How not to check the validity of an email address • Hacker News Board

Re: How not to check the validity of an email address

#41

Post by dclowd9901 » Wed, Sep 04, 2013, 7:49 AM UTC

mherdeg wrote: post #40

Gosh. For some reason, the "right answer" I expected to see was "do not try to validate the address; just send the e-mail and handle the bounce if it fails". There is a whole other layer which is very good at handling incorrect or undeliverable addresses.

I recently sat in on a presentation regarding javascript module loading. Someone in our company had taken it upon themselves to roll their own solution, because, shit, they're being paid and apparently have no oversight.

The solution involved creating an entire cache/hash layer on the client using local storage.

At the end of the presentation I had to try to be as respectful as possible when I asked why basic browser caching and content expiration weren't enough. Apparently it wasn't even considered -_-

Re: How not to check the validity of an email address

#42

Post by PakG1 » Wed, Sep 04, 2013, 7:49 AM UTC

mmariani wrote: post #29

banachtarski wrote: post #25

Earlier quoted context omitted.

You're missing the sarcasm :P

Unless it's clearly stated sarcasm gets garbled over the wire. So in the hope of helping those who don't get it I decided to do the right thing just to be on the safe side. ;)

Oh come on, then sarcasm loses its humor. Anyone who didn't get it the first time probably falls into the same category of developer that is being criticized here. :P

Re: How not to check the validity of an email address

#43

Post by retube » Wed, Sep 04, 2013, 7:50 AM UTC

mherdeg wrote: post #40

Gosh. For some reason, the "right answer" I expected to see was "do not try to validate the address; just send the e-mail and handle the bounce if it fails". There is a whole other layer which is very good at handling incorrect or undeliverable addresses.

Not sure you read the article - there is an additional constraint in that only email addresses pertaining to the institution in question are allowed.

Re: How not to check the validity of an email address

#44

Post by jmadsen » Wed, Sep 04, 2013, 7:50 AM UTC

Glyptodon wrote: post #16

Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…

>Another legacy app I'm employed to "repair" has one single 'template' for every page on the whole site. Its first ~500 lines conveniently consist of a giant and highly nested if/else clause to set the page variables and inline javascript.

oh, oh! I'm doing one of those. Only, it's a modern, MVC version, so there's actually a couple of dozen controllers with a single function each, and all actions snake through The Great Maze of Ifelsedom to set their rightful values, before traversing it once more on the page view file

Manager: "Uhm, I thought you said changing that label would be a 5 minute task?"

Re: How not to check the validity of an email address

#45

Post by evincarofautumn » Wed, Sep 04, 2013, 7:52 AM UTC

Glyptodon wrote: post #16

Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…

> Switching it to use a single properly formatted SQL reduced load times to under a second.

We need you to change it back because the system that scrapes that page is relying on the page load time.

Re: How not to check the validity of an email address

#46

Post by dclowd9901 » Wed, Sep 04, 2013, 7:52 AM UTC

pmiller2 wrote: post #33

Man. Reading posts like these has several effects on me. One is utter shock that anyone could be so stupid. Another is to remind me of how little I know (because I'm sure in the eyes of someone who actually knows anything about security, I'd probably provoke the same reaction). I'm also amazed that some of the people responsible for these things can still find work. Here's my own personal story. The other day, I had…

Not necessarily. They may be using a reversible hash. Not much more secure, but it beats plaintext.

Re: How not to check the validity of an email address

#47

Post by shousper » Wed, Sep 04, 2013, 7:52 AM UTC

meowface wrote: post #6

MichaelApproved wrote: post #2

I've had something similar delivered to me on a project I hired out. The most frustrating part was not the code but the developers reaction to why it was so bad. He had no idea what the big deal was and thought I was being nitpicky. Worse yet, was an initial claim that it was more efficient to do it that way. That was followed up with a claim that doing it differently wasn't possible. Needless to say, I stopped worki…

>The most frustrating part was not the code but the developers reaction to why it was so bad. He had no idea what the big deal was and thought I was being nitpicky. This is always the worst. I've had experiences like that on many an occasion, where the person is simply like "huh? what's wrong?" You can't really fix that level of sheer incompetence, ignorance, and arrogance all wrapped into one.

Or more simply, you can't help people who don't want to be helped =)

Re: How not to check the validity of an email address

#48

Post by jbaiter » Wed, Sep 04, 2013, 7:52 AM UTC

Glyptodon wrote: post #16

Every single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a…

> hiring random "programmers" who have history or psychology degrees and think they can program because they made a form in PHP.

That's pretty unfair to people coming from history or psychology who actually can write good code. Just because you don't have a degree in CS doesn't mean your code is shit. This is purely anecdotal, but my predecessor at my current job was a CS graduate and wrote code like in the OP.

Re: How not to check the validity of an email address

#49

Post by joshfraser » Wed, Sep 04, 2013, 7:58 AM UTC

In college I was hired to build an auction site. I was billing my client $20 / hour and subcontracting out the work to some of my fellow classmates at $10 / hour. I was swamped with other work and didn't have much time to review the code. I just made sure it satisfied the specifications and shipped it. We launched the site and did a few hundred thousands dollars worth of transactions in the first 24 hours. Then something strange happened... all of the bids mysteriously disappeared from our admin panel and users started emailing in asking why their bids weren't showing up anymore. I got a panicked call asking what had happened. I had no clue, but promised to look into it. I started digging through the server logs and noticed that all the bids had been deleted around the time that Google had discovered and crawled the site. Sure enough, my friend had added links to delete bids via the admin panel that were executed via GET requests. It wouldn't have been that big of a deal except the poor guy had used JavaScript for authentication! Google's crawlers had carefully hit every single Delete link and wiped out the site. I fixed the authentication system, refunded everyone's credit cards and relaunched the site with a huge apology for the issues. Needless to say, from that day on I became far more diligent about doing code audits.

Re: How not to check the validity of an email address

#50

Post by masklinn » Wed, Sep 04, 2013, 8:01 AM UTC

tantalor wrote: post #37

w-ll wrote: post #31

if input_email in valid_emails_set: send_email(input_email, another_param, etc) Their solution, while isn't wrong, could still be improved. With a somewhat modified 2822 regex with a more strict domain rule. But I would also assume you could just query the db.

You assume "in valid_emails_set" doesn't make a query. It's fairly trivial to define your own __contains__ in python.

Indeed, since this is an internal system validating the uni's own emails it could easily query the uni's MSA for valid addresses.

Although for a set of 80k items and long-running processes (fcgi or wsgi) you could also load the whole thing in memory directly and not bother with a custom `__contains__`.