19 ms·

The “Chad” bug

220 points by mrb 11y ago

grardb 11y ago
This is remarkable. I always find it interesting when bugs like this occur. It reminds me of a hackathon I attended where a food ordering startup (I forget the name, but they were chosen to feed us dinner that night) had a similar bug, which baffled me beyond belief. Without going into crazy detail about my password, it typically follows a certain pattern but is never the same across websites. For some reason, the website kept saying my password was invalid. It met all the password requirements that the website asked for (length, capital letter, etc.). I forget the exact details, but it ended up being the exact location of a capital letter, the location of a number, or some combination of both. I could never figure out how a bug like that could even be coded up. My best guess is that it was some poorly-formed regex. > Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems.
- akerl_ 11y ago
  It should be common knowledge at this point, but just in case: If you're doing regex or any other text manipulation on user input when you ask them to set a password, you're doing it wrong.
  - chucky_z 11y ago
    What's the best way to deal with this problem, and what's the correct way to deal with this problem?
    - akerl_ 11y ago
      The input the user puts into the password prompt should by taken exactly as is, pushed into bcrypt/scrypt/etc, then stored as the user's password hash. I'm not entirely opposed to requiring a minimum length, but imposing max lengths / character class rules / etc ends up hurting people who want to pick strong passwords more than it helps people who would pick weak ones (enforcing character classes just gets us lots of password1A! and similar)
      - cookiecaper 11y ago
        I agree that the only real restriction that makes sense is a minimum character count. The others just tend to get in the way. I haven't seen anyone implement it in the wild, but it'd also be cool if there was a wordlist of the 25 most common passwords that the site matched against and refused to accept. I think those two policies, minimum length and no super common passwords, would do a lot to minimize the effectiveness of dictionary attacks.
        mbreese 11y ago
        I personally like the Stanford policy[1]. It basically boils down to: the longer the password, the fewer restrictions. Each password needs to be at least 8 characters, but if you only have 8 characters, you might need uppercase, lowercase, a symbol and a digit. If you have 12 characters, you only need upper/lower/digit. Once you hit 20 characters, you can have whatever you want. I think that this is a good balance between security for short passwords, while still allowing ridiculously long ones (pass-phrases). [1] http://arstechnica.com/security/2014/04/stanfords-password-policy-shuns-one-size-fits-all-security/ http://arstechnica.com/security/2014/04/stanfords-password-p...
        warfangle 11y ago
        Almost like you're validating on entropy and not specific rules..........
        Dylan16807 11y ago
        The concept is nice, but their numbers are horribly, unforgivably wrong. 8 random upper/lower/digit/symbol characters are equal to 9 random mixed-case letters. Not 16. Their cutoffs for different mixes are 8, 12, 16, 20. Realistic cutoffs would look more like 10, 11, 11, 14. Even worse, they encourage counting the individual letters in words. Never do that. Random words are only as good as two random characters.
        technion 11y ago
        $ dd if=/dev/urandom bs=32 count=1 | xxd -p That nearly every site on the Internet will refer to that output as "not strong enough" and instead suggest P@ssword1 as a better alternative definitely speaks to the issue.
    - bjt 11y ago
      Use https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn.
    - lmm 11y ago
      The correct way is not to use passwords. Use X.509 client certificates, and let the user secure theirs whatever way makes sense to them (whether that's a password, a smartcard, both, or something else). Unfortunately the browser UX for them is terrible.
- 0xcde4c3db 11y ago
  Besides the usual regex aches and pains, the grammar for email addresses is far more complex than most people realize. According to a highly-voted Stack Overflow answer [1], the current RFC-specified grammar for addresses can't even be matched with regex alone. Combining the edge cases of the grammar with (say) Unicode normalization sounds like a recipe for hours of fun. [1] https://stackoverflow.com/questions/201323/using-a-regular-expression-to-validate-an-email-address https://stackoverflow.com/questions/201323/using-a-regular-e...
