Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

In 2014, a Polish driver modified their license plate to also contain an SQL injection in effort to thwart speed cameras: https://hackaday.com/2014/04/04/sql-injection-fools-speed-tr...


EVERY Polish driver (without intending to) possibly exploited lack of type checking in an Irish national crime database:

https://en.wikipedia.org/wiki/Driving_licence_in_Poland#Mist...


The Ignobel prize in literature the police got awarded was a nice touch.

I still wonder how their DB was set up to accept this data in the first place. It makes sense to allow a person to be associated with multiple addresses - people move, sometimes a lot - but a person should not under any circumstances have multiple DoBs, should it?

(Unless I missed "Falsehoods programmers believe about personal data: People are born only once" or something)


Well, here is a story I heard (central Europe).

Parents did not want the baby, so they left it at the door step, date of birth was not known, so some was assigned and used in some legal documents. Later, original parents changed their minds, real date of birth became known.

(For sanity sake, I would just say choose one or flip a coin and be done with it, but at the same time I could imagine that some layer could take my sanity into account)


A person can't, but there can be multiple people with the exact same name, with different birthdays (or even the same!) so DoB isn't guarantee to be unique without some other identifier.


Ah, that makes sense. So the DB likely assigned the incidents to multiple different persons with the same name and not a single person.


The DoB may change (per law, not the real), for example refugees without travel documents often get assigned Jan 01.



I'm sorry, but PULSE (Police Using Leading Systems Effectively) is the stupidest name for a "computer system" I've ever seen.


A 'backronym' if ever there was one.


Fun read but not sure it can be attributed to type checking or the lack thereof


What type checking would you add to your database schema to prevent this?


I don't think this can be prevented with a schema. The only thing someone has to do is legally rename themselves to "Driving license" to be the edge case in this check. Teach cops to look for the (almost) international driver license format where your names are preceeded by the numbers 1 and 2 on the license.


One thing (that was done in 2013) would be to standardize the format of the card, so that name is in the same place no matter which (EEA) country it's from.

https://en.wikipedia.org/wiki/European_driving_licence

The other thing is to list out the field names in all 27/30/33 languages and flag those for double checking. Theres probably few people named "drivers license". Finally, just take a photo of the whole ID so even if the wrong value is entered initially, the right value can be recovered later as necessary.

None of that is foolproof, but it doesn't have to be 100% foolproof, just not totally broken.


That's an administrative problem so don't solve it with a technical means.


Another polish madlad named his company

    Dariusz Jakubowski x'; DROP TABLE users; SELECT '1 
https://aplikacja.ceidg.gov.pl/ceidg/ceidg.public.ui/searchd...


There's also a Dorian Kucharski '); DROP TABLE users;-- and two more examples of a bit more failed (or maybe those two are the ones that chickened out) attempts when you search ceidg for "DROP TABLE".

I am a bit proud.


Little Darry Tables sure has grown up into a fine young man!


There's a great Radiolab episode where they interview the person who had NULL as his license plate. https://radiolab.org/podcast/null/transcript


Not so much "modified their license plate" so much as put a banner across the license plate part of their car. No indication that it did anything; would be in the top 5 all-time dumbest hacks.


Obligatory XKCD: https://xkcd.com/1105/. Be sure to check the alt text too.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: