Using TypeScript to obtain one of the rarest license plates

https://www.jack.bio/blog/licenseplate

by lafond • 7 months ago

197 155 7 months ago

hippich• 7 months ago

One thing that stopped me from seeking the vanity plate - I learned that at least in Texas all plates are made by minimally paid prisoners. So any desire to finance that system beyond what's absolute possible minimum (i.e. regular plates) evaporated.

rsstack• 7 months ago

In New York it's the same, they make the license plates and also school furniture, and maybe other things too. I was scared for a moment when I was told by USPS Informed Delivery that I have incoming mail from Auburn Correctional Facility - but it was a license plate.

embedding-shape3• 7 months ago

I learned that at least in Texas all plates are made by minimally paid prisoners

Lol, wasn't slavery outlawed in the US, or were some states still allowed to keep it? That's absolutely bananas if true.

dogleash• 7 months ago

Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction.

grimgrin• 7 months ago

Since you didn't know about for-profit prisons, here:

https://en.wikipedia.org/wiki/Private_prison

Aurornis2• 7 months ago

To be clear, the prisoners aren’t literally forced to do this work. It’s a job they can choose to apply for and do while in prison. (EDIT: In my state, it might be different in other states)

The contention is about how much they’re paid per hour.

SirSavary• 7 months ago

The Thirteenth Amendment to the United States Constitution abolished slavery and involuntary servitude, except as punishment for a crime.

https://en.wikipedia.org/wiki/Thirteenth_Amendment_to_the_Un...

paulddraper2• 7 months ago

No, Thirteenth Amendment permits it as punishment for a crime.

This a good reminder to all Americans to read the Constitution. The amount of bizarre understandings (not necessarily this one) that I see is very high.

htx80nerd• 7 months ago

they shouldnt be paid at all. they're in prison for a reason. they have a debt to society. a great many of those people didnt do 'one bad thing' then got caught. it was just the last bad thing they were caught for. any many of them did 'the bad thing', then continued doing other bad things up until the point they were put in prison.

pavel_lishin7• 7 months ago

I don't agree with your "slave labor is ok if the slave committed a crime" position, and find it morally indefensible.

jollyllama• 7 months ago

In many cases, their earnings are confiscated as part of restitution.

macintux2• 7 months ago

they're in prison for a reason.

Often that reason is "too poor to afford proper representation" or "looked vaguely like the actual criminal" or "took a plea bargain because the justice system was threatening them with an immorally-long wait for a trial and a likely worse outcome".

aacid• 7 months ago

Punishment is only one reason of inprisonment, another is correction. Majority of prisoners do not serve lifetime sentence, at some point they wikl return to society and ideally you don't want them to get right back to what they have been doing before because they have no other options or they don't know nothing better.

7bit2• 7 months ago

Ah yes. American Prisons prioritizing punishment over resocialising is the reason why criminals so often continue to hurt society after they have been released.

Then we have people who demand to double down on the punishment and wonder why these people never stop breaking the law.

Americans are a marvelous bunch. Thanks Dog I live in a first world country.

alexfoo3• 7 months ago

One thing that stopped me from seeking the vanity plate

I'm sure it differs between countries but in the UK vanity plates have become reasonably contentious.

As a gross generalisation they're fine if the car is worth hundreds of thousands or the plate itself is worth hundreds of thousands.

The UK plate "F1" last sold for just under £1m (about US$1.3m) over 10 years ago and it's rumoured that there are offers for ten times that from someone who wants to buy it now.

It comes down to a classic British issue of "class", which is inherently difficult to explain.

If you have the money to have, say, a Ferrari 250 GTO then you can do what the hell you like with it, including getting a vanity plate for it. You are rich enough that you don't care what anyone else thinks about you. Anyone seeing you and that car will know you are rich.

If you have the money to spend close to £1m on a plate like "X1" and decide to put it on beat up 15 year old 1.2 litre Ford Focus then, again, it shows you have stupid amounts of money and some delicious irony in putting it on an old beater of a car.

But if don't have a supercar and you get a relatively cheap vanity plate like "RMZ 1327" and stick it on a Range Rover Evoque that's only a couple of years old then it just shows that you're trying too hard and just aspire to be seen as rich. You don't have enough money for a really nice car, or a really exclusive vanity plate.