  - kccqzy 11y ago
    I find that quite unbelievable. When I had a similar problem last year, the first resource I found was a W3C specification[1] about <input type=email>. The specification clearly states that email addresses should match: /^[a-zA-Z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/ Since this is an official W3C doc, I see no reason why people shouldn't use this. Edit: There is also a version by WHATWG[2] here: /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/ It apparently does a more thorough validation than the W3C one in the domain part, but the difference between the two is not apparent in practice. [1]: http://www.w3.org/TR/html-markup/input.email.html http://www.w3.org/TR/html-markup/input.email.html [2]: https://html.spec.whatwg.org/multipage/forms.html#e-mail-state-(type=email) https://html.spec.whatwg.org/multipage/forms.html#e-mail-sta...
    - wyldfire 11y ago
      >Since this is an official W3C doc, I see no reason why people shouldn't use this. Well, as far as authority/canon goes, it's typically dictated by the IETF and not W3. And, sure, they could cooperate with one another but, really -- if there's an authority on the protocols that describe email (SMTP, POP, IMAP, etc) -- it shouldn't be the World Wide Web Consortium. That said, the IETF does tend to draft RFCs that reflect actual implementations (at least their intended design), but since they often bias towards interoperability, it's unlikely they'd narrow the scope of the email address grammar.
    - oinksoft 11y ago
- cookiecaper 11y ago
  I find a lot of websites will eat passwords that contain special characters. I don't mean that they'll tell you it doesn't match the password policy, I mean that they'll accept the password and then tell you the password is wrong when you come back to sign in. I eventually had to teach my password generator to use only a few usually-properly-handled special characters when generating to avoid the hassle of having to reset the password every time. The same thing is often true of long passwords -- websites will accept the password at the UI level, but it probably gets truncated somewhere in the processing, and you don't know which character you got cut off at, so you have to reset to something shorter.
  - ars 11y ago
    If it's going to eat a character it should at least be consistent and also eat it at the validation stage.
- Animats 11y ago
  "Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems." Yes. My favorite was a Coyote Point load balancer bug. If the last character of the HTTP options is "m", the connection will not get past the load balancer.[1] I found this because a web crawler was having trouble with one site. Fortunately, I knew someone with their own Coyote Point load balancer, and was able to establish that the connection went into the load balancer and never came out. The load balancer has a big file of rules which contain regular expressions. Somewhere, I think there's a "\m" where they meant "\n". Reporting this to the vendor, along with a Python program to demonstrate the problem, was of course futile; they suggested "upgrading the software". I demonstrated that the bug existed on their own load balancer on their own site. I finally added a completely useless field to the HTTP header so that the last character was not "m". [1] https://www.webmasterworld.com/webmaster_hardware/3312997.htm https://www.webmasterworld.com/webmaster_hardware/3312997.ht...
  - chris_wot 11y ago
    Tell them they've violated their contract and you are migrating from them ASAP.
    - rdancer 11y ago
      That doesn't work when it's software on your client's computer. Remember when all the web devs revolted and ditched IE6 back in 2001, because MS was just taking the Mickey? Yeah, me neither.
      - Animats 11y ago
        Right. I didn't have a Coyote Point unit. Many other sites did, and they all appeared to be down to my web crawler until I figured out the problem. (Current web crawler problem: sites that won't let you read their robots.txt file if they don't like your user-agent string.)
        ThisIs_MyName 11y ago
- raverbashing 11y ago
  From what I've seen from "regular people" writing regular expressions, they seem to not have the slightest clue on how to do it And then putting it into the program without testing it properly So, sorry, the issue is not regexes, but people just going for it at an "trial and error" fashion (and sometimes just trial)
  - TeMPOraL 11y ago
    For people here that may ask themselves just how exactly one could test regular expressions, I recommend a visual tool like [0]. Having the regex structure and meaning drawn in front of you helps tremendously. That, and for the love of God please comment any non-trivial regexp. Either like this, with 'x' option: preg_match('/^ .* # Match any number of characters... (?=.{6,}) # ... AND match at least 6 characters (lookahead) ... (?=.*\d) # ... AND match one digit after any number of characters (lookahead) ... (?=.*[a-zA-Z]) # ... AND match one letter after any number of characters (lookahead) ... .* # ... AND allow any number of characters later. $/x', $password); ... or just with normal programming language comments and stitching regexp from multiple strings in multiple lines. Also give some semantic meaning to groups if you use them, e.g. tag them with constants so that your code isn't full of stuff "result.get(3)", which makes you waste time on trying to recall what was that group 3 in the code from last month. I know it's pretty much software engineering 101. It's the basics of basics. But from my experience, even the brightest of engineers in most serious projects suddenly forget how to write code when they touch regular expressions. [0] - https://www.debuggex.com https://www.debuggex.com
    - raverbashing 11y ago
      Using tools is good, but also people should test them in their unit test, for what it should/should not be accepted If you're forbidding items beginning with numbers, just have a test try passing '1a' and failing the match
      - TeMPOraL 11y ago
- noonespecial 11y ago
  Regex's in perl5 are what introduced me to test automation. Hard.
