Top
Best
New

Posted by lafond 12/18/2025

Using TypeScript to obtain one of the rarest license plates(www.jack.bio)
197 points | 206 comments
paradox460 12/19/2025|
I used to have a fun novelty plate when I lived in California, but when it came time to get new ones, I went with the most boring, plain plate I could. With how many crazy assholes there are on the road these days, anything I can do to promote my own inconspicuousness is something I'll do. No bumper stickers, no cute plate frames, nothing. When I'm not carrying skis, the rack comes off
hu3 12/19/2025|
In a world where people scratch sports cars painting out of pure envy. It's hard to criticise someone trying to stay under the radar of the crazy.
moduspol 12/18/2025||
I found out recently that in my state, the online vanity plate checker shows plates that were PREVIOUSLY registered but NOW available as NOT available. I wanted to get one of my own plates I had years ago and assumed there was some process to have it transferred, but was told by a DMV rep that after two years of non-registration, they're up for grabs. Apparently the web page does not take this into account.

That means there are probably a lot of great plate names up for the taking that people are just assuming are taken. You'd need to call the DMV to verify.

Hopefully Florida's web page does not have that limitation.

yesitcan 12/18/2025||
This has nothing to do with TypeScript
bsimpson 12/18/2025||
Generally speaking, if someone specifies "TypeScript," I expect the type system to be the interesting part of the writeup. Otherwise, it could say "JavaScript."

(It could say "React," but still, the interesting part is that you built a scraper/visualizer, not that it used React.)

wvenable 12/19/2025|||
If the headline said "Using Python to obtain one of the rarest license plates" you wouldn't think twice.
yesitcan 12/21/2025||
That’s true. But the analogy is more correct if it said “Using Mypy to obtain…”
sphars 12/18/2025||
The scripts he wrote to pull the data were written in TypeScript, though all the TS I see is in the parameters in the function signature. Also he used Next.js for the dashboard
kelnos 12/18/2025||
I think the GP's point was that the part of the article that's most interesting is the investigation into how the DMV's plate system works. The fact that Typescript was used is incidental (of course this could have been done in pretty much any language), and it's an odd choice to include the language choice in the article title.
Svip 12/18/2025||
In Denmark, you can buy a vanity plate (ønskenummerplade) for 8'000 DKK (needs renewal every 8 years), and it can be between 2 and 7 characters long; but the best part is that they permit all Danish letters, including Æ, Ø and Å. One could likely write a script quickly to check these platforms for short combinations, such as ØÅ, which appears to be available.
neilv 12/18/2025||
ØØ7

Don't forget that the cost is not only the bureaucratic fee; you also have to buy a vintage Aston Martin or Lotus, to display the plate.

josteink 12/18/2025|||
While clever, as a Scandinavian I regret to inform you that I would read that as: Uh Uh Seven, not (double) Oh Seven ;)
cobbzilla 12/19/2025|||
a money-saver! uh uh seven belongs on a vintage Ford Pinto!
neilv 12/19/2025|||
But the tourists visiting Europe will be impressed.
reactordev 12/18/2025|||
Shouldn’t be a problem with all that medieval money lying around. /s

Does a kit car count? You can build a Lotus for around the cost of a Honda civic. Like a Lotus 7.

MisterTea 12/18/2025||
Money? You mean you don't just go to Q and procure one?
reactordev 12/18/2025||
I guess you could get the tax payers to pay for it.
mdasen 12/18/2025|||
I'm imagining someone driving in England and the police having no way to input those letters into their system.

I wonder if the Danish system would prevent ÆØÅ and AEOA from both being registered. Would the Danish system Match "ÆØÅ" if someone input "AEOA"? There are unicode normalization rules, but I wonder if systems would be built to handle that. If you're Danish, you'd just use those letters so it wouldn't be a useful feature. If you're English, you wouldn't often encounter those letters so it wouldn't be a useful feature.

alexfoo 12/18/2025||
> I'm imagining someone driving in England and the police having no way to input those letters into their system.

I would assume the UK has worked out a way of dealing with this having had plenty of years of foreign plates being driven around the country.

Any Danish license plate driven in the UK will almost certainly have to a be an EU style plate with the blue band on the left with the "DK" country code. If someone needs to send a fine to the registered owner of this plate I'd guess they'd be handing over the camera footage/images to a contact in the relevant country and letting them confirm what the exact plate is.

(There may be some weird exemptions for old classic/vintage cars that can continue to be driven on their original number plates, in which case you really don't know who to contact.)

The UK is very strict on license plates. I don't think there's any valid reason for driving a car without some form of a license plate on display (cars being driven on trade plates placed in the front/rear windscreens are the closest thing I can think of). I'd expect the UK Police to pull over any car that didn't have plates on it if they spotted it. It's certainly considered very suspicious in the UK if a car is missing either of its plates.

There are plenty of examples of normal ANPR cameras failing to capture plates properly. Or even sillier examples like this: https://www.bbc.co.uk/news/uk-england-somerset-58959930

This story got referenced by the associated Government body here: https://videosurveillance.blog.gov.uk/2021/10/27/the-camera-...

monerozcash 12/18/2025|||
>I would assume the UK has worked out a way of dealing with this having had plenty of years of foreign plates being driven around the country.

Based on my experience, the UK approach is to not even bother and try and collect fines from owners of foreign registered vehicles. They do sell them to some private company that has been sending me scary letters for 10 years soon.

Svip 12/18/2025|||
My understanding is that most countries just don't bother; I once drove around North America on Danish plates; since European plates are much wider than North American style plates, none of their cameras could scan my plates; so camera-only toll roads were essentially free for me. I consider that it happens so rarely anyway, that they don't bother.

Similarly, I've been flashed for speeding in France, which does have cameras adjusted to my plates' size, but they also didn't bother sending a ticket. Germany - on the other hand - will send you a ticket, but since they allow Ö, Ü, etc. on their plates, their system can probably handle Æ, Ø and Å as well.

Edit: Obviously, they don't bother to a degree; severe infractions will obviously make local law enforcement do something, but it's a rather manual process. Most countries are signatures to a treaty, that recognises other countries' plates.

culi 12/18/2025||
So what happens when ÁÀÂÅÅÀÄ run a red light?
ilya_m 12/19/2025||
A fine for faking a license plate, may be? ÁÀÂÀÄ are not in the Danish alphabet.
culi 12/19/2025||
Apologies. I'm not familiar with the alphabet. I just looked up Danish unicode and it showed those characters. I'll stick with 0OO0O00 as my license plate
pavel_lishin 12/18/2025||
> Most people never think twice about the random mix of letters and numbers the DMV assigns them.

I started thinking about it when someone parked next to me in a nearly-identical model - same brand, year, etc, the only difference was some roof accessory - and a nearly identical license plate. (Think ABC D12 and ABC E12). I started trying to open their car door, and was confused until I noticed some things in their front seat that were clearly not ours.

Later that week, I was shopping around for car tires, and saw that some shop - PepBoys or something - let you punch in your license plate and let you know what kind of tires you need, and that their API response included the car make and model. I thought about poking around it, and seeing if there was a pattern to the way my state assigned license plates, but never got around to it.

(They live in town, too, and I've seen where they park. I should go introduce myself to our car twin.)

giarc 12/18/2025||
https://www.pepboys.com/tires

They have a license plate checker on their site. I don't live in the states, therefore I don't have a plate to check. Or do I..... HY in Florida....

@lafond - do you own a 2010 Subaru Legacy with the 2.5L SOHC engine?

pavel_lishin 12/18/2025||
Yep. I wonder where and how they get this information.
bombcar 12/18/2025||
When you realize the total combos of car key possibilities, you have a decent chance your key would work, too!
MisterTea 12/18/2025|||
Had two GM 3500 cargo vans, one a 2002 Chevy Express, the other a 2001 GMC Savannah. Same vehicle different badges. Noticed the keys were a bit similar and found that the Chevy key could in fact unlock the GMC with some wiggling but not the other way around. It did not work in the ignition lock.
bombcar 12/18/2025||
Ignition locks were always better machined - the door locks were the first to get loose enough for “alternative keys”

Eventually a screwdriver works for both.

dhosek 12/19/2025||||
Back in the 90s, I was on a trip and ended up parked next to a car which had a car alarm that responded to the key fob for my car alarm. It was very disconcerting.
culi 12/18/2025||||
I borrowed my friend's Prius once and accidentally opened the door to the wrong one and got in for a second before slowly realizing things felt off.
dhosek 12/19/2025||
Around 2009ish I parked our dark grey Prius next to another dark grey Prius while going to the Beverly Hills Farmers’ Market and when I came back to the car, there was a third dark grey Prius parked next to the two original dark grey Priuses.
bombcar 12/19/2025||
They were reproducing!
pavel_lishin 12/18/2025|||
It's a keyfob, and it didn't open his door when I tried to get in :P
komali2 12/18/2025||
I swear I read some case a couple years back where a kid was facing serious prison time for automating requests to w publicly available government website. "Unauthorized access of a computer." I think the author may have just admitted to what the government considers a serious federal crime, as stupid as it is to consider it a crime.
pavel_lishin 12/18/2025||
Arguably the most famous one is this: https://en.wikipedia.org/wiki/Aaron_Swartz#United_States_v._...
bsimpson 12/18/2025|||
I once had a flatmate who worked in IT at MIT at the time that happened. I don't remember the details, but it was a sad fluke that the feds even got involved - something like it was reported at the wrong time of day/when the person who should have got it was off-shift, or the feds happened to be doing something with the state police when the report came in and wanted to make a big news splash.

Whole thing was incredibly fucked up.

Interesting to see how much more thorough the Wikipedia page is now.

theSuda 12/18/2025|||
Whoa. That was an interesting read.
cyral 12/18/2025|||
Different scenario but it reminds me of when Missouri prosecuted a reporter who found that teacher's SSN numbers were exposed in the HTML of a webpage

> "Parson described the journalist as a “perpetrator” who “took the records of at least three educators, decoded the HTML source code, and viewed the Social Security number of those specific educators” in an “attempt to steal personal information and harm Missourians.”"

sunaookami 12/19/2025|||
Reminds me of a German developer that got prosecuted because he opened an EXE file with notepad and found a hardcoded database password there: https://www.heise.de/en/news/Modern-Solution-Convicted-IT-ex...

>The password to this database was stored unencrypted in an executable file of the middleware product and was the same for all Modern Solution customers

>Modern Solution then reported the security researcher to the police, who searched his home and confiscated his work equipment

>The programmer has thus been sentenced to a fine of 3,000 euros and must bear the costs of the proceedings

gpm 12/18/2025||||
That didn't actually happen. The governor threatened to prosecute, and ordered the police to produce a report on their investigation into the matter. The police complied producing a report saying the person the governor wanted to prosecute did nothing wrong.
consp 12/18/2025|||
Isn't html copyrightable and thus it is a publication? (And thus exposed by the author). Or am I in the wrong ballpark here?
dhosek 12/19/2025|||
What makes something a publication is the act of publishing, not the format that it takes.¹ Copyright is implicitly granted at publication² although registration is required in order to sue for infringement.³

⸻

1. Within some limitations: certain types of creative works, most notably typefaces, are excluded from copyright law, although it was determined that digital font files that describe the outlines of the characters are programs and thus eligible for copyright. Bitmap font files on the other hand, as an expression of a typeface design are not eligible for copyright.

2. Although works created by federal employees as part of their job are explicitly excluded from copyright protection.

3. Note though, that the timing of the registration impacts what you can sue for. If registration takes place after the infringement you can only sue for actual damages, but if it takes place before the infringement you can sue for punitive damages.⁴

4. I should add the obligatory disclaimers that all of the above only describes US copyright law and also I’m not a lawyer (although I did used to watch Law and Order a lot) so everything in this comment could quite likely be completely wrong.

phyzome 12/19/2025||||
No. Imagine you wrote a personal diary entry in a text file on your computer, and only afterwards wrapped it in HTML tags. Did you just make it a document intended for broad publication?
ryanmcbride 12/18/2025||||
It doesn't matter. The judges who pass these sentences don't know enough about the systems to understand whether or not a crime has been committed and they simply don't care.
wvenable 12/19/2025|||
Raw data isn't copyrightable. You can't copyright the contents of phone book, for example.
wing-_-nuts 12/18/2025|||
Just because you can hit a backend without a rate limit, doesn't mean you should. In my experience, government IT is very humorless about this sort of thing. Far better to blend in with normal traffic than to stand out as a bad actor.
Scaevolus 12/18/2025|||
Especially given how the response time doesn't matter much here! If you're just looking at 2-character license plates, that's 676/5=136 requests to check them all, and you could easily space that out to something like one request per minute to scan the space every two hours.
ycombinatrix 12/19/2025|||
"Your honor, the defendant took steps to hide their activities, showing that they knew it was wrong"
hun3 12/23/2025||
Just append

  X-Crawl-Reason: Finding spare license plates, throttled ONLY to prevent service disruption. To the best of my knowledge, [legalese claiming good faith and compliance to all applicable laws]
(Mandatory disclaimer: IANAL, ignorance is no excuse for breaking laws)
jfindper 12/18/2025|||
The fun thing about the computer fraud and abuse act is that just about anything can be made into a federal crime with it!
pcaharrier 12/18/2025|||
Just about, indeed!

"Nonprofit hires woman, but she quits after a few days, asks for pay for that time; they refuse, and things get worse from there. But! They don’t turn off her email access to a board member’s email. She and a friend comb through the account, download internal documents, and then ask for a lot of money. Federal crime? Third Circuit: Not until they actually revoked her access."

https://www2.ca3.uscourts.gov/opinarch/233017p.pdf

Someone1234 12/18/2025|||
Considering it was created during a major moral panic after the movie "War Games" came out, by a bunch of politicians who knew nothing about computers (aside from, again, watching the movie War Games).

As a direct result, anything and everything can be a crime (e.g. violating a private company's Terms & Conditions), and the punishments are completely disproportionate to the actual criminality.

See the AT&T/iPad data leak, where AT&T were leaking private information on the internet with no security checks at all. Someone found it, told the press, who in turn told AT&T, but the FBI still investigated it as a "crime", raided their home, charged them with "conspiracy to access a computer without authorization." AT&T go no punishment at all.

pizzalife 12/18/2025||

  See the AT&T/iPad data leak, where AT&T were leaking private information on the internet with no security checks at all. Someone found it, told the press, who in turn told AT&T, but the FBI still investigated it as a "crime", raided their home, charged them with "conspiracy to access a computer without authorization." AT&T go no punishment at all.
I think you are missing some nuance here. They found a vulnerability where they could just increment an "id" and get access to another user's information. They then went ahead and scraped as much as they could. Also this person (iProphet / weev / Andrew Auernheimer) is awful and certainly not a victim. AT&T did not leak the information, Andrew did!

Should they have had better security? Yes. Was the vulnerability extremely basic? Yes. Doesn't change much, a vulnerability was used to dump a bunch of private data.

bombcar 12/18/2025|||
Exactly. If you find an unlocked warehouse, even if you are supposed to pick up something of yours, and instead of directly complaining you also ransack everything, you’re going to catch some heat.
Someone1234 12/18/2025||||
> I think you are missing some nuance here. They found a vulnerability where they could just increment an "id" and get access to another user's information.

That's not nuance; the information was publically available on the internet without any security. Even search engines had indexed it before it was patched.

> They then went ahead and scraped as much as they could.

They told the press instead of releasing it.

> AT&T did not leak the information, Andrew did!

So AT&T dumping it all onto the open internet without any security isn't culpable, but the person who let the press know that their information was available to everyone is. That's quite an interesting take.

I'm struggling to see the nuance... You just repeated back what I already said, but added that you dislike the person personally, which is absolutely fine, but we're talking about miscarriages of justice not running a popularity contest. If you feel like they committed other crimes (which they likely did per Wikipedia), that is unrelated to THIS supposed crime.

> Was the vulnerability extremely basic? Yes.

There was no vulnerability. You just needed to request a record from a public web-server, which the server happily provided with no extra steps.

Let me ask this: When you request e.g. google.com, and they return a HTTP response, why is that not a "vulnerability?" Because we'd both agree it objectively is not. So then, why, when AT&T provides a URL with information they're meant to keep private but available to the public, and you then request it, that is suddenly a "vulnerability?"

Here is the actual URL you needed to call:

https://dcp2.att.com/OEPNDClient/openPage?IMEI=0&ICCID=<consecutive id>

You just needed to take any iPad's ICC ID and +1 for the next customer's record. So what is the "vulnerability?" Being able to count consecutively?

bsimpson 12/18/2025|||
"The guy who did it sucked" is generally not a good justification.

It's an easy trap to fall into (we all want consequences for shitty people), but it's also a blurry line to hold.

"First they came…"

lafond 12/19/2025|||
OP here - I did some pretty heavy research on this topic to make sure I'd be okay publishing this / automating anything at all. From what I looked into (and mind you, I'm a 23 year old security researcher & not a lawyer) there are a few recent landmark court cases (Van Buren vs. United States, hiQ Labs vs. LinkedIn) that protect webscraping of a public-facing page without bypass of any technological barriers. Furthermore, Florida has the Computer Abuse and Data Recovery Act that defines any malicious behavior as overuse of resources or an intent to defraud or cause harm, both of which I was very conscious about not violating. I appreciate the concern regardless!
FroshKiller 12/18/2025|||
I was charged with felony unauthorized access of a government computer years ago for an even stupider reason. Nobody should underestimate the state's willingness to prosecute over anything.
kp1197 12/19/2025||
Soon he may be making vanity license plates
dustfinger 12/18/2025||
What we need is a "Little Bobby Tables" vanity plate that exploits a buffer overflow in speed cams.
Liquix 12/18/2025||
https://i.imgur.com/hhlg100.jpeg
kijin 12/18/2025|||
Unfortunately they seem to filter special characters on input, that is, when you apply for your plate.

But don't despair! Depending on how crappy the cam's firmware is, NULL might just do the trick.

pavel_lishin 12/18/2025||
Or it might do the opposite: https://www.wired.com/story/null-license-plate-landed-one-ha...
dustfinger 12/18/2025||
Ouch!
bombcar 12/18/2025||
Isn’t there an xkcd abut a license plate of zeros an Os and ones and LS and the cops just say “it’s the guy with the plate again”.
Liquix 12/18/2025||
https://xkcd.com/1105/
dhosek 12/19/2025||
That plate wouldn’t be allowed in Illinois where there is a hard requirement that all digits follow any letters on the plate.¹ The thing that I find mystifying is that they charge more for a vanity plate that’s all letters than one that’s letters and digits.

⸻

1. Although some specialty plates end up having suffixed letters, usually shown on the plate stacked.

bombcar 12/19/2025||
Some states simply do not allow 0 and 1 on vanity plates, you have to use the letters.
rgovostes 12/18/2025||
Hah, in California I used to have HX.

The short plate came back to bite me: Years after I had moved to another state, an automatic license plate reader on a toll road (91 Express Lanes) in Los Angeles misread someone else's plate as mine. It was kafkaesque: My public records request for photographic evidence was blocked because, if I was correct that the offending driver was not me, the law prohibits the release of records revealing others' driving patterns.

The other plates available when I did a similar search were BO and IR. In retrospect IR wasn't a bad choice.

ProllyInfamous 12/20/2025|
I have an iteration of NO PLATE, and have received numerous citations and impound notices. At this point, I just ignore them. Registration renewal is possible, only because my local county office understands the situation (years of this).

Of course I could change my license plate, but not'gonna.

masfuerte 12/18/2025||
If anyone else was wondering why it says NASCAR on the plate:

https://en.wikipedia.org/wiki/Vehicle_registration_plates_of...

tantalor 12/18/2025|
I'm not seeing what TypeScript brings to the party here? Looks like regular old JavaScript plus a vanilla dashboard.
sphars 12/18/2025|
He used TypeScript for the scripts he wrote to pull the data. He also used Next.js to build the dashboard which is written with TypeScript
More comments...