I guess the other way of looking at it is that people who don't have the money to get a vanity plate aspire to being able to do so as it would mean they have more money than they have now. Once they get to having that amount of money most realise that the money is best spent elsewhere (or not spent at all). Once they have so much money that having a vanity plate is inconsequential to their finances they may as well do it. So it's natural that some people want to pretend they've reached the "rich" state by buying a vanity plate preemptively - the problem is that this is so easy to spot it just looks gauche.

All of this obviously doesn't apply to countries where vanity plates aren't traded for stupid amounts like famous pieces of art.

mtrovo• 7 months ago

Loved your description of the class system. There's a general theme of old money wealthy people not caring about vanity purchases because they don't know how much stuff costs nor if that is a too much money or not.

It's interesting to see how luxury brands have different segments of clothes that range from no logos at all to a huge alligator the size of your chest, depending on whether you need to announce to the world that you made it or if you just want to have access to good quality clothes.

OptionOfT2• 7 months ago

In CA and AZ vanity plates are first come, first served. You cannot sell them either. You either keep them on a car, or you can keep on paying to keep it out of circulation forever. But once you give it up it goes back to the pool, and someone can get it.

Also, my vanity plate is $0 more than a normal plate. Why wouldn't I?

TiredOfLife• 7 months ago

It comes down to a classic British issue of "class", which is inherently difficult to explain.

The Frost Report sketch explains it quite well:

https://youtu.be/9XmB59Ax4cE

BurningFrog• 7 months ago

Imprisoning people for years seems like a much worse thing to do to people than underpaying them for work they do while locked up.

Is it that the latter can be called "slavery" that makes people upset?

retrodaredevil• 7 months ago

There are a lot of incentives to lock people up. Cheap labor is one of them. We should support incentives such as "keeping society safe", but incentives such as "profits and cheap labor" are incentives that may actually incentivize locking up innocent people.

So it's not about which one is worse, it's about not supporting something that could lead to corruption or an unfair system.

paulddraper2• 7 months ago

“The morally correct thing is to pay them even less.”

Svip2• 7 months ago

In Denmark, you can buy a vanity plate (ønskenummerplade) for 8'000 DKK (needs renewal every 8 years), and it can be between 2 and 7 characters long; but the best part is that they permit all Danish letters, including Æ, Ø and Å. One could likely write a script quickly to check these platforms for short combinations, such as ØÅ, which appears to be available.

neilv2• 7 months ago

ØØ7

Don't forget that the cost is not only the bureaucratic fee; you also have to buy a vintage Aston Martin or Lotus, to display the plate.

reactordev2• 7 months ago

Shouldn’t be a problem with all that medieval money lying around. /s

Does a kit car count? You can build a Lotus for around the cost of a Honda civic. Like a Lotus 7.

josteink• 7 months ago

While clever, as a Scandinavian I regret to inform you that I would read that as: Uh Uh Seven, not (double) Oh Seven ;)

mdasen• 7 months ago

I'm imagining someone driving in England and the police having no way to input those letters into their system.

I wonder if the Danish system would prevent ÆØÅ and AEOA from both being registered. Would the Danish system Match "ÆØÅ" if someone input "AEOA"? There are unicode normalization rules, but I wonder if systems would be built to handle that. If you're Danish, you'd just use those letters so it wouldn't be a useful feature. If you're English, you wouldn't often encounter those letters so it wouldn't be a useful feature.

alexfoo3• 7 months ago

I'm imagining someone driving in England and the police having no way to input those letters into their system.

I would assume the UK has worked out a way of dealing with this having had plenty of years of foreign plates being driven around the country.

Any Danish license plate driven in the UK will almost certainly have to a be an EU style plate with the blue band on the left with the "DK" country code. If someone needs to send a fine to the registered owner of this plate I'd guess they'd be handing over the camera footage/images to a contact in the relevant country and letting them confirm what the exact plate is.

(There may be some weird exemptions for old classic/vintage cars that can continue to be driven on their original number plates, in which case you really don't know who to contact.)

The UK is very strict on license plates. I don't think there's any valid reason for driving a car without some form of a license plate on display (cars being driven on trade plates placed in the front/rear windscreens are the closest thing I can think of). I'd expect the UK Police to pull over any car that didn't have plates on it if they spotted it. It's certainly considered very suspicious in the UK if a car is missing either of its plates.

