Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lies we tell ourselves about email addresses

gitpush--force.com

Post reply on HN
Print view View original

121–130 of 197 posts

Re: Lies we tell ourselves about email addresses

#121

Post by Freak_NL »

FinnKuhn wrote: post #112
Freak_NL wrote: post #82

This all old hat, unfortunately, and also a thing which will be gotten wrong by developers for years to come. Just shouting 'give me a regex for validating email addresses' will make an LLM like ChatGPT happily output bullshit suggesting some overlong regex which is flawed precisely as outlined by the linked article, even though no one is arguing for those long unmaintainable regexes once they've seen the light. Ah w…

I just tried this with Claude Opus 4.8 and I think it don't see any of those issues: The first sentence is that there is no single regex that perfectly validates every technically valid email address. I think that is a good start. It then recommends the regex used for and explains that this would cover the majority of email addresses used by actual people. It also shows an improved regex that handles dot-atom local p…

Does it say 'don't bother with a regex beyond checking it contains an @ surrounded by arbitrary pieces of text?' This still sounds like it is leading developers to conclude that they should use a too complex regex and then send a confirmation email.

Claude Sonnet says:

> A practical email regex that covers the vast majority of real-world addresses: > > ^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$

Which is still way more complex than needed (and takes effort to read), and buggy according to years of blog posts written about this topic.

Of course the problem is the developer asking for a regex at all, but the must-regex-email instinct seems heavily engrained in our collective psyche.

I have no idea what other pay-to-play models say.

Re: Lies we tell ourselves about email addresses

#122

Post by giancarlostoro »

greengreengrass wrote: post #119

I, too, get so frustrated by + addresses not working that I’ve configured my MDA to rewrite —- (double hyphen) to plus, and use this in spite on sites that dislike the + variant. I’ve made it impossible to /not/ host my own mail delivery infrastructure now if I want every address I’ve ever given out to still work. Although more recently I’ve moved to a catch all domain for throwaway, which is even better. It confuses…

Been wanting to do something similar my only hang up is coming up with a domain they wont butcher. When I got my passport I guess it must be OCR but they butchered my email completely.

Re: Lies we tell ourselves about email addresses

#123

Post by kgwxd »

greengreengrass wrote: post #119

I, too, get so frustrated by + addresses not working that I’ve configured my MDA to rewrite —- (double hyphen) to plus, and use this in spite on sites that dislike the + variant. I’ve made it impossible to /not/ host my own mail delivery infrastructure now if I want every address I’ve ever given out to still work. Although more recently I’ve moved to a catch all domain for throwaway, which is even better. It confuses…

> as {their company name}@mydomain.com

People are still doing that? To prevent spam? To "catch" the company leaking/selling your address? Now the spammers know they can likely use anything@domain, and it'll get to your eyeballs in some capacity. Also, companies have no shame anymore, they don't care if you know.

Re: Lies we tell ourselves about email addresses

#124

Post by sylware »

Many email servers do forget about the email adresses with IP literals, that for people who are self-hosted without paying for DNS.

mailbox@[x.x.x.x] and mailbox@[ipv6:...] (and probably without "ipv6" prefix once ipv4 is gone).

This is stronger than SPF since the second the IP of the sending SMTP server does not match the IP in the "from" headers and the envelope, the email is dropped, not even going into spam.

For instance, currently, if I send an email to a gmail slave, their parsers will ask for... a DNS PTR record, Oo "Geniuses" at work, or conveniently breaking all interop with small tech?

Re: Lies we tell ourselves about email addresses

#125

Post by volemo »

kgwxd wrote: post #123
greengreengrass wrote: post #119

I, too, get so frustrated by + addresses not working that I’ve configured my MDA to rewrite —- (double hyphen) to plus, and use this in spite on sites that dislike the + variant. I’ve made it impossible to /not/ host my own mail delivery infrastructure now if I want every address I’ve ever given out to still work. Although more recently I’ve moved to a catch all domain for throwaway, which is even better. It confuses…

> as {their company name}@mydomain.com People are still doing that? To prevent spam? To "catch" the company leaking/selling your address? Now the spammers know they can likely use anything@domain, and it'll get to your eyeballs in some capacity. Also, companies have no shame anymore, they don't care if you know.

