111–120 of 405 posts
Secondly, this guy is so hilarious.
I clicked to his podcast (where he reads Wikipedia pages) at the bottom and listened to this hilarious episode https://itunes.apple.com/us/podcast/david-reads-wikipedia/id.... His specific style of sarcastic humor (just like the article - is there a name for this style of humor btw?) is rare and hilarious.
Earlier quoted context omitted.
Definitely, I think email validation links are important too. However, it's pretty senseless to let an obviously invalid email address pass all the way through to that layer (and potentially get billed for sending messages to invalid email addresses).
1. There are no "obviously invalid email address[es]". 2. Getting billed for sending emails? WTF?
Earlier quoted context omitted.
Definitely, I think email validation links are important too. However, it's pretty senseless to let an obviously invalid email address pass all the way through to that layer (and potentially get billed for sending messages to invalid email addresses).
1. There are no "obviously invalid email address[es]". 2. Getting billed for sending emails? WTF?
Earlier quoted context omitted.
> Sure, the complete regex is complex, but it is defined and is hardly unconquerable. If it is a regular expression, then it is not able to match all valid email addresses, because the grammar of email addresses is context-free, and regular expressions can only match regular grammars. It doesn't matter if it is defined or not: if it's a true regular expression, then it simply cannot validate email addresses. (it may,…
> the grammar of email addresses is context-free I don't think you're really correct about "email addresses" being context-free, or at least, citation, please? When I look at a generic "email address" entry field on a random form on the Internet, say on the sign-up page for some hot new startup's service, I expect it to take what RFC 5322 §3.4.1[1] calls an `addr-spec`; specifically, I don't ever expect such fields t…
> When I look at a generic "email address" entry field on a random form on the Internet, say on the sign-up page for some hot new startup's service, I expect it to take what RFC 5322 §3.4.1[1] calls an `addr-spec`; specifically, I don't ever expect such fields to take the grammar of what that RFC calls an `address`.
Well, sure. Let's look at what RFC 5322 defines as an addr-spec[1]:
addr-spec = local-part "@" domain
local-part = dot-atom / quoted-string / obs-local-part
dot-atom = [CFWS] dot-atom-text [CFWS]
CFWS = (1*([FWS] comment) [FWS]) / FWS
comment = "(" *([FWS] ccontent) [FWS] ")"
ccontent = ctext / quoted-pair / comment
Pair-balancing, of course, is impossible with regular expressions, since matching pairs requires push-down automata (which match CFGs) and cannot be done with finite-state machines, (which match regular expressions).
QED.
> Also, using that assumption, your "perfectly valud[sic] email addresses such as …" would appear to not be valid, as it has unbalanced quotes.
Nope, there are no unbalanced quotes in (this)"()[]:,;@\\\"!#$%&'-/=?^_`{}| ~.a"(is)@(valid)example.org(honest): the first quote balances with the third, while the second quote is one of a quoted pair \" (which is allowed within a quoted-string, which is allowed within a local-part). It's all allowed per the spec.
I'll admit that it's a bit surprising, but it's true. One simply cannot match a valid RFC5322 addr-spec with a regular expression. One can, of course, match it with something which pretends to be regular but isn't really (as I noted).
Earlier quoted context omitted.
> Scarier still is when it's a server-side response that rejects my password for its contents... A friend's project decided to disallow umlauts, combined characters like ´e (can't type the correct e with accent mark), the pipe symbol and a couple more in new passwords. Not due to plaintext storage or so, but because of customer service issues - people were bugging support all the time because they were e.g. abroad an…
> combined characters like ´e (can't type the correct e with accent mark) You mean é ? :-)
Earlier quoted context omitted.
Caring what characters are in the password heavily implies that the site is not hashing the plaintext password in any way, and scarier still, may just be storing the plaintext password as plain text. Why: Because if they were (at least) hashing it the output from the hash would be a binary string in which case they would have to be 8-bit clean through to the DB column where the hash output resided, and then there wou…
Sadly at some places it's intentional so your password matches existing PIN systems or is "easy to remember" so you're not as easily locked out of your account. I wish in those cases there was a check box that says, "I know what I'm doing, leave me alone." Speaking of annoying validations, my name has a hyphen in it but you'd be surprised how often that's rejected with the familiar, "Please enter a valid last name."…
Earlier quoted context omitted.
Can you name some popular websites that do this? Speaking as someone who uses + addresses to filter stuff from mostly well-known websites, I have never seen this. I have seen this a few times on old, crusty, finance websites etc. but I hardly ever need to use a + address with them anyway. (It does make me wonder about how good their internal security is, though.)
BestBuy allowed me to sign up with a trailing "+bestbuy@gmail.com", but their unsubscribe interface rejects it as invalid, so I can't unsubscribe from their promos. I just filter/mark as spam and move on.
It's less common, but some websites ask you to type your email address once they realise they can't find you on record. If the "+" doesn't work in that field (server side rejected), then you can try %2B there as well.
Earlier quoted context omitted.
> combined characters like ´e (can't type the correct e with accent mark) You mean é ? :-)
Yes. OS X keyboard drives me nuts sometimes, Karabiner can only fix some bits of the weirdness.
Firstly, great article. Secondly, this guy is so hilarious. I clicked to his podcast (where he reads Wikipedia pages) at the bottom and listened to this hilarious episode https://itunes.apple.com/us/podcast/david-reads-wikipedia/id... . His specific style of sarcastic humor (just like the article - is there a name for this style of humor btw?) is rare and hilarious.
.+@.+\..{2,}
That is, at least one character for the inbox, at least one character for the domain, at least two for the TLD (we assume that TLD-less domains are undeliverable by us). This ensures we don't allow 'a@a' or 'a@a.a', but do allow 'a@a.io'.