I keep writing about NULL problems, yet every day the news reminds me: NULL is still alive and kicking. I keep writing about NULL problems, yet every day the news reminds me: NULL is still alive and kicking. TL;DR: Avoid NULL references that cause runtime crashes by using proper validation and null-safe patterns TL;DR: Avoid NULL references that cause runtime crashes by using proper validation and null-safe patterns Problems 😔 Runtime crashes
Big incidents and outages
Unpredictable behavior
Hard debugging
User frustration
System instability
Poor reliability Runtime crashes crashes Big incidents and outages incidents and outages Unpredictable behavior Hard debugging User frustration System instability Poor reliability In Google Cloud case: Google Cloud Poor error handling: The code crashed instead of gracefully handling null data
No feature flags: New code wasn't gradually rolled out with safety controls
Instant global replication: Bad data spreads worldwide immediately like in Crowdstrike Incident
No randomized backoff: Recovery caused infrastructure overload
Inadequate testing: The failure scenario was never tested during deployment Poor error handling: The code crashed instead of gracefully handling null data No feature flags: New code wasn't gradually rolled out with safety controls feature flags Instant global replication: Bad data spreads worldwide immediately like in Crowdstrike Incident Crowdstrike Incident No randomized backoff: Recovery caused infrastructure overload Inadequate testing: The failure scenario was never tested during deployment Solutions 😃 Avoid nulls
Use null checks if nulls are beyond your control (for example, an external API)
Initialize default values
Implement guard clauses
Use null objects
Don't use optionals Avoid nulls nulls Use null checks if nulls are beyond your control (for example, an external API) Initialize default values Implement guard clauses Use null objects null objects Don't use optionals optionals Refactorings ⚙️ https://hackernoon.com/code-refactoring-tips-no-015-remove-null https://hackernoon.com/code-refactoring-tips-no-015-remove-null Context 💬 On June 12th, 2025, a major outage happened on Google Cloud Platform. major outage It affected dozens of Google Cloud and Google Workspace services globally from approximately 10:49 AM to 1:49 PM PDT (3 hours total), with some services taking longer to recover fully. The outage was caused by a cascading failure in Google's API management system: The Trigger: The Trigger: On May 29, 2025, Google deployed new code to "Service Control" (their API management system) that added additional quota policy checks. This code had a critical flaw. It lacked proper error handling and wasn't protected by feature flags. error handling feature flags The Failure: The Failure: On June 12, a policy change containing blank/NULL fields was pushed to the global database that Service Control uses. When Service Control attempted to process these blank fields, it encountered a null pointer in the unprotected code path, resulting in the binaries crashing in an infinite loop. NULL Global Impact: Global Impact: Since quota management is global, this corrupted data was replicated worldwide within seconds, causing Service Control to crash in every region. Null pointer exceptions happen when you try to access methods or properties on objects that don't exist. This happens when variables contain null references instead of valid object instances. The problem becomes particularly dangerous in production environments where these exceptions can crash your application and frustrate users. Languages like Java, C#, and JavaScript are especially prone to this issue, though modern language features and patterns can help you avoid these crashes entirely. Nulls have been a significant problem in the software industry for decades, yet software engineers continue to ignore them despite the warnings of their creator. https://hackernoon.com/null-the-billion-dollar-mistake-8t5z32d6?embedable=true https://hackernoon.com/null-the-billion-dollar-mistake-8t5z32d6?embedable=true Sample Code 📖 Wrong ❌ public class ServiceControlPolicy {
  private SpannerDatabase spannerDB;
  private QuotaManager quotaManager;
    
  public void applyPolicyChange(PolicyChange change) {
      // NULL POINTER: change can be null
      Policy policy = spannerDB.getPolicy(change.getPolicyId());
      // NULL POINTER: policy can be null from the database
      String quotaField = policy.getQuotaField();
      // NULL POINTER: quotaField can be null (blank field)
      quotaManager.updateQuota(quotaField, change.getValue());
  }
    
  public void exerciseQuotaChecks(String region) {
      // NULL POINTER: policies list can be null
      List<Policy> policies = spannerDB.getPoliciesForRegion(region);
      for (Policy policy : policies) {
          // NULL POINTER: individual policy can be null
          String quotaValue = policy.getQuotaField();
          // NULL POINTER: quotaValue can be null before trim()
          quotaManager.checkQuota(quotaValue.trim());
      }
  }
    
  public boolean validatePolicyData(Policy policy) {
      // NULL POINTER: policy parameter can be null
      String quotaField = policy.getQuotaField();
      // NULL POINTER: quotaField can be null before length()
      return quotaField.length() > 0 && 
             !quotaField.equals("null");
  }
    
  public void replicateGlobally(PolicyChange change) {
      List<String> regions = getGlobalRegions();
      for (String region : regions) {
          // NULL POINTER: change.getPolicy() can return null
          spannerDB.insertPolicy(region, change.getPolicy());
      }
  }
} public class ServiceControlPolicy {
  private SpannerDatabase spannerDB;
  private QuotaManager quotaManager;
    
  public void applyPolicyChange(PolicyChange change) {
      // NULL POINTER: change can be null
      Policy policy = spannerDB.getPolicy(change.getPolicyId());
      // NULL POINTER: policy can be null from the database
      String quotaField = policy.getQuotaField();
      // NULL POINTER: quotaField can be null (blank field)
      quotaManager.updateQuota(quotaField, change.getValue());
  }
    
  public void exerciseQuotaChecks(String region) {
      // NULL POINTER: policies list can be null
      List<Policy> policies = spannerDB.getPoliciesForRegion(region);
      for (Policy policy : policies) {
          // NULL POINTER: individual policy can be null
          String quotaValue = policy.getQuotaField();
          // NULL POINTER: quotaValue can be null before trim()
          quotaManager.checkQuota(quotaValue.trim());
      }
  }
    
  public boolean validatePolicyData(Policy policy) {
      // NULL POINTER: policy parameter can be null
      String quotaField = policy.getQuotaField();
      // NULL POINTER: quotaField can be null before length()
      return quotaField.length() > 0 && 
             !quotaField.equals("null");
  }
    
  public void replicateGlobally(PolicyChange change) {
      List<String> regions = getGlobalRegions();
      for (String region : regions) {
          // NULL POINTER: change.getPolicy() can return null
          spannerDB.insertPolicy(region, change.getPolicy());
      }
  }
} Right 👉 public class ServiceControlPolicy {
  private SpannerDatabase spannerDB;
  private QuotaManager quotaManager;
    
  public void applyPolicyChange(PolicyChange change) {
      if (change == null) {
          // Assuming it comes from an external API
          // Beyond your control
          change = new NullPolicyChange();
      }
      
      Policy policy = findPolicyOrNull(change.policyId());
      String quotaField = policy.quotaField();
      if (!quotaField.isEmpty()) {
          quotaManager.updateQuota(quotaField, change.value());
      }
  }
    
  public void exerciseQuotaChecks(String region) {
      if (region == null || region.isEmpty()) {
          // Assuming it comes from an external API
          // Beyond your control
          return;
      }
      
      List<Policy> policies = policiesOrEmpty(region);
      
      for (Policy policy : policies) {
          String quotaValue = policy.quotaField();
          if (!quotaValue.isEmpty()) {
              quotaManager.checkQuota(quotaValue.trim());
          }
      }
  }
    
  public boolean validatePolicyData(Policy policy) {
      if (policy == null) {
          // Assuming it comes from an external API
          // Beyond your control
          // From now on, you wrap it
          policy = new NullPolicy();
      }
      
      String quotaField = policy.quotaField();
      return quotaField.length() > 0;
  }
    
  public void replicateGlobally(PolicyChange change) {
      if (change == null) {
          // Assuming it comes from an external API
          // Beyond your control
          // From now on, you wrap it
          change = new NullPolicyChange();
      }
        
      Policy policy = change.policy();
      if (policy == null) {
          // Assuming it comes from an external API
          // Beyond your control
          // From now on, you wrap it
          policy = new NullPolicy();
      }
        
      List<String> regions = globalRegions();
      for (String region : regions) {
          spannerDB.insertPolicy(region, policy);
      }
  }
    
  private Policy findPolicyOrNull(String policyId) {
      Policy policy = spannerDB.policy(policyId);
      return policy != null ? policy : new NullPolicy();
  }
    
  private List<Policy> policiesOrEmpty(String region) {
      List<Policy> policies = spannerDB.policiesForRegion(region);
      if (policies == null) {
          // This is a good NullObject
          return Collections.emptyList();
      }
      
      return policies.stream()
              .map(p -> p != null ? p : new NullPolicy())
              .collect(Collectors.toList());
  }
}

class NullPolicy extends Policy {
  @Override
  public String quotaField() { return ""; }
    
  @Override
  public String policyId() { return "unknown-policy"; }
    
  @Override
  public Map<String, String> metadata() { 
      return Collections.emptyMap(); 
  }
}

class NullPolicyChange extends PolicyChange {
  @Override
  public String policyId() { return ""; }
    
  @Override
  public String value() { return ""; }
    
  @Override
  public Policy policy() { return new NullPolicy(); }
} public class ServiceControlPolicy {
  private SpannerDatabase spannerDB;
  private QuotaManager quotaManager;
    
  public void applyPolicyChange(PolicyChange change) {
      if (change == null) {
          // Assuming it comes from an external API
          // Beyond your control
          change = new NullPolicyChange();
      }
      
      Policy policy = findPolicyOrNull(change.policyId());
      String quotaField = policy.quotaField();
      if (!quotaField.isEmpty()) {
          quotaManager.updateQuota(quotaField, change.value());
      }
  }
    
  public void exerciseQuotaChecks(String region) {
      if (region == null || region.isEmpty()) {
          // Assuming it comes from an external API
          // Beyond your control
          return;
      }
      
      List<Policy> policies = policiesOrEmpty(region);
      
      for (Policy policy : policies) {
          String quotaValue = policy.quotaField();
          if (!quotaValue.isEmpty()) {
              quotaManager.checkQuota(quotaValue.trim());
          }
      }
  }
    
  public boolean validatePolicyData(Policy policy) {
      if (policy == null) {
          // Assuming it comes from an external API
          // Beyond your control
          // From now on, you wrap it
          policy = new NullPolicy();
      }
      
      String quotaField = policy.quotaField();
      return quotaField.length() > 0;
  }
    
  public void replicateGlobally(PolicyChange change) {
      if (change == null) {
          // Assuming it comes from an external API
          // Beyond your control
          // From now on, you wrap it
          change = new NullPolicyChange();
      }
        
      Policy policy = change.policy();
      if (policy == null) {
          // Assuming it comes from an external API
          // Beyond your control
          // From now on, you wrap it
          policy = new NullPolicy();
      }
        
      List<String> regions = globalRegions();
      for (String region : regions) {
          spannerDB.insertPolicy(region, policy);
      }
  }
    
  private Policy findPolicyOrNull(String policyId) {
      Policy policy = spannerDB.policy(policyId);
      return policy != null ? policy : new NullPolicy();
  }
    
  private List<Policy> policiesOrEmpty(String region) {
      List<Policy> policies = spannerDB.policiesForRegion(region);
      if (policies == null) {
          // This is a good NullObject
          return Collections.emptyList();
      }
      
      return policies.stream()
              .map(p -> p != null ? p : new NullPolicy())
              .collect(Collectors.toList());
  }
}

class NullPolicy extends Policy {
  @Override
  public String quotaField() { return ""; }
    
  @Override
  public String policyId() { return "unknown-policy"; }
    
  @Override
  public Map<String, String> metadata() { 
      return Collections.emptyMap(); 
  }
}

class NullPolicyChange extends PolicyChange {
  @Override
  public String policyId() { return ""; }
    
  @Override
  public String value() { return ""; }
    
  @Override
  public Policy policy() { return new NullPolicy(); }
} Detection 🔍 [x]Semi-Automatic [x]Semi-Automatic [x] You can detect potential null pointer exceptions by reviewing code for direct method calls on objects without null checks. Linters can examine return values from methods that might return Null, looking for uninitialized object fields, and using static analysis tools that flag potential null dereferences. Null Modern IDEs often highlight these issues with warnings. Tags 🏷️ Null Null Level 🔋 [x]Intermediate [x]Intermediate [x] Why the Bijection Is Important 🗺️ In the real world, objects either exist or they don't. real world When you model this correctly in your program, you create a clear one-to-one correspondence between reality and code. one-to-one correspondence Breaking this bijection by allowing null references creates phantom objects that exist in your code but not in the real world, leading to crashes when you try to interact with these non-existent entities. If you choose to name your license plate "NULL", you will get a lot of parking tickets a lot of parking tickets AI Generation 🤖 AI generators frequently create code with null pointer vulnerabilities because they focus on happy path scenarios. They often generate method calls without considering edge cases where objects might be NULL, especially in complex object hierarchies or when dealing with external data sources. NULL AI Detection 🧲 AI tools can detect and fix null pointer issues when you provide clear instructions about defensive programming practices. Try Them! 🛠 Remember: AI Assistants make lots of mistakes Remember: AI Assistants make lots of mistakes Suggested Prompt: Remove all Null References Suggested Prompt: Remove all Null References Without Proper Instructions