There are plenty of examples of normal ANPR cameras failing to capture plates properly. Or even sillier examples like this: https://www.bbc.co.uk/news/uk-england-somerset-58959930

This story got referenced by the associated Government body here: https://videosurveillance.blog.gov.uk/2021/10/27/the-camera-...

culi3• 7 months ago

So what happens when ÁÀÂÅÅÀÄ run a red light?

ilya_m• 7 months ago

A fine for faking a license plate, may be? ÁÀÂÀÄ are not in the Danish alphabet.

valleyer• 7 months ago

You should not be getting notifications while driving.

moralestapia• 7 months ago

Hehe, I do a similar thing for phone numbers and I got real good ones almost for free :)

tetraodonpuffer• 7 months ago

phone numbers seem risky, years back I got randomly assigned a "cool" number (I think it ended with 8888 or something) and it seems it was on all possible fax spam lists, constant calls all hours of the day and the night, had to change it asap.

bsimpson4• 7 months ago

I have my HN name @gmail.com.

I've never actually used that account, because there are too many anonymous Bart Simpsons (and old people who don't understand email addresses) who use that one.

The shitty thing is that I use Google Apps for Your Domain (a.k.a. Dasher/GSuite) to get around this. For years, things like Photos and Music were stuck to my useless Gmail account, because the PMs involved never bothered going through the approvals to get those things to work on custom domain accounts (which Google ret-conned to be for businesses only).

A lot of these are resolved now, but there are still frustrating places where it comes up:

- I pay twice for YouTube Music - once for myself, and once for my family. I can't share my account with them, because it's attached to my domain name.

- I similarly can't join their Google Home accounts to do things like have my voice recognized when I visit them.

- Gemini CLI thinks I'm a business and quotas me like one.

dhosek5• 7 months ago

My then-fiancée had a cell number that ended with 5 zeroes and a 1 and she got many wrong number calls from people who were trying to reach numbers that ended with 0-001x

moduspol• 7 months ago

I found out recently that in my state, the online vanity plate checker shows plates that were PREVIOUSLY registered but NOW available as NOT available. I wanted to get one of my own plates I had years ago and assumed there was some process to have it transferred, but was told by a DMV rep that after two years of non-registration, they're up for grabs. Apparently the web page does not take this into account.

That means there are probably a lot of great plate names up for the taking that people are just assuming are taken. You'd need to call the DMV to verify.

Hopefully Florida's web page does not have that limitation.

dustfinger2• 7 months ago

What we need is a "Little Bobby Tables" vanity plate that exploits a buffer overflow in speed cams.

Liquix2• 7 months ago

https://i.imgur.com/hhlg100.jpeg

kijin• 7 months ago

Unfortunately they seem to filter special characters on input, that is, when you apply for your plate.

But don't despair! Depending on how crappy the cam's firmware is, NULL might just do the trick.

pavel_lishin7• 7 months ago

Or it might do the opposite: https://www.wired.com/story/null-license-plate-landed-one-ha...

bombcar7• 7 months ago

Isn’t there an xkcd abut a license plate of zeros an Os and ones and LS and the cops just say “it’s the guy with the plate again”.

Liquix2• 7 months ago

https://xkcd.com/1105/

rozenmd• 7 months ago

I did something similar to get OnlineOrNot's twitter handle - I realised that unclaimed names would 404 and so I set up a check to get an alert when that happened.

sltkr• 7 months ago

It's a fun story of course, but it also seems that people like OP who abuse public APIs are why we can't have nice things, and why so many web pages these days are bogged down by Cloudflare and Anubis interstitials that waste human time.

abound• 7 months ago

Yeah, also running a scraper with no rate limit against a government website is a pretty risky endeavor.

LikesPwsh• 7 months ago

Skiddies targeting an individual site are a drop in the ocean compared with the industrial scale LLM scraping, so blaming them for it is in bad taste.

