Live data from Hacker News

How not to check the validity of an email address

dellsystem.me

21–30 of 243 posts

Re: How not to check the validity of an email address

#21
post #12

[deleted]

The verbiage is sometimes used to exaggerate the condition of being stupid. I tend to enjoy that sort of flamboyant post on occasion , but others don't have much tolerance for it. YMMV. [EDIT] Original poster took the "drug usage" vernacular a bit too literally.

To be fair (I didn't see the original comment), I'm not sure which drugs would result in designing such a terrible solution. I'm sure addicts around the world would not want to be painted with such a broad brush ;)

Re: How not to check the validity of an email address

#22

I've had something similar delivered to me on a project I hired out. The most frustrating part was not the code but the developers reaction to why it was so bad. He had no idea what the big deal was and thought I was being nitpicky. Worse yet, was an initial claim that it was more efficient to do it that way. That was followed up with a claim that doing it differently wasn't possible. Needless to say, I stopped worki…

> Worse yet, was an initial claim that it was more efficient to do it that way

This is a classic excuse... so what if it leaks e-mail addresses (who looks at source code anyway?), makes clients wait (at least server's CPU is intact), and is just plain illegible (there is always a debugger if you want to fix a bug).

Re: How not to check the validity of an email address

#23
post #15

Clearly they should have optimized this by stripping the @mail.mcgill.ca on the server side before serving the list.

Clearly you must be joking. They should've kept the emails on the server-side the entire time. Then would be a matter of validating the request by searching the email in let's say SQLite. Would it be done? Probably not. But at least it'd be a lot stronger than sending sensitive data to clients every damn request.

Re: How not to check the validity of an email address

#24
post #9

McGill seems to use a LMS branded as "myCourses", apparently the newest label Blackboard is using for it's "Learn" line.

McGill switched to 'Desire2Learn' last summer as Blackboard no longer supports 'webCT', I think (access to old courses hosted on webCT is now very limited). 'myCourses' was the branding chosen by McGill... I think now they just call it 'myCourses2', after the switch.

Hm... how come Desire2Learn hasn't been sued by Blackboard yet? Usually, as soon as a uni stops switches away to use a competing course management software, the competitor get sued based on the LMS patent: http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=H...

UPDATE: they //did// get sued, but won, and the above patent is invalid now. Way to go! http://en.wikipedia.org/wiki/Blackboard_Inc.#Legal_matters

Re: How not to check the validity of an email address

#25
post #15

Clearly they should have optimized this by stripping the @mail.mcgill.ca on the server side before serving the list.

Clearly you must be joking. They should've kept the emails on the server-side the entire time. Then would be a matter of validating the request by searching the email in let's say SQLite. Would it be done? Probably not. But at least it'd be a lot stronger than sending sensitive data to clients every damn request.

You're missing the sarcasm :P

Re: How not to check the validity of an email address

#29

Earlier quoted context omitted.

Clearly you must be joking. They should've kept the emails on the server-side the entire time. Then would be a matter of validating the request by searching the email in let's say SQLite. Would it be done? Probably not. But at least it'd be a lot stronger than sending sensitive data to clients every damn request.

You're missing the sarcasm :P

Unless it's clearly stated sarcasm gets garbled over the wire. So in the hope of helping those who don't get it I decided to do the right thing just to be on the safe side. ;)

Re: How not to check the validity of an email address

#30
post #6

I've had something similar delivered to me on a project I hired out. The most frustrating part was not the code but the developers reaction to why it was so bad. He had no idea what the big deal was and thought I was being nitpicky. Worse yet, was an initial claim that it was more efficient to do it that way. That was followed up with a claim that doing it differently wasn't possible. Needless to say, I stopped worki…

>The most frustrating part was not the code but the developers reaction to why it was so bad. He had no idea what the big deal was and thought I was being nitpicky. This is always the worst. I've had experiences like that on many an occasion, where the person is simply like "huh? what's wrong?" You can't really fix that level of sheer incompetence, ignorance, and arrogance all wrapped into one.

> You can't really fix that level of sheer incompetence, ignorance, and arrogance all wrapped into one.

Sure you can. You can tell them why it's wrong and point them at reading material to fix it. Fixes incompetence and ignorance, and if you're lucky, arrogance. All wrapped into one.

Everyone had to start somewhere.

Post reply on HN