But the portion of us is so negligible that it’s not worth for the spammers to handle our edge case. :D

Re: Lies we tell ourselves about email addresses

#126

Post by Ekaros »

atoav wrote: post #68

One thing I have learned about verification is: Don't just put a link into your mail that directly verifies an email when visited. At least put some button or code input field there. Why? There are mail clients that will automatically open links for users and if that link is now invalid the user is confused about being able to click them.

Also much more critically. Just because mail is successfully delivered does not mean it is in the right inbox. So just link being visited by automation is far from enough in confirming that right person received the mail.

Re: Lies we tell ourselves about email addresses

#127

Post by [deleted] »

kgwxd wrote: post #123
greengreengrass wrote: post #119

I, too, get so frustrated by + addresses not working that I’ve configured my MDA to rewrite —- (double hyphen) to plus, and use this in spite on sites that dislike the + variant. I’ve made it impossible to /not/ host my own mail delivery infrastructure now if I want every address I’ve ever given out to still work. Although more recently I’ve moved to a catch all domain for throwaway, which is even better. It confuses…

> as {their company name}@mydomain.com People are still doing that? To prevent spam? To "catch" the company leaking/selling your address? Now the spammers know they can likely use anything@domain, and it'll get to your eyeballs in some capacity. Also, companies have no shame anymore, they don't care if you know.

[deleted]

Re: Lies we tell ourselves about email addresses

#128

Post by scottmcmac »

kgwxd wrote: post #123
greengreengrass wrote: post #119

I, too, get so frustrated by + addresses not working that I’ve configured my MDA to rewrite —- (double hyphen) to plus, and use this in spite on sites that dislike the + variant. I’ve made it impossible to /not/ host my own mail delivery infrastructure now if I want every address I’ve ever given out to still work. Although more recently I’ve moved to a catch all domain for throwaway, which is even better. It confuses…

> as {their company name}@mydomain.com People are still doing that? To prevent spam? To "catch" the company leaking/selling your address? Now the spammers know they can likely use anything@domain, and it'll get to your eyeballs in some capacity. Also, companies have no shame anymore, they don't care if you know.

Yeah, I do the same, but without the catchall for exactly that reason. If I start getting spam, the e-mail gets disabled.

Re: Lies we tell ourselves about email addresses

#129

Post by AndroTux »

teo_zero wrote: post #80
AndroTux wrote: post #76

Earlier quoted context omitted.

there's bad actors that use bots to sign up to websites using bogus data.

Wait! Are you saying that you process new registration attempts without any rate limit, captcha, etc? Because the moment to filter out (or limit) bad actors is before they submit an email address, not through it.

Yeah, good luck with that. Captchas are basically useless in today’s world, so are IP rate limits for anything just a little sophisticated. Of course it helps, but if you think this solves all problems, you live in a dream world.

Re: Lies we tell ourselves about email addresses

#130

Post by kurttheviking »

kgwxd wrote: post #123
greengreengrass wrote: post #119

I, too, get so frustrated by + addresses not working that I’ve configured my MDA to rewrite —- (double hyphen) to plus, and use this in spite on sites that dislike the + variant. I’ve made it impossible to /not/ host my own mail delivery infrastructure now if I want every address I’ve ever given out to still work. Although more recently I’ve moved to a catch all domain for throwaway, which is even better. It confuses…

> as {their company name}@mydomain.com People are still doing that? To prevent spam? To "catch" the company leaking/selling your address? Now the spammers know they can likely use anything@domain, and it'll get to your eyeballs in some capacity. Also, companies have no shame anymore, they don't care if you know.

I do but mostly for coordination and comms sharing with my spouse by using group aliases. Summer camp registration, school nurse contact info, car insurance, library holds...all super convenient to get joint notifications for things. And yeah, also to remember who we gave contact info to which we can drop if it gets spammy.
Post reply on HN