- annnnd 11y ago
  > Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems. Great quote. However, I think regexes got a bad reputation just because of the way people use them. In essence they are a pretty reliable way of parsing because the parsing engine is well tested. But the expression should be kept as simple as possible and developer should avoid using any nonstandard / nonexplicit extensions. I even avoid using \w because, well, what IS a word character? I am sure it is defined somewhere... but I'll always use explicit form (like "[a-zA-Z]" when I want ASCII chars) instead. Anyway, if you use the form as used in the regex puzzle [0], you'll be fine. As long as you use regex only for what it was meant for, of course [1]... [0] https://news.ycombinator.com/item?id=10787509 https://news.ycombinator.com/item?id=10787509 [1] http://blog.codinghorror.com/parsing-html-the-cthulhu-way/ http://blog.codinghorror.com/parsing-html-the-cthulhu-way/
- ifdefdebug 11y ago
  > Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems. Yeah sure. I think I heard that quote before... just about a million times? People expect regex to be an easy-to-use tool. Well it's not, and it's a foot gun if you don't take your time to learn it right. But no, people hack up some expressions, hit their feet and blame... the tool of course, not themselves. Just learn it right, it's a great tool if you know how to make it work for you :)
- pg_is_a_butt 11y ago
  yeah, very remarkable... only 1 of your contacts is fucked up in google contacts? and you were able to figure out which one? whoa. remarkable. at least 20 of mine are like this, and i swear it isn't the same 20. google creates terrible software that breaks with every other release. deal with it.
suprjami 11y ago
I didn't get the reference. https://en.m.wikipedia.org/wiki/Chad_(paper) https://en.m.wikipedia.org/wiki/Chad_(paper)
- snydly 11y ago
  Ohh, I didn't get it at first either. Thought of the country. Best image to explain a hanging "chad": http://images1.fanpop.com/images/photos/1400000/Halloween-how-i-met-your-mother-1469279-1008-758.jpg http://images1.fanpop.com/images/photos/1400000/Halloween-ho...
- huac 11y ago
  Chad's also the stereotypical douchebag name.
db48x 11y ago
Is that "chad@" or "chаd@" (homoglyphs)?
- mrb 11y ago
  No homoglyphs.
raldi 11y ago
I bet there's a hashtable involved somewhere, and Chad's address just happens to hash to, like, 0x00000, and it turns out when that happens, there's a bug. As a workaround, I bet you can use CHAD@... or chad+blah@...
- mrb 11y ago
  A hashtable bug seems possible. (Hangouts Dialer still does not see him if saved as CHAD@. It sees him when saved as chad+bla@ but it's annoying because then his email is wrong in my contact list as his email provider does not support + aliases.)
  - AnkhMorporkian 11y ago
    You could try chad()@. () is an empty e-mail address comment which, by the RFC, is supposed to be ignored during delivery. Not every mail server supports it, but it's worth a try until they fix that bug.
    - marcoperaza 11y ago
      Email address comment? What the hell were they thinking?
      - deleted 11y ago
        [deleted]
      - csours 11y ago
        Think about pre-outlook days, you may want some notes to remember who you are emailing.
        Dylan16807 11y ago
        I'm thinking about it. Still doesn't make sense to put it in the address.