Someone12343• 7 months ago

The difference is that the government won't charge a major LLM vendor with a crime, but they may kick in John Smith's front door and ruin their life.

wiseowise• 7 months ago

Skiddies targeting an individual site are a drop in the ocean compared with the industrial scale LLM scraping

They're not. Both are bad, but at least there's some utility to LLMs.

pavel_lishin7• 7 months ago

Most people never think twice about the random mix of letters and numbers the DMV assigns them.

I started thinking about it when someone parked next to me in a nearly-identical model - same brand, year, etc, the only difference was some roof accessory - and a nearly identical license plate. (Think ABC D12 and ABC E12). I started trying to open their car door, and was confused until I noticed some things in their front seat that were clearly not ours.

Later that week, I was shopping around for car tires, and saw that some shop - PepBoys or something - let you punch in your license plate and let you know what kind of tires you need, and that their API response included the car make and model. I thought about poking around it, and seeing if there was a pattern to the way my state assigned license plates, but never got around to it.

(They live in town, too, and I've seen where they park. I should go introduce myself to our car twin.)

giarc• 7 months ago

https://www.pepboys.com/tires

They have a license plate checker on their site. I don't live in the states, therefore I don't have a plate to check. Or do I..... HY in Florida....

@lafond - do you own a 2010 Subaru Legacy with the 2.5L SOHC engine?

pavel_lishin7• 7 months ago

Yep. I wonder where and how they get this information.

bombcar7• 7 months ago

When you realize the total combos of car key possibilities, you have a decent chance your key would work, too!

culi3• 7 months ago

I borrowed my friend's Prius once and accidentally opened the door to the wrong one and got in for a second before slowly realizing things felt off.

pavel_lishin7• 7 months ago

It's a keyfob, and it didn't open his door when I tried to get in :P

MisterTea2• 7 months ago

Had two GM 3500 cargo vans, one a 2002 Chevy Express, the other a 2001 GMC Savannah. Same vehicle different badges. Noticed the keys were a bit similar and found that the Chevy key could in fact unlock the GMC with some wiggling but not the other way around. It did not work in the ignition lock.

dhosek5• 7 months ago

Back in the 90s, I was on a trip and ended up parked next to a car which had a car alarm that responded to the key fob for my car alarm. It was very disconcerting.

tantalor• 7 months ago

I'm not seeing what TypeScript brings to the party here? Looks like regular old JavaScript plus a vanilla dashboard.

sphars2• 7 months ago

He used TypeScript for the scripts he wrote to pull the data. He also used Next.js to build the dashboard which is written with TypeScript

yesitcan2• 7 months ago

This has nothing to do with TypeScript

sphars2• 7 months ago

The scripts he wrote to pull the data were written in TypeScript, though all the TS I see is in the parameters in the function signature. Also he used Next.js for the dashboard

kelnos2• 7 months ago

I think the GP's point was that the part of the article that's most interesting is the investigation into how the DMV's plate system works. The fact that Typescript was used is incidental (of course this could have been done in pretty much any language), and it's an odd choice to include the language choice in the article title.

bsimpson4• 7 months ago

Generally speaking, if someone specifies "TypeScript," I expect the type system to be the interesting part of the writeup. Otherwise, it could say "JavaScript."

(It could say "React," but still, the interesting part is that you built a scraper/visualizer, not that it used React.)

wvenable2• 7 months ago

If the headline said "Using Python to obtain one of the rarest license plates" you wouldn't think twice.

yesitcan2• 7 months ago

That’s true. But the analogy is more correct if it said “Using Mypy to obtain…”

vachina• 7 months ago

I got my vanity phone number this way too. However key point is to have a registrar with an insecure lookup endpoint like in the article.

Most endpoints now only give you a list pre generated numbers to choose from, AND that endpoint is rate limited to the tits with reCaptcha. No more script kiddies.

masfuerte• 7 months ago

If anyone else was wondering why it says NASCAR on the plate:

https://en.wikipedia.org/wiki/Vehicle_registration_plates_of...

komali2• 7 months ago

I swear I read some case a couple years back where a kid was facing serious prison time for automating requests to w publicly available government website. "Unauthorized access of a computer." I think the author may have just admitted to what the government considers a serious federal crime, as stupid as it is to consider it a crime.

pavel_lishin7• 7 months ago

Arguably the most famous one is this: https://en.wikipedia.org/wiki/Aaron_Swartz#United_States_v._...

theSuda• 7 months ago

Whoa. That was an interesting read.

bsimpson4• 7 months ago

I once had a flatmate who worked in IT at MIT at the time that happened. I don't remember the details, but it was a sad fluke that the feds even got involved - something like it was reported at the wrong time of day/when the person who should have got it was off-shift, or the feds happened to be doing something with the state police when the report came in and wanted to make a big news splash.

