted to a string for plate lookup.

How is this unexpected? Anytime a plate number is missing in the database it’ll match to him.

That's not what's happening, the article mentioned it was when the submitted report didn't have a license field at all, so it perhaps is comparing null to null on the lookup.

Personally I would've thought the lookup would be an empty string. Hopefully little bobby tables doesn't get caught speeding.

More discussion here in 2019:

https://news.ycombinator.com/item?id=20676904 (471 comments)

The 'NULL' License Plate (2019)