    - mrb 11y ago
deleted 11y ago
[deleted]
nbakshi 11y ago
This reminds me my favorite name while testing: "McNulla". I have seen quite a few webforms which had a regex to remove any NULL string, because of which it would not take this name as it has a "Null" string in the name.
- EvanAnderson 11y ago
  I knew a family w/ the last name of "Null" from high school. I wonder, from time to time, if they have suboptimal experiences using the 'net.
  - isp 11y ago
    Obligatory: https://news.ycombinator.com/item?id=3900224 https://news.ycombinator.com/item?id=3900224
- jehna1 11y ago
  I learned there was a place called Nan[1], when my json importer crashed to it while interpreting it as a NaN (not a number) [1]:https://en.wikipedia.org/wiki/Nan,_Thailand https://en.wikipedia.org/wiki/Nan,_Thailand
mattbillenstein 11y ago
Android is a wasteland.
frik 11y ago
Many sites don't support the plus in email addresses ("+" = comment, supported e.g. by GMail). Not so funny if the register process works but the login or password reset features are broken. Example: a site let me register and login with the plus. But resetting the password was hard, I had to escape the plus to get it working.
timberburn 11y ago
When I was setting up an account on Comcast's website, I was consistently getting an nondescript internal server error when submitting the form. Took me quite awhile and many failed attempts to find that Comcast will throw an error when your requested username contains "comcast".
- hidroto 11y ago
  i wonder if that is to stop people from using names like comcastSucks or worse.
  - rdancer 11y ago
    It may not have been the rationale, but it sure must be the most common use-case.
  - akurtzhs 11y ago
    It also avoids security problems with fraudsters creating official looking emails - "comcastsupport" and the like.
- josegonzalez 11y ago
  Same for ConEd. Moneygram will freeze payments with the word "moneygram" in the associated email. Which is great for those of us that use catch-all emails and use the email address to discern what to do with an email...
- rincebrain 11y ago
  I've had a number of fun failure modes like that. My current favorite two include when the change password form permitted longer passwords than the login page, and one where the change password form happily allowed special characters, but if there was e.g. a semicolon in the password, submitting it from the login page would throw a SQL error.
edent 11y ago
It's a pity there's no way to report bugs like this to Google. The only way I've found of getting anything resolved is to forward issues to a friend inside the company, or hope that you can write a blog post which gets enough attention. I get that filtering and testing millions of random bug reports from all corners of the Internet is hard - but it's a problem which Google desperately needs to solve if it wants to retain the trust of its users.
- chris_wot 11y ago
  LibreOffice, RedHat, Debian, Canonical and Mozilla can do it. This is not a particularly hard problem to solve.
- asuffield 11y ago
  (Tedious disclaimer: not speaking for anybody else, my opinion only, etc. I'm an SRE at Google.) > It's a pity there's no way to report bugs like this to Google. This is a popular myth. General instructions are here: https://www.google.com/tools/feedback/intl/en/ https://www.google.com/tools/feedback/intl/en/ In this particular case, it's an android app, so what you do is tap on the hamburger menu, hit "help and feedback", then "send feedback".
  - edent 11y ago
    Having reported many bugs this way - I don't think I've ever had a response, let alone seen anything fixed. Looking at Android (OS) issues - https://code.google.com/p/android/issues/list?can=2&q=&sort=-stars+-opened&colspec=ID%20Status%20Priority%20Owner%20Summary%20Stars%20Reporter%20Opened https://code.google.com/p/android/issues/list?can=2&q=&sort=... - it's clear that the majority of bugs are ignored. Even when they're well described and affect multiple users / devices.
    - asuffield 11y ago
      We do not routinely release information about what happens to bugs, so you should not expect a response. I've certainly seen bugs reported on these channels be fixed. I cannot release any statistics. > Looking at Android (OS) issues - https://code.google.com/p/android/issues/list?can=2&q=&sort=.. https://code.google.com/p/android/issues/list?can=2&q=&sort=.... - it's clear that the majority of bugs are ignored. A quick glance at that page appears to disprove this claim. If you flip it to display "all issues", there are 206689 bugs in that tracker at the moment, of which 44583 are open. That tells you that 79% of all bugs filed have been closed - so, at least 79% of bugs were not ignored. Note that this tracker is for the operating system only, and does not include any of the Google apps that the feedback system covers.
abhishekash 11y ago
Do people with other android version or the phone make face the same issue while using this email id ?