Whole thing was incredibly fucked up.

Interesting to see how much more thorough the Wikipedia page is now.

wing-_-nuts• 7 months ago

Just because you can hit a backend without a rate limit, doesn't mean you should. In my experience, government IT is very humorless about this sort of thing. Far better to blend in with normal traffic than to stand out as a bad actor.

Scaevolus• 7 months ago

Especially given how the response time doesn't matter much here! If you're just looking at 2-character license plates, that's 676/5=136 requests to check them all, and you could easily space that out to something like one request per minute to scan the space every two hours.

ycombinatrix• 7 months ago

"Your honor, the defendant took steps to hide their activities, showing that they knew it was wrong"

cyral• 7 months ago

Different scenario but it reminds me of when Missouri prosecuted a reporter who found that teacher's SSN numbers were exposed in the HTML of a webpage

"Parson described the journalist as a “perpetrator” who “took the records of at least three educators, decoded the HTML source code, and viewed the Social Security number of those specific educators” in an “attempt to steal personal information and harm Missourians.”"

consp• 7 months ago

Isn't html copyrightable and thus it is a publication? (And thus exposed by the author). Or am I in the wrong ballpark here?

gpm• 7 months ago

That didn't actually happen. The governor threatened to prosecute, and ordered the police to produce a report on their investigation into the matter. The police complied producing a report saying the person the governor wanted to prosecute did nothing wrong.

sunaookami• 7 months ago

Reminds me of a German developer that got prosecuted because he opened an EXE file with notepad and found a hardcoded database password there: https://www.heise.de/en/news/Modern-Solution-Convicted-IT-ex...

The password to this database was stored unencrypted in an executable file of the middleware product and was the same for all Modern Solution customers
Modern Solution then reported the security researcher to the police, who searched his home and confiscated his work equipment
The programmer has thus been sentenced to a fine of 3,000 euros and must bear the costs of the proceedings

FroshKiller• 7 months ago

I was charged with felony unauthorized access of a government computer years ago for an even stupider reason. Nobody should underestimate the state's willingness to prosecute over anything.

jfindper• 7 months ago

The fun thing about the computer fraud and abuse act is that just about anything can be made into a federal crime with it!

Someone12343• 7 months ago

Considering it was created during a major moral panic after the movie "War Games" came out, by a bunch of politicians who knew nothing about computers (aside from, again, watching the movie War Games).

As a direct result, anything and everything can be a crime (e.g. violating a private company's Terms & Conditions), and the punishments are completely disproportionate to the actual criminality.

See the AT&T/iPad data leak, where AT&T were leaking private information on the internet with no security checks at all. Someone found it, told the press, who in turn told AT&T, but the FBI still investigated it as a "crime", raided their home, charged them with "conspiracy to access a computer without authorization." AT&T go no punishment at all.

pcaharrier• 7 months ago

Just about, indeed!

"Nonprofit hires woman, but she quits after a few days, asks for pay for that time; they refuse, and things get worse from there. But! They don’t turn off her email access to a board member’s email. She and a friend comb through the account, download internal documents, and then ask for a lot of money. Federal crime? Third Circuit: Not until they actually revoked her access."

https://www2.ca3.uscourts.gov/opinarch/233017p.pdf

kp1197• 7 months ago

Soon he may be making vanity license plates

lafond3• 7 months ago

OP here - I did some pretty heavy research on this topic to make sure I'd be okay publishing this / automating anything at all. From what I looked into (and mind you, I'm a 23 year old security researcher & not a lawyer) there are a few recent landmark court cases (Van Buren vs. United States, hiQ Labs vs. LinkedIn) that protect webscraping of a public-facing page without bypass of any technological barriers. Furthermore, Florida has the Computer Abuse and Data Recovery Act that defines any malicious behavior as overuse of resources or an intent to defraud or cause harm, both of which I was very conscious about not violating. I appreciate the concern regardless!

jconley88• 7 months ago

In CO, there isn't an online search. When you apply, you have to list your top options and hope one is available. I'm also not a normal person. I'm an engineer and this was not good enough for me.

