Falsehoods Programmers Believe About Phone Numbers (2016) • Hacker News Board

Re: Falsehoods Programmers Believe About Phone Numbers (2016)

#171

Post by jcranmer » Thu, Feb 21, 2019, 4:06 PM UTC

scbrg wrote: post #110

duskwuff wrote: post #31

Earlier quoted context omitted.

Not sure why this is getting downvoted. It's a valid point. There is a gap between "technically valid email addresses" and "email addresses that reasonable people use".

Not that I downvoted, but the attitude annoys me. As a developer you have two options: 1) Do nothing and support all valid addresses (that your mail system can handle) 2) Spend development time to make your system not support all valid addresses. Why do you spend development effort to make your software worse ?

3) Realize that undervalidation of input can create opportunities to introduce backdoors into your system.

4) Realize that the added benefit of supporting weird formats are not worth the time to verify that it actually works.

As someone who works on an email client, I can absolutely tell you that using IP address literals and quoted localparts are more trouble than its worth. Chances are, the libraries you use can't handle them anyways. And if you don't try to support quoted localparts, than normalization is a lot easier. (Although I was once locked out of a system because I signed up with an email address that used capitals and the login form changed to lowercase it without changing the database storage, which meant no form I could spell it would cause it to match).

Re: Falsehoods Programmers Believe About Phone Numbers (2016)

#172

Post by thefringthing » Thu, Feb 21, 2019, 4:32 PM UTC

Here's a good one: All phone numbers can be reached using tone dialing. (I know of at least one phone number to which one can connect only using pulse dialing.)

Re: Falsehoods Programmers Believe About Phone Numbers (2016)

#173

Post by semi-extrinsic » Thu, Feb 21, 2019, 4:33 PM UTC

Thlom wrote: post #88

semi-extrinsic wrote: post #71

Earlier quoted context omitted.

What pisses me off to no end is the local (very popular) app Vipps for sending other people cash, e.g. to split a bill or buy something at a garage sale or whatever. Not only does it use phone numbers to identify the people you send money to, but it explicitly disallows two people with different phone numbers to have a shared bank account. Husband and wife with common debit account? Sorry, unsupported. WTF? What happ…

I don’t think bank account numbers are re-used. So in that case the transaction would just fail. And no one changes phone number in Norway. With a few exceptions of course.

Ah, but it's precisely this types of assumptions/disregard of "just a few exceptions" that we as programmers should avoid, as per TFA.

Re: Falsehoods Programmers Believe About Phone Numbers (2016)

#174

Post by MockObject » Thu, Feb 21, 2019, 4:38 PM UTC

thefringthing wrote: post #172

Here's a good one: All phone numbers can be reached using tone dialing. (I know of at least one phone number to which one can connect only using pulse dialing.)

How is that even possible?

Re: Falsehoods Programmers Believe About Phone Numbers (2016)

#175

Post by thecatspaw » Thu, Feb 21, 2019, 4:48 PM UTC

lubujackson wrote: post #10

robertAngst wrote: post #3

Alright, guess I'll be using email verification

Cool, I have a bulletproof regex for that

.+\@.+

... I hope

Re: Falsehoods Programmers Believe About Phone Numbers (2016)

#176

Post by jdrek1 » Thu, Feb 21, 2019, 4:51 PM UTC

icedchai wrote: post #162

krick wrote: post #64

Earlier quoted context omitted.

No, as much as I hate Facebook: fuck phone numbers. The idea of using phone number as a personal identification tool is so bad, I'm struggling to believe this is not some kind of conspiracy designed for the solely purpose of mocking the user. It is bad enough that phone numbers exist at all in the eyes of the end user by the year 2019, 15 years after Skype with user-friendly logins appeared and when about a half of t…

What do you suggest? Give everyone their own domain name? Phone numbers are more portable than third-party emails or logins to proprietary services like Skype. They can be moved from provider-to-provider.

I mean, why not? Doesn't even have to be a full domain name, even just assigning everyone their individual IPv6 address would work.

