How not to check the validity of an email address • Hacker News Board

Re: How not to check the validity of an email address

#141

Post by pdonis » Wed, Sep 04, 2013, 2:22 PM UTC

mherdeg wrote: post #69

retube wrote: post #43

Earlier quoted context omitted.

Not sure you read the article - there is an additional constraint in that only email addresses pertaining to the institution in question are allowed.

Yes, I decided to ignore that constraint because it doesn't make sense :). The article suggests performing "server-side membership testing, which is O(1)", but I think this is a bit too much — you can do even easier server-side validation without the list of all valid e-mail addresses, just the information that "@[anything but these two domains] is not an OK target".

Yes, I decided to ignore that constraint because it doesn't make sense :).

It does if you want to give the user instant feedback when they type an address that is in a valid domain but does not actually exist, as Ntrails pointed out. If you think a requirement doesn't make sense, you're supposed to ask the client, not just arbitrarily ignore it.

Re: How not to check the validity of an email address

#142

Post by rachelbythebay » Wed, Sep 04, 2013, 2:32 PM UTC

aestra wrote: post #131

rachelbythebay wrote: post #7

Gradebusters / Making the Grade, or something with names like that, used to use a Java applet to "secure" the web site with student grades. You could just download the applet and decompile it to figure out their trivial encoding of the IDs and PINs (which were just params in the HTML). Or you could figure out just an ID (typically a student ID number, although more than a few were social security numbers, apparently)…

So were unauthorized users able to modify grades? Or just view them?

View. It was a system where the teacher would export things from their personal machine and it would dump a bunch of files into their ~/public_html.

Re: How not to check the validity of an email address

#143

Post by einhverfr » Wed, Sep 04, 2013, 2:32 PM UTC

vxNsr wrote: post #124

krisgee wrote: post #109

Earlier quoted context omitted.

Six months? I come in after the weekend and constantly want to rewrite the whole goddamn thing.

This^ and I'm only a student; I'll write a program in the evening and by the following morning I'm all, no, no, no!

I tend to spend a lot of time planning (almost as much as coding). I do tend to notice big changes over a period of 2-3 years but areas where I can notice improvements in say six months.

Re: How not to check the validity of an email address

#144

Post by drdaeman » Wed, Sep 04, 2013, 2:35 PM UTC

mason240 wrote: post #120

asdfs wrote: post #55

Somewhat unrelated, but out of curiosity, does anyone know of a site that lists — for all popular languages — various libraries/code snippets/routines which one can use to correctly (according to the RFCs) check the validity of e-mail addresses? If not I may be compelled to create one.

@"^[^@]{1,}[@]{1}[^@]{1,}\.{1}[^@]{1,}$" I check it with this RegEx to make sure it's in the right format of [string]@[string].[string] to make sure that user at least tries to enter an email address, but beyond that sending and email and getting a response is the only way.

> @"^[^@]{1,}[@]{1}[^@]{1,}\.{1}[^@]{1,}$"

Is not

> [string]@[string].[string]

It's mere ^.+@.+\..+ (in both POSIX extended and PCRE dialects) that properly represents the latter.

And even such regexp filters out many technically-valid but obscure cases of RFC-compliant email addresses (for example ai, io, kh and ws TLDs have MX records, and supposedly hostmaster@io should be a valid email address).

Re: How not to check the validity of an email address

#145

Post by drderidder » Wed, Sep 04, 2013, 2:36 PM UTC

AYBABTME wrote: post #27

I've once come across: if (!Boolean.FALSE.equals(aBoolean)) { // ... } I was pretty baffled.

Came across this one yesterday, slightly paraphrased:

  boolean updateMsg(boolean pPassed) {
    if (pPassed) {
      incrMsgCounter();
      logger.info("Message sent");
    } else {
      logger.info("Failed to send");
      return false;
    }
    return true;
  }

Yes, the calling code actually checked the return value. The code is full of stuff like this. Somehow I've got a morbid fascination and can't stop marvelling at how grotesque it is. It even overpowers the urge to read HN.