I emailed government employees until I figured out who was responsible for license plate records. I submitted a CORA (Colorado Open Records Request) for the entirety of their dataset. I had hoped to get the data on some regular cadence to build a simple online service for others. Unfortunately, they flat out refused and wouldn't discuss options.

When I told my family what license plate I wanted, they laughed at me and said "No one has that, just go get it". And so I did and it worked. I now have what I consider to be the best possible license plate in Colorado: "LCNZPLT"

Occasionally I'll see someone walk by my car, see the plate, think for a few seconds and then start laughing. Mission accomplished!

rsync• 7 months ago

The best possible license plates in Colorado all start with ZG …

bombcar7• 7 months ago

Oh I get it your license plate is “License Plate”

LCNSPL8

mkw5053• 7 months ago

Very similar to this post from a few months ago - https://blog.jonlu.ca/posts/ca-plate-checker

rgovostes• 7 months ago

Hah, in California I used to have HX.

The short plate came back to bite me: Years after I had moved to another state, an automatic license plate reader on a toll road (91 Express Lanes) in Los Angeles misread someone else's plate as mine. It was kafkaesque: My public records request for photographic evidence was blocked because, if I was correct that the offending driver was not me, the law prohibits the release of records revealing others' driving patterns.

The other plates available when I did a similar search were BO and IR. In retrospect IR wasn't a bad choice.

ProllyInfamous• 7 months ago

I have an iteration of NO PLATE, and have received numerous citations and impound notices. At this point, I just ignore them. Registration renewal is possible, only because my local county office understands the situation (years of this).

Of course I could change my license plate, but not'gonna.

jonluca• 7 months ago

I did something similar with CA a few months back - https://blog.jonlu.ca/posts/ca-plate-checker

Next steps would be to make it LLM assisted and to generate common number/letter replacement combos

lafond3• 7 months ago

Great minds think alike! Tough you weren't able to find anything cool with it, but glad I wasn't the only one thinking to automate it :)

zzo38computer• 7 months ago

What character set does it use? For example, can "O" and "0" considered different characters or same character, and are some letters/numbers not used? If so, then how many they say are possible is not quite that simple, since some might match (so they cannot simply be added together) and some might not be possible.

chatmasta• 7 months ago

I was hoping “using TypeScript” was going to be more along these lines, i.e. using the type system as a constraint solver for some combination of homoglyphs that resembles a target string.

turtlebits• 7 months ago

Aren't all license plates rare since they're unique? I would also not call it rare unless everyone wants that specific combo of characters.

Personally, I wouldn't pay extra every year to have an easily recognizable vehicle.

paradox460• 7 months ago

I used to have a fun novelty plate when I lived in California, but when it came time to get new ones, I went with the most boring, plain plate I could. With how many crazy assholes there are on the road these days, anything I can do to promote my own inconspicuousness is something I'll do. No bumper stickers, no cute plate frames, nothing. When I'm not carrying skis, the rack comes off

hu3• 7 months ago

In a world where people scratch sports cars painting out of pure envy. It's hard to criticise someone trying to stay under the radar of the crazy.

hmokiguess• 7 months ago

I’m boring. The process for us was: Wifey and I thought of cool names, went to register with our shortlist written on paper, most didn’t work, until one did. Though now we’re considering dropping it because it costs too much.

resurge• 7 months ago

Hey, would you please consider adding an RSS feed to your blog? I remember liking your post about Waffle house and now also this one, so I tried to add it to my RSS reader. But unfortunately no feed is available.

lafond3• 7 months ago

It's now available! https://jack.bio/feed :-)

eurleif• 7 months ago

EVENTVALIDATION is (was?) a novel security measure implemented in 2006 by the ASP.NET team to "prevents unauthorized requests sent by potentially malicious users from the client [..] to ensure that each and every postback and callback event originates from the expected user interface elements, the page adds an extra layer of validation on events".

The attack it prevents is called XSRF, and this security measure wasn't novel in 2006.

Using TypeScript to obtain one of the rarest license plates

Related Stories