PhasmaFelis 11y ago
> I exported the contacts and looked at the raw Google CSV data. One of the 2 problematic contacts had a whitespace character at the end of its phone number. I removed it. Bingo, Dialer can now find it! This is kind of horrifying. Google being tripped up by trailing whitespace?
mwpmaybe 11y ago
The Lando system?
GotAnyMegadeth 11y ago
I also see this with one of my brothers' names which is Olly <surname>.
packetized 11y ago
I wonder if this is related to i18n or country lookup. Chad is the only semi-common English-language name that's also a country name, that I can think of.
- benplumley 11y ago
  Jordan, Georgia. I feel like if this were the cause then the bug would be a lot more common. My guess is the dialler hashes some parts of the contact to get a UUID, but for this contact it happens to be outside the range the dialler can look at - perhaps off-by-one, where the dialler looks for UUIDs of 1 and above and this happens to hash to 0.
- NLips 11y ago
  There are also: India Georgia Jordan I'd guess they are all as common or more common than Chad.
- stevoski 11y ago
  My niece is called "Ireland". Continents too: I met a girl called "Africa", and "Asia" is certainly used as a name. However I don't ever expect to meet someone called "Democratic People's Republic of Korea"
Eyas 11y ago
I wonder if this is the only case where the name/first name of the contact is exactly the same as the recipient's address.
ryporter 11y ago
Somewhat similarly, I encountered a possible bug in Google Docs many years back. I was reorganizing my documents, and I temporarily changed one of the names to "delete". Poof -- I could not longer find it anywhere (or even search for words that I knew were in it). I forget how I got back to it (maybe via my browser history), but I changed the name a bit, and then the document was "found". This could have simply been a race case unrelated to the filename, but it's much more amusing to speculate that it was due to hack introduced during development. I now regret not trying to reproduce it, but I was pretty frustrated after I found my document again. I did contact support, but didn't hear anything back.
tmaly 11y ago
regex bugs are bad, I have been bitten by one before. Its pure technical debt
Gravityloss 11y ago
So, when computing power increases, we just add useless parsing at every level of software, decreasing performance and causing bugs like these.
dougdonohoe 11y ago
Was it the Chad? https://www.youtube.com/watch?v=_79BtELxB2k https://www.youtube.com/watch?v=_79BtELxB2k
incepted 11y ago
> Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems. jwz's wit was a lot of fun in the early 2000s but that quote is too often used wrong. This quote is not about regexps, it's about using wrong tools for the job. Using it without context makes it sound dumb. "Well, what if regexp is exactly the right solution for that problem?".
- lmm 11y ago
  A regexp is almost always the wrong solution. It's a way of representing a finite state machine that obscures the states, which are the only valuable part of the state machine abstraction (they're inherently incomprehensible otherwise). And most implementations these days have random extensions, meaning you have all the performance and safety issues of a turing-complete programming language - but a much worse UX. They may have made sense in the days of ed and the teletype, when a terse incomprehensible expression was better than a slightly longer readable one, but they don't now.
  - incepted 11y ago
    > A regexp is almost always the wrong solution. That's quite a sweeping statement. Sure, complex regexps can be hard to read but state machines are just hard to read for humans in general, whatever the form. What do you recommend for parsing simple text entries, then?
    - lmm 11y ago
      If there are no existing libraries, parser combinators. More verbose but so much more readable, and they make it much easier to parse into an actual structure rather than a list of match groups.
      - incepted 11y ago
        > More verbose but so much more readable First of all, "more readable" is extremely subjective. Second, there are a lot of different parser combinators, all with very different syntaxes. Finally, parser combinators are readable by people familiar with them and regexps are readable by people familiar with them. Regexps are also much more widespread and approachable. And very often, writing a parser combinator to parse a simple text entry is way overkill. There are many good reasons why regexps are so popular.
tyingq 11y ago
A potential workaround...quote the local part: "chad"@example.com It seems to be supported by Exchange, gmail, and a few other MTA's I tested, and gets routed to the right place.