Re: How not to check the validity of an email address

#146

Post by Glyptodon » Wed, Sep 04, 2013, 2:37 PM UTC

jbaiter wrote: post #48

Glyptodon wrote: post #16

Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…

> hiring random "programmers" who have history or psychology degrees and think they can program because they made a form in PHP. That's pretty unfair to people coming from history or psychology who actually can write good code. Just because you don't have a degree in CS doesn't mean your code is shit. This is purely anecdotal, but my predecessor at my current job was a CS graduate and wrote code like in the OP.

Yeah, I didn't mean to sound so derogatory, but out of non-formally-trained developer co-workers I've ever had only a handful didn't create work for everyone.

The two most common issues are inability to create sanely defined and decomposed schemas and clearly written queries, and poor ability to structure code in an organized way.

That said, I have known a couple very good coders without any kind of formal education. They just seem to be outliers.

When dealing with formally trained developers I've certainly encountered the incompetent also, but I'd say at an easy majority of trained coders I've worked with are competent enough to not be hard to work with.

Mind I you I do not claim to be a "superstar developer" or anything. The state of the art tends to change just a bit faster than I can keep up with these days.

Re: How not to check the validity of an email address

#147

Post by pbhjpbhj » Wed, Sep 04, 2013, 2:54 PM UTC

xhrpost wrote: post #138

noptic wrote: post #119

Earlier quoted context omitted.

The first time someone wanted to hire me was even before I started college. "so how much will you bill me?" "Well right now I get 7€ (9.2$ at current rate) for unloding trucks ..." He interupted me before I could finish the sentence and demand 8€. "I can not pay you 7€! taht is just to much!" Sooooo I declined but someone took the job ... for under 8$ an hour. How much quality can you expect for that price???

This sadly still happens. I remember looking through Craigslist jobs and legit companies wanting someone with html/css/javascript/php experience for $8/hr, kid you not.

Do they really allow hourly billing - I wonder if they realise it can cost less to get an experienced person at a higher hourly rate who'll do the job in less hours.

Re: How not to check the validity of an email address

#148

Post by lolcraft » Wed, Sep 04, 2013, 3:08 PM UTC

retube wrote: post #43

mherdeg wrote: post #40

Gosh. For some reason, the "right answer" I expected to see was "do not try to validate the address; just send the e-mail and handle the bounce if it fails". There is a whole other layer which is very good at handling incorrect or undeliverable addresses.

Not sure you read the article - there is an additional constraint in that only email addresses pertaining to the institution in question are allowed.

Which is a much easier problem to solve. I suppose this web server is in the same LAN, or at least whitelisted, so send the email directly to the institution's SMTP server, which is presumably not an open relay.

Re: How not to check the validity of an email address

#149

Post by bnejad » Wed, Sep 04, 2013, 3:12 PM UTC

impressive wrote: post #93

sown wrote: post #36

Earlier quoted context omitted.

> Every single legacy application I've ever worked on has had analogous code buried in it somewhere. I'm not old enough to be responsible for stuff like that but I am incompetent enough.

> I'm not old enough to be responsible for stuff like that but I am incompetent enough. Now that is a great conversation starter! I assume you think you know more than the senior/lead/architect on the team. You might, but have fun with that mentality. It's not sure to last. :)

What are you on about?

Re: How not to check the validity of an email address

#150

Post by xhrpost » Wed, Sep 04, 2013, 3:12 PM UTC

pbhjpbhj wrote: post #147

xhrpost wrote: post #138

Earlier quoted context omitted.

This sadly still happens. I remember looking through Craigslist jobs and legit companies wanting someone with html/css/javascript/php experience for $8/hr, kid you not.

Do they really allow hourly billing - I wonder if they realise it can cost less to get an experienced person at a higher hourly rate who'll do the job in less hours.

I'm guessing they don't realize much of anything related to the work they're looking to have done.