Hacker Newsnew | past | comments | ask | show | jobs | submit | qaisjp's commentslogin

The "closed duplicate" thing is blown away out of proportion than it actually is. I'm convinced people are just pooping on Stack Overflow, not because it's bad, but because they just like complaining about things.


>The "closed duplicate" thing is blown away out of proportion than it actually is.

I hardly use the site and it's happened to me multiple times. I'm sure people that rely more heavily on it see it all the time. I suppose it depends on the sorts of topics you're looking for help with, much like wikipedia or subreddits, a lot of the little niches are seemingly ran by assholes that would rather delete stuff than actually help people find information.


out of curiosity, why are you trying to validate emails?


Just a base level regex before sending emails, to avoid some errors sending to non-email addresses and logging otherwise unnecessary errors.


The best you can hope to do is reduce a small class out of possible errors. But you'll never get a test that can prevent errors like name@gnail.com, name@gmaip.com, nane@gmail.com etc. So is it really worth doing any checks at all?

I have a .blue email address and it's amazing how many sites still won't accept it. I keep a spare Gmail account for these.


> But you'll never get a test that can prevent errors like name@gnail.com, name@gmaip.com, nane@gmail.com etc. So is it really worth doing any checks at all?

You can do quite well at this, if you're willing to not restrict yourself to regexes and commit to some amount of hackery. One system I worked on used a simple regex (just what is described here IIRC - assert the existence of an @ sign), plus did an MX check on the domain, plus warned (not errored) if the domain was within 1 or 2 Levenshtein distance of any of a list of most common email domains (yahoo, gmail, etc). Statistically it seems like we saved people a lot of grief with this simple filtering.


> So is it really worth doing any checks at all?

People accidentally typing their name in the email field, stuff like that. I've done that.

The problems with your .blue is obviously completely unrelated to the "email.contains('@')" check the poster is doing.


I resent being called a poster! I am not flat, nothing was ever printed on me. I am a human being, you.. you... you piece of sheet!


The downvotes are a sign that I did not notice that my reply to the poster was not composed. I got the memo, and will take note from now on, mark my words!


.blue is 11 years old and still has issues. Same with several of the gtlds I have. I had an argument with a major backend email provider recently who refused to open an account for me as my gtld wasn't "valid." (they backed down eventually and fixed their code)

I keep a Gmail for the same reason.

I tried to add a .wiki link to a Reddit profile recently and their filters also say that domain is invalid.


> I tried to add a .wiki link to a Reddit profile recently and their filters also say that domain is invalid.

That's absurd, there's a .wiki that's almost definitely in the top 20 most visited websites in Korea, if not higher.


There's also minecraft.wiki.


In other words, /^.+?@.+$/ is a user-friendly reminder that you forgot the @ sign or something. That's all.


Does this block things like the unconventional Google-filing trick of:

  myemail+90sdev@gmail.com
which gives me the “90sdev” tag for my emails, which still go squarely into my “myemail@gmail.com” address? I don’t know what the best route is, but I’ve certainly run into bad validators that block things that otherwise work, and that’s annoying. It seems to me the best thing might be to have a user twice input their address, then have the next step/confirmation done via email.


> unconventional Google-filing trick

Documented as "subadressing" in RFC 5233, and the default for both sendmail and postfix, amongst others. As such, often 'accidentially' supported by many mail providers even when undocumented. Google didn't introduce them, nor are they 'unconventional'.

https://www.rfc-editor.org/rfc/rfc5233


TIL


I don't do blocking or differentiating. Emails are literal, for better or worse.


> bad validators

Possibly these validators are working exactly as intended and don't want you to know which service sold your email to spammers.

Then again maybe spammers are smart enough to strip of the + from email lists they purchase.


The latter was motivation to get my own domain so I can have unlimited unique addresses with a wildcard entry.


I never get spam that makes it through the default filter, so I am unsure if this works, but I do get zero spam in general since switching off gmail. I like giving silly businesses that ask for my email their business name @ my domain.

Most of the time they're too disinterested to notice. Oil change places always notice for some reason.

I'll look through my spam foldsr tomorrow and see who's been naughty.


Does your regex support emoji usernames and domains? (both of which are in use, e.g. https://mailoji.com/)


Both parts are limited to 7-bit ASCII or a subset thereof. Emojis have to be in punycode. You could theoretically use UTF-7 for the local-part but nothing supports it in practice.


That's the spec, for sure! The domains are converted to punycode, but the usernames? I have no idea what happens to them. My tests showed some providers delivered them, some didn't. I'm sure there are a bunch of people out there using accented characters and CJK etc in their usernames and wondering why it's not going so well...


That is officially the most cursed thing I've read all week. People really do love to do bizarre things just for the hell of it sometimes.


My project doesn't even support emojis or unicode. In context, it's not an issue.


I really enjoyed this read, thanks.

In the footnotes you said:

> One complication is that the counters have an "anti-tearing" feature for additional security

Two questions:

1. Why is it a "complication"? Is it just that it makes the counters more complicated, or is there something frustrating about the counters? 2. I would love to learn more about how the anti-tearing feature works!


The problem is that if the user tears the card away from the reader in the middle of an update, that card can end up with corrupted data. This makes implementing the increment-only counters more complicated. For instance, the straightforward approach might hold 00 FF in two bytes. If you increment the counter by updating the low-order byte first, but the card gets torn away before you update the high-order byte, you end up with 00 00, and the counter has gone backward.

A simple way of preventing tearing is to have two copies of each counter; if there is tearing, then the two values will be different.

Looking at an NXP patent [1], they use a much more complicated approach, using a level of indirection. They write the new value to a different memory page and then update a pointer to the new page. There are various progress bits recorded along the way so they can roll back as needed.

[1]: https://patents.google.com/patent/EP3226141A1

Here's an article describing an attack on the anti-tearing feature: https://blog.quarkslab.com/rfid-monotonic-counter-anti-teari...


> Anyone wanna know what the optimal magic number is?

Sure.


For no Newton iterations, I thought I found 0x5f37641f had the lowest relative error, and I measure it at 3.4211. Of course I’m not super certain, Lomont’s effort is way more complete than mine. Lomont’s paper mentions 0x5f37642f with a relative error of 3.42128 and Wikipedia and the paper both talk about 0x5f375a86 being best when using Newton iterations.


The post mentions BYOIP. I assume Cloudflare wanted OP on BYOIP to mitigate risk, and Cloudflare wanted them to pay for the privilege.


And Spectrum has interruptions all the time.


I miss gov.uk sites so much


I don't think spammers care if trimming the plus-alias doesn't work for some email providers.

Gmail is also pretty popular, so it's not much work to just hardcode it there.


This link is incredible, thank you!


Knowing that a guy wrote this ruined the post for me.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: