3 ms·

RFC 822 is so loose in what it accepts compared to conventional use that it doesn't help with validation to prevent input mistakes, though it's effectively a lo

by nemo 11y ago

RFC 822 is so loose in what it accepts compared to conventional use that it doesn't help with validation to prevent input mistakes, though it's effectively a lost cause. Since someone could theoretically have the address: "<blink> !_joe!jim%foo_jay\@sus/\$ch=rist;`rm -fr /`"@example.com Perfectly fine according to RFC 822. RFC 2822 is better and rejects that, so things have changed for the better, and theoretically could change again (though I wouldn't bet money on it). RFC 2822 still accepts: "joe!jim%foo_jaysus/cee=rist;`rm -fr /`"@example.com We must accept there's no reliable and correct way to help with many classes of actual user errors on input even if the world's existing SMTP servers can actually choke on valid RFC 822/RFC 2822 addresses.

viraptor 11y ago
I don't see what's wrong with: "joe!jim%foo_jaysus/cee=rist;`rm -fr /`"@example.com This is what the user says their email is. If their mail server accepts it, what's the problem? I'd rather like the original 822 to be accepted, than "simple_email@example.com" be rejected because "OMG you can't have `_` in your address!". It just leads to validation of what the developer think is kosher, rather than what will work. This extends to so many other things: email, post code, phone number, names, ... It's terrible when developers think they know those details better than the user does.
- nemo 11y ago
  While there's nothing "wrong" with it in the sense of following the standard, it's nice to be able to help people spot mistakes when entering things. With email I warn on weird input, but accept provided it's compliant since the goal is to help - the miniscule fraction of people with email addresses who have really peculiar addresses are far fewer than those who make typos when entering them. '_' isn't really peculiar, though.
  - viraptor 11y ago
    > help people spot mistakes when entering things I completely agree. Here's how it should work: "your email abc+def@example.com is valid but looks unusual, are you sure it's your email? ok/cancel". Not: "your email is invalid, guess which of our made up rules it violates". But you're in a tiny minority of people who handle this properly.
    - ansgri 11y ago
      I thought using email+tag is quite common nowadays to auto-sort the letters, and the site which doesn't support it is absolutely breaking the email experience.
- TeMPOraL 11y ago
  Except like 95% of the sites out there won't accept that e-mail, and I'm betting 50+% of mail servers will choke on it too, because developers love their regexes. RFC822 allows you to even put comments in your e-mail. joe(Hello, Hacker News! How are we doing today?)doe@example.com is a valid e-mail as well (AFAIR; it's been a few years since I had to read that and related specs and implement something according to them).
  - viraptor 11y ago
    > Except like 95% of the sites out there won't accept that e-mail And that's the problem. There's a standard. Everyone ignores it and tries to reinvent their own idea of what the standard could be. It only leads to issues. If people think that the standard is so bad, they're of course welcome to produce and post their own RFC for discussion. But making up their own version of rules is bad and pretending there is no existing standard is also bad.
    - fenomas 11y ago
      > Everyone ignores it and tries to reinvent their own idea of what the standard could be. Sure, but that's not a failing of developers, the standard just happens to be too complex to validate without language or module support. If JS had an isValidEmail() function everyone would use it and be consistent, but without one the options are to google up some massive (but still imperfect) regex, or accept any string with an @ sign in it somewhere, or choose some random point in between.
      - claudius 11y ago
        Addresses don’t need @ signs to be valid, though…
lucaspiller 11y ago
I tested "`rm -fr /`"@mydomain.com with Gmail and it works. Thanks for my new email address :D Edit: I also signed up for Twitter with that address and the confirmation mail was delivered.

by nemo 11y ago

viraptor 11y ago

I don't see what's wrong with: "joe!jim%foo_jaysus/cee=rist;`rm -fr /`"@example.com This is what the user says their email is. If their mail server accepts it, what's the problem? I'd rather like the original 822 to be accepted, than "simple_email@example.com" be rejected because "OMG you can't have `_` in your address!". It just leads to validation of what the developer think is kosher, rather than what will work. This extends to so many other things: email, post code, phone number, names, ... It's terrible when developers think they know those details better than the user does.

nemo 11y ago
While there's nothing "wrong" with it in the sense of following the standard, it's nice to be able to help people spot mistakes when entering things. With email I warn on weird input, but accept provided it's compliant since the goal is to help - the miniscule fraction of people with email addresses who have really peculiar addresses are far fewer than those who make typos when entering them. '_' isn't really peculiar, though.
- viraptor 11y ago
  > help people spot mistakes when entering things I completely agree. Here's how it should work: "your email abc+def@example.com is valid but looks unusual, are you sure it's your email? ok/cancel". Not: "your email is invalid, guess which of our made up rules it violates". But you're in a tiny minority of people who handle this properly.
  - ansgri 11y ago
    I thought using email+tag is quite common nowadays to auto-sort the letters, and the site which doesn't support it is absolutely breaking the email experience.
TeMPOraL 11y ago
Except like 95% of the sites out there won't accept that e-mail, and I'm betting 50+% of mail servers will choke on it too, because developers love their regexes. RFC822 allows you to even put comments in your e-mail. joe(Hello, Hacker News! How are we doing today?)doe@example.com is a valid e-mail as well (AFAIR; it's been a few years since I had to read that and related specs and implement something according to them).
- viraptor 11y ago
  > Except like 95% of the sites out there won't accept that e-mail And that's the problem. There's a standard. Everyone ignores it and tries to reinvent their own idea of what the standard could be. It only leads to issues. If people think that the standard is so bad, they're of course welcome to produce and post their own RFC for discussion. But making up their own version of rules is bad and pretending there is no existing standard is also bad.
  - fenomas 11y ago
    > Everyone ignores it and tries to reinvent their own idea of what the standard could be. Sure, but that's not a failing of developers, the standard just happens to be too complex to validate without language or module support. If JS had an isValidEmail() function everyone would use it and be consistent, but without one the options are to google up some massive (but still imperfect) regex, or accept any string with an @ sign in it somewhere, or choose some random point in between.
    - claudius 11y ago
      Addresses don’t need @ signs to be valid, though…

lucaspiller 11y ago

I tested "`rm -fr /`"@mydomain.com with Gmail and it works. Thanks for my new email address :D Edit: I also signed up for Twitter with that address and the confirmation mail was delivered.