Re: Falsehoods Programmers Believe About Phone Numbers (2016)

#177

Post by PeterisP » Thu, Feb 21, 2019, 5:04 PM UTC

0xADEADBEE wrote: post #58

newscracker wrote: post #37

> An individual has a phone number > Some people do not own phones, or do not wish to provide you with their telephone number when asked. Do not require a user to provide a phone number unless it is essential, and whenever possible try and provide a fallback to accommodate these users. Signal, WhatsApp and Telegram are spectacular design failures on this point because they assume that every person has a phone number…

I agree fully. I've no clue why phone numbers a prerequisite for most email account providers or anything else I have to sign up for. There is no quicker way to make me bail on a signup flow that to demand something that has nothing to do with what I'm using. I barely use my phone as it is, so I'm excited to see what the world will look like for me when I finally eschew it!

Many services need a process that makes it hard for spammers to create a large number of accounts. If getting that costs a small number of real customers who can't use your service, oh well, the need to fight spammers is objectively more important to them as long as there aren't too many real customers with such problems.

Requiring phone numbers is a system that works quite reasonable, as most people have a phone number, and it's not that easy (and certainly not free) for a spammer to get thousands of phone numbers to make thousands of fake identities.

Re: Falsehoods Programmers Believe About Phone Numbers (2016)

#178

Post by PeterisP » Thu, Feb 21, 2019, 5:08 PM UTC

newscracker wrote: post #165

chrisbolt wrote: post #70

Earlier quoted context omitted.

>Signal, WhatsApp and Telegram are spectacular design failures on this point because they assume that every person has a phone number and also that every person has their own private (non-shared) and unique phone number. No, most people have a phone number and for most people that's their own phone number. That was a tradeoff for them. >Facebook, Google, etc., require a phone number for verification and believe that…

> No, most people have a phone number and for most people that's their own phone number. That was a tradeoff for them. That’s a very first world observation, and even there, this would be quite shaky if actual numbers were known. Also, I didn’t say or intend to mean that these companies made excluding people a goal. Their decisions, on the contrary, have resulted in that.

I'd argue that it's a reasonable tradeoff if you consider the users vs customers distinction. Many (most?) services want more users because they're either going to pay money directly or they are good targets for advertising. A first world user is valuable, a third world user - not so much (literally - if you look at costs for clickthroughs or user acquisition or ad revenue per user, there's easily a hundredfold difference). People who are poor enough to not have a phone of their own are probably not going to bring you much revenue, so it's no big deal if they can't access your service. I mean, a company isn't building that service to serve users, it's building that service only to earn money from these users.

Re: Falsehoods Programmers Believe About Phone Numbers (2016)

#179

Post by PeterisP » Thu, Feb 21, 2019, 5:11 PM UTC

bmn__ wrote: post #157

smcl wrote: post #149

Earlier quoted context omitted.

Geography and dialling codes aren’t necessarily aligned. So none of those countries share a border - it doesn’t mean there was never a weird issue with international dialling codes at some point (and, after I did a bit of searching, it seems that there was)

> none of those countries share a border Precisely. That should give the reader pause to think that there's something wrong. You're missing that the author mixed up Monaco with Montenegro (Kosovo's neighbour) because they sound similar. That's the perennial Austria/Australia confusion writ small.

There's no mixup.

Kosovo has numbers that are reachable through Monaco (not Kosovo's neighbour) country code.

Kosovo does not have numbers that are reachable through Montenegro (Kosovo's neighbour) country code.

Re: Falsehoods Programmers Believe About Phone Numbers (2016)

#180

Post by PeterisP » Thu, Feb 21, 2019, 5:17 PM UTC

segfaultbuserr wrote: post #51

macintux wrote: post #43

Earlier quoted context omitted.

Heck, last time I tried to register a Twitter account I couldn’t do so without a phone number to receive a PIN, and a burner number wouldn’t do it. C’est la guerre.

I can answer my original question - Google has been actively blacklisting all forms of VoIP numbers to their best efforts, so it's almost impossible to register one account without putting in your personal information. The last time I've checked it, there's only one workaround - you can purchase a real phone number connected to a computer from a cryptocurrency freelancer developer... Many stories from the U.S media a…

Is it hard to just buy a phone number? I can buy a prepaid SIM card for something like 1.5 eur and put it in a burner phone from a pawn shop for 5 eur, and I'd have a legitimate anonymous phone number that'll work for some time.