With Specific Instructions



ChatGPT

ChatGPT



Claude

Claude



Perplexity

Perplexity



Copilot

Copilot



Gemini

Gemini



DeepSeek

DeepSeek



Meta AI

Meta AI



Grok

Grok



Qwen

Qwen Without Proper Instructions

With Specific Instructions



ChatGPT

ChatGPT



Claude

Claude



Perplexity

Perplexity



Copilot

Copilot



Gemini

Gemini



DeepSeek

DeepSeek



Meta AI

Meta AI



Grok

Grok



Qwen

Qwen Without Proper Instructions

With Specific Instructions Without Proper Instructions Without Proper Instructions With Specific Instructions With Specific Instructions ChatGPT

ChatGPT ChatGPT ChatGPT ChatGPT ChatGPT ChatGPT ChatGPT Claude

Claude Claude Claude Claude Claude Claude Claude Perplexity

Perplexity Perplexity Perplexity Perplexity Perplexity Perplexity Perplexity Copilot

Copilot Copilot Copilot Copilot Copilot Copilot Copilot Gemini

Gemini Gemini Gemini Gemini Gemini Gemini Gemini DeepSeek

DeepSeek DeepSeek DeepSeek DeepSeek DeepSeek DeepSeek DeepSeek Meta AI

Meta AI Meta AI Meta AI Meta AI Meta AI Meta AI Meta AI Grok

Grok Grok Grok Grok Grok Grok Grok Qwen

Qwen Qwen Qwen Qwen Qwen Qwen Qwen Conclusion 🏁 Null pointer exceptions represent one of the most common runtime errors in programming. You can remove most of these crashes by implementing proper null checks, using the Null Object design pattern, and adopting defensive programming practices. The small overhead of validation code pays off significantly in application stability and user experience. Relations 👩‍❤️‍💋‍👨 https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-iii-t7h3zkv https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-iii-t7h3zkv https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xliii https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xliii https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xxxix https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xxxix https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xxvi https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xxvi https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xlii https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-xlii https://hackernoon.com/code-smell-252-nullcustomer?embedable=true https://hackernoon.com/code-smell-252-nullcustomer?embedable=true https://hackernoon.com/code-smell-260-crowdstrike-null?embedable=true https://hackernoon.com/code-smell-260-crowdstrike-null?embedable=true More Information 📕 https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1SsW?embedable=true https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1SsW?embedable=true https://www.wired.com/story/null-license-plate-landed-one-hacker-ticket-hell/?embedable=true https://www.wired.com/story/null-license-plate-landed-one-hacker-ticket-hell/?embedable=true https://www.forbes.com/sites/zakdoffman/2019/08/14/hacker-gets-12000-in-parking-tickets-after-null-license-plate-trick-backfires/?embedable=true https://www.forbes.com/sites/zakdoffman/2019/08/14/hacker-gets-12000-in-parking-tickets-after-null-license-plate-trick-backfires/?embedable=true Disclaimer 📘 Code Smells are my opinion. opinion I call it my billion-dollar mistake. It was the invention of the null reference in 1965 I call it my billion-dollar mistake. It was the invention of the null reference in 1965 Tony Hoare Tony Hoare https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true This article is part of the CodeSmell Series. https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-i-xqz3evd?embedable=true https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-i-xqz3evd?embedable=true

Vibe Coding Explained in 5 Levels of Sophistication

Code Smell 303 - How to Prevent Breaking Existing Clients When You Make Changes

Buy My Book

Share your ideas with me!

Read My Stories

Buy Me a Coffee

Too Long; Didn't Read

Make resilience your competitive advantage

Code Smell 304: Null Pointer Exception - How to Avoid NULL References That Cause Runtime Crashes

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

Code Smell 309 - Query Parameter API Versioning

106 Stories To Learn About Clean Code

100 Pieces of Programming Advice from the Book Clean Code by Robert Martin

110 Stories To Learn About Refactoring

3 Things Coding And Prose Writing Have In Common According To Cory House

Code Smell 309 - Query Parameter API Versioning

106 Stories To Learn About Clean Code

100 Pieces of Programming Advice from the Book Clean Code by Robert Martin

110 Stories To Learn About Refactoring

3 Things Coding And Prose Writing Have In Common According To Cory House

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps