Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not to check the validity of an email address

dellsystem.me

Post reply on HN
Print view View original

91–100 of 243 posts

Re: How not to check the validity of an email address

#91

Post by harshreality »

dclowd9901 wrote: post #46
pmiller2 wrote: post #33

Man. Reading posts like these has several effects on me. One is utter shock that anyone could be so stupid. Another is to remind me of how little I know (because I'm sure in the eyes of someone who actually knows anything about security, I'd probably provoke the same reaction). I'm also amazed that some of the people responsible for these things can still find work. Here's my own personal story. The other day, I had…

Not necessarily. They may be using a reversible hash. Not much more secure, but it beats plaintext.

How does it beat plaintext?

A reversible hash isn't so much a hash as a bijective function. The security of all stored passwords then depends on the secrecy of the "hash" function.

Re: How not to check the validity of an email address

#92

Post by callahad »

asdfs wrote: post #55

Somewhat unrelated, but out of curiosity, does anyone know of a site that lists — for all popular languages — various libraries/code snippets/routines which one can use to correctly (according to the RFCs) check the validity of e-mail addresses? If not I may be compelled to create one.

The HTML5 standard actually defines a mostly-sane regex, which achieves that sanity through "a willful violation of RFC 5322, which defines a syntax for e-mail addresses that is simultaneously too strict (before the "@" character), too vague (after the "@" character), and too lax (allowing comments, whitespace characters, and quoted strings in manners unfamiliar to most users) to be of practical use here."

I like it.

Link: http://www.whatwg.org/specs/web-apps/current-work/multipage/...

Re: How not to check the validity of an email address

#93

Post by impressive »

sown wrote: post #36
Glyptodon wrote: post #16

Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…

> Every single legacy application I've ever worked on has had analogous code buried in it somewhere. I'm not old enough to be responsible for stuff like that but I am incompetent enough.

> I'm not old enough to be responsible for stuff like that but I am incompetent enough.

Now that is a great conversation starter! I assume you think you know more than the senior/lead/architect on the team. You might, but have fun with that mentality. It's not sure to last. :)

Re: How not to check the validity of an email address

#94

Post by einhverfr »

dpcx wrote: post #90
einhverfr wrote: post #89

Earlier quoted context omitted.

As a history major, I would agree with you. One of the real issues has to do with the mentality of coding. There are people regardless of background who approach coding as a job, and those who approach it as a craft. You want the latter, not the former. Here's my rule: If you don't look back at code you wrote a decade ago with some degree of horror, you are either an extraordinarily good coder, or you aren't a good c…

A decade is a long time at a single job... Try six months for a good start :)

If you are coding at all outside of work you will have code to look back at.

The question is:

Are you improving? Or are you beyond improvement?

Re: How not to check the validity of an email address

#95

Post by zamalek »

mherdeg wrote: post #69
retube wrote: post #43

Earlier quoted context omitted.

Not sure you read the article - there is an additional constraint in that only email addresses pertaining to the institution in question are allowed.

Yes, I decided to ignore that constraint because it doesn't make sense :). The article suggests performing "server-side membership testing, which is O(1)", but I think this is a bit too much — you can do even easier server-side validation without the list of all valid e-mail addresses, just the information that "@[anything but these two domains] is not an OK target".

> Yes, I decided to ignore that constraint because it doesn't make sense :).

Then the customer won't pay you because you ignored their requirements. They might even sue you because you breached contract.

If the customer asks you for a mound of poo you write them a mountain of poo; you try your damned hardest to make sure that the room smells like poo when they are using the app. If they go home and tell their wife and kids about the giant mound of steaming poo they have been using all day then you have succeeded because they will go back to the one developer who knows how to stick to their senseless requirements.

At the end of the day all the other developers are giving them apps built on principles that only make sense to developers - principles that only really make sense for millions of users and not the few thousand that they have. Principles don't put a house over your head and food on the table - money does.

Re: How not to check the validity of an email address

#96

Post by petenixey »

sown wrote: post #36
Glyptodon wrote: post #16

Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…

> Every single legacy application I've ever worked on has had analogous code buried in it somewhere. I'm not old enough to be responsible for stuff like that but I am incompetent enough.

I love your comment. Funny and humble.

Re: How not to check the validity of an email address

#98

Post by babuskov »

I'm sad to see so many smart people wasting their time discussing what some stupid person did. :(

I'm also disappointed I lost a couple of minutes of my life reading about this stupidity as well... just because it got 233 points.

So, I'm looking at YOU 233 who upvoted this. WHY DID YOU DO IT?

Re: How not to check the validity of an email address

#99

Post by nnnnni »

evincarofautumn wrote: post #45
Glyptodon wrote: post #16

Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…

> Switching it to use a single properly formatted SQL reduced load times to under a second. We need you to change it back because the system that scrapes that page is relying on the page load time.

What's worse is when fake delays are put into the code because (stupid) people think that the computer can't possibly be doing a good job if it retrieves the results in under a second. If it's "thinking", it's working well!

Re: How not to check the validity of an email address

#100

Post by asynchronous13 »

arethuza wrote: post #58
AYBABTME wrote: post #27

I've once come across: if (!Boolean.FALSE.equals(aBoolean)) { // ... } I was pretty baffled.

I've seen a surprising amount of code that does: if (aBoolean == true) { .... }

At university I worked with small unmanned aircraft. We had a crash due to a piece of code with this form:

  int landing_flag;
  ...
  if( landing_flag ) {
    do_landing();
  }
It was C code that pre-dated a boolean type. A single corrupt data packet in a wireless link made landing_flag == 2345923 (some arbitrary large value) and thus the landing routine was triggered mid-flight.

We changed every instance of if( flag ) to if( flag == specific_flag_value ) to ensure that particular bug didn't rear it's ugly head again. I keep doing that now.

Post reply on HN