Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not to check the validity of an email address

dellsystem.me

Post reply on HN
Print view View original

71–80 of 243 posts

Re: How not to check the validity of an email address

#71

Post by pmiller2 »

evincarofautumn wrote: post #54
pmiller2 wrote: post #33

Man. Reading posts like these has several effects on me. One is utter shock that anyone could be so stupid. Another is to remind me of how little I know (because I'm sure in the eyes of someone who actually knows anything about security, I'd probably provoke the same reaction). I'm also amazed that some of the people responsible for these things can still find work. Here's my own personal story. The other day, I had…

Every financial institution I have interacted with has failed to store hashed passwords. So I looked up the reason why. Turns out that the Payment Card Industry Security Standards Council Data Security Standard (PCI DSS[1]) stipulates only that passwords and other sensitive are to be stored with encryption, and also transmitted as such†—but only amongst other financial institutions‡. So while they can’t keep your pas…

>> Render all passwords unreadable during transmission and storage on all system components using strong cryptography.

>(It appears this does not include cardholders.)

Ah, very informative. So, here is the problem: the fact that crypto is specified when it's the wrong tool for this particular job (that of storing my online banking password). I don't want my password encrypted. I wanted hashed and salted with something like bcrypt, and I don't want it sent in the clear over email.

Re: How not to check the validity of an email address

#72

Post by rmc »

asdfs wrote: post #55

Somewhat unrelated, but out of curiosity, does anyone know of a site that lists — for all popular languages — various libraries/code snippets/routines which one can use to correctly (according to the RFCs) check the validity of e-mail addresses? If not I may be compelled to create one.

The RFC-compliant email address is actually incredibly complex. There are loads of things that are RFC-valid email addresses that basically hardly anyone uses (like spaces).

Re: How not to check the validity of an email address

#73

Post by m_mueller »

joshfraser wrote: post #49

In college I was hired to build an auction site. I was billing my client $20 / hour and subcontracting out the work to some of my fellow classmates at $10 / hour. I was swamped with other work and didn't have much time to review the code. I just made sure it satisfied the specifications and shipped it. We launched the site and did a few hundred thousands dollars worth of transactions in the first 24 hours. Then somet…

This story almost had me in tears (a mix of schadenfreude and shame for my profession). I hope they learned something not to give business critical work to college students. Makes me think that IT Risk management should be right at the top of what MBAs have to learn.

Re: How not to check the validity of an email address

#75

Post by arethuza »

dclowd9901 wrote: post #41
mherdeg wrote: post #40

Gosh. For some reason, the "right answer" I expected to see was "do not try to validate the address; just send the e-mail and handle the bounce if it fails". There is a whole other layer which is very good at handling incorrect or undeliverable addresses.

I recently sat in on a presentation regarding javascript module loading. Someone in our company had taken it upon themselves to roll their own solution, because, shit, they're being paid and apparently have no oversight. The solution involved creating an entire cache/hash layer on the client using local storage. At the end of the presentation I had to try to be as respectful as possible when I asked why basic browser…

So they had used HTML5 local storage and missed the fact that HTML5 has a pretty nice offline caching feature?

Re: How not to check the validity of an email address

#76

Post by arethuza »

jlgreco wrote: post #65
arethuza wrote: post #58

Earlier quoted context omitted.

I've seen a surprising amount of code that does: if (aBoolean == true) { .... }

Typically that isn't done from ignorance, just some (imho misguided) idea about readability.

Probably the same kind of place that bans use of the ternary conditional operator because it's "too complicated"

Re: How not to check the validity of an email address

#77

Post by biot »

mmariani wrote: post #29
banachtarski wrote: post #25

Earlier quoted context omitted.

You're missing the sarcasm :P

Unless it's clearly stated sarcasm gets garbled over the wire. So in the hope of helping those who don't get it I decided to do the right thing just to be on the safe side. ;)

From now on, when you see a post taking the form "Clearly [obviously bad idea]", please read it out loud in The Simpson's Comic Book Guy voice and place extra emphasis on the irony. This ensures you will get the correct intent 99% of the time.

Re: How not to check the validity of an email address

#78

Post by sigkill »

mbenjaminsmith wrote: post #59
joshfraser wrote: post #57

Earlier quoted context omitted.

If I recall correctly the code looked something like this: if (!admin()) echo " window.location = '/signin'; "; delete_bid($_GET['bid_id']); ?>

When you think about it it's actually pretty elegant -- if your purpose is to write something that appears to work but will do the worst possible thing when crawled.

Something like the underhanded C contest then?

Re: How not to check the validity of an email address

#79

Post by hcayless »

jbaiter wrote: post #48
Glyptodon wrote: post #16

Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…

> hiring random "programmers" who have history or psychology degrees and think they can program because they made a form in PHP. That's pretty unfair to people coming from history or psychology who actually can write good code. Just because you don't have a degree in CS doesn't mean your code is shit. This is purely anecdotal, but my predecessor at my current job was a CS graduate and wrote code like in the OP.

Speaking as a former history major, thanks! :-) Code like that is written by people who don't really understand how their code works and there are plenty of CS majors in that category. With any luck, they are swiftly promoted to management where they can do less harm.

Re: How not to check the validity of an email address

#80

Post by sigkill »

jlgreco wrote: post #65
arethuza wrote: post #58

Earlier quoted context omitted.

I've seen a surprising amount of code that does: if (aBoolean == true) { .... }

Typically that isn't done from ignorance, just some (imho misguided) idea about readability.

Guilty as charged. Although it's practically the same, I prefer the TRUE part. Same with the !aBoolean and FALSE.
Post reply on HN