Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Validating Email Addresses With Your Complex Regex

davidcel.is

Post reply on HN
Print view View original

191–200 of 211 posts

Re: Stop Validating Email Addresses With Your Complex Regex

#191

Post by snowwrestler »

anonyfuss wrote: post #140
tomjen3 wrote: post #138

Earlier quoted context omitted.

Honestly if the user is signing up with an ip email then you really shouldn't accept it - it may be valid but something fishy is going on for sure.

Why does it matter? If I managed to acquire the 8.8.8.0/24 netblock, I might very well want to use 'user@8.8.8.8' as my e-mail address. I don't see why it has any material affect on someone requesting e-mail addresses: if it's valid, then it's valid. This seems to be an example of the misplaced sense of propriety with which people approach validating e-mail addresses -- that somehow, your job isn't just to help the u…

I do see a misplaced sense of propriety here, and it's coming from you. Blocking a few valid email addresses in the service of helping most customers is just a business decision, not a moral issue.

For example: requiring shirt and shoes in a restaurant will block some customers from dining there. But it improves the experience for all the other diners, so it's a net win.

Re: Stop Validating Email Addresses With Your Complex Regex

#192

Post by baudehlo »

anonyfuss wrote: post #183
baudehlo wrote: post #176

Earlier quoted context omitted.

Postfix (and the other big receivers) will ignore it, but will send using the proper RFCs. It's still a good sign of a badly written bulk mail engine, and worth rejecting for.

> It's still a good sign of a badly written bulk mail engine, and worth rejecting for. No, it might be worth scoring the e-mail with a spam filter, but the MTA shouldn't be overzealously throwing away e-mail.

My MTA doesn't "throw away" email. It sends back a 5xx with an appropriate message that the sending end isn't RFC compliant. Absolutely nothing wrong with that - if it's a legit sender they know I didn't get the mail.

Re: Stop Validating Email Addresses With Your Complex Regex

#193

Post by stonemetal »

anonyfuss wrote: post #190
stonemetal wrote: post #189

Earlier quoted context omitted.

Does this feel slow to you? https://www.emailitin.com/email_validator Yes, it did.

I got a response in 55ms. We must have different definitions of 'slow'.

I must have hit a speed bump somewhere then, it took around 2 seconds to look up my email address.

Re: Stop Validating Email Addresses With Your Complex Regex

#194

Post by anonyfuss »

baudehlo wrote: post #192
anonyfuss wrote: post #183

Earlier quoted context omitted.

> It's still a good sign of a badly written bulk mail engine, and worth rejecting for. No, it might be worth scoring the e-mail with a spam filter, but the MTA shouldn't be overzealously throwing away e-mail.

My MTA doesn't "throw away" email. It sends back a 5xx with an appropriate message that the sending end isn't RFC compliant. Absolutely nothing wrong with that - if it's a legit sender they know I didn't get the mail.

At which point the legit sender does what -- replace their MtA? More likely they just contact thir receipient out-of-band (eg; gmail) and avoid your over-zealous mta.

Whether you think you're 'Throwing away' is just semantics. From a user's perspective that's exactly what you're doing.

Re: Stop Validating Email Addresses With Your Complex Regex

#195

Post by [deleted] »

hrktb wrote: post #146
bjhoops1 wrote: post #126

Earlier quoted context omitted.

> because some tester opens a ticket saying you can enter an invalid email in the email field? This is the source of 80% of all "bugs" I've fixed over the years. Another personal favorite: If you enter WWWWWWWWWWWWWWWWWWWW W WWWWWWWWWWWWWWWW for name, it messes up the layout on the display screen.

That's roughly 40 chars ? People coming from some regions easily have 20 to 30 chars for the family name alone [1]. That's more or less the length of our test string if the add the given name(s). [1] http://news.bbc.co.uk/2/hi/africa/5651310.stm

[deleted]

Re: Stop Validating Email Addresses With Your Complex Regex

#196

Post by tomjen3 »

anonyfuss wrote: post #140
tomjen3 wrote: post #138

Earlier quoted context omitted.

Honestly if the user is signing up with an ip email then you really shouldn't accept it - it may be valid but something fishy is going on for sure.

Why does it matter? If I managed to acquire the 8.8.8.0/24 netblock, I might very well want to use 'user@8.8.8.8' as my e-mail address. I don't see why it has any material affect on someone requesting e-mail addresses: if it's valid, then it's valid. This seems to be an example of the misplaced sense of propriety with which people approach validating e-mail addresses -- that somehow, your job isn't just to help the u…

Because those who would sign up with them would be 1 geek with an ip address and 200 scammers who didn't want to pay 10 bucks for a domain.

I imagine I would have trouble renting a car with cash, even though it would allow more customers.

Re: Stop Validating Email Addresses With Your Complex Regex

#197

Post by baudehlo »

anonyfuss wrote: post #194
baudehlo wrote: post #192

Earlier quoted context omitted.

My MTA doesn't "throw away" email. It sends back a 5xx with an appropriate message that the sending end isn't RFC compliant. Absolutely nothing wrong with that - if it's a legit sender they know I didn't get the mail.

At which point the legit sender does what -- replace their MtA? More likely they just contact thir receipient out-of-band (eg; gmail) and avoid your over-zealous mta. Whether you think you're 'Throwing away' is just semantics. From a user's perspective that's exactly what you're doing.

It's my MTA, I'm the "user". My server, my rules. Just like if you want to come into my house you come in the front door and take your shoes off, not crash through the window in muddy boots.

Re: Stop Validating Email Addresses With Your Complex Regex

#199

Post by baudehlo »

korg250 wrote: post #178
baudehlo wrote: post #159

This has come up so often on Hacker News that I decided to create a very simple JSON API for checking email addresses. Free to use for anyone. Performs the right regexp check for email addresses based on RFC-5321 rules (not the oft-quoted but incorrect RFC-822 rules, which are for mail headers), performs MX lookups to ensure mail can be delivered, and performs the same "did you mean" type checks that kicksend's mailc…

If I type name@outlok.com instead of name@outlook.com, it says the email is valid - when in fact it is not.

The domain outlok.com has an A record which points to 208.87.35.108 which I can even connect to on port 25 (though I don't perform that test). Until you actually mail that address there's no way to distinguish this from a valid email.

Re: Stop Validating Email Addresses With Your Complex Regex

#200

Post by chris_mahan »

baby wrote: post #188
chris_mahan wrote: post #96

Earlier quoted context omitted.

Maybe it is less resource-intensive to actually send an email rather than use a heavy regex to validate the email?

I really don't think so since you're soliciting an email server while a regex is just some code that has to be run, and they are run on a tiny string (a mail is never really long). Also it's bothering for the user, if you need mail confirmation then do it, but otherwise it should be a RULE OF THUMB to always avoid annoying user. Thus avoid mail confirmation. This article is actually a really bad advice. I don't know…

I'm not completely sure that I get annoyed when a web site sends me a confirmation email. It helps me know that the site indeed knows my correct email.
Post reply on HN