220 points by mrb 11y ago

This is remarkable. I always find it interesting when bugs like this occur. It reminds me of a hackathon I attended where a food ordering startup (I forget the name, but they were chosen to feed us dinner that night) had a similar bug, which baffled me beyond belief. Without going into crazy detail about my password, it typically follows a certain pattern but is never the same across websites. For some reason, the website kept saying my password was invalid. It met all the password requirements that the website asked for (length, capital letter, etc.). I forget the exact details, but it ended up being the exact location of a capital letter, the location of a number, or some combination of both. I could never figure out how a bug like that could even be coded up. My best guess is that it was some poorly-formed regex. > Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems.

akerl_ 11y ago
It should be common knowledge at this point, but just in case: If you're doing regex or any other text manipulation on user input when you ask them to set a password, you're doing it wrong.
- chucky_z 11y ago
  What's the best way to deal with this problem, and what's the correct way to deal with this problem?
  - akerl_ 11y ago
    The input the user puts into the password prompt should by taken exactly as is, pushed into bcrypt/scrypt/etc, then stored as the user's password hash. I'm not entirely opposed to requiring a minimum length, but imposing max lengths / character class rules / etc ends up hurting people who want to pick strong passwords more than it helps people who would pick weak ones (enforcing character classes just gets us lots of password1A! and similar)
    - cookiecaper 11y ago
      I agree that the only real restriction that makes sense is a minimum character count. The others just tend to get in the way. I haven't seen anyone implement it in the wild, but it'd also be cool if there was a wordlist of the 25 most common passwords that the site matched against and refused to accept. I think those two policies, minimum length and no super common passwords, would do a lot to minimize the effectiveness of dictionary attacks.
      - mbreese 11y ago
        I personally like the Stanford policy[1]. It basically boils down to: the longer the password, the fewer restrictions. Each password needs to be at least 8 characters, but if you only have 8 characters, you might need uppercase, lowercase, a symbol and a digit. If you have 12 characters, you only need upper/lower/digit. Once you hit 20 characters, you can have whatever you want. I think that this is a good balance between security for short passwords, while still allowing ridiculously long ones (pass-phrases). [1] http://arstechnica.com/security/2014/04/stanfords-password-policy-shuns-one-size-fits-all-security/ http://arstechnica.com/security/2014/04/stanfords-password-p...
        warfangle 11y ago
        Almost like you're validating on entropy and not specific rules..........
        Dylan16807 11y ago
        The concept is nice, but their numbers are horribly, unforgivably wrong. 8 random upper/lower/digit/symbol characters are equal to 9 random mixed-case letters. Not 16. Their cutoffs for different mixes are 8, 12, 16, 20. Realistic cutoffs would look more like 10, 11, 11, 14. Even worse, they encourage counting the individual letters in words. Never do that. Random words are only as good as two random characters.
        technion 11y ago
        $ dd if=/dev/urandom bs=32 count=1 | xxd -p That nearly every site on the Internet will refer to that output as "not strong enough" and instead suggest P@ssword1 as a better alternative definitely speaks to the issue.
  - bjt 11y ago
    Use https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn.
  - lmm 11y ago
    The correct way is not to use passwords. Use X.509 client certificates, and let the user secure theirs whatever way makes sense to them (whether that's a password, a smartcard, both, or something else). Unfortunately the browser UX for them is terrible.
0xcde4c3db 11y ago
Besides the usual regex aches and pains, the grammar for email addresses is far more complex than most people realize. According to a highly-voted Stack Overflow answer [1], the current RFC-specified grammar for addresses can't even be matched with regex alone. Combining the edge cases of the grammar with (say) Unicode normalization sounds like a recipe for hours of fun. [1] https://stackoverflow.com/questions/201323/using-a-regular-expression-to-validate-an-email-address https://stackoverflow.com/questions/201323/using-a-regular-e...
- kccqzy 11y ago
  I find that quite unbelievable. When I had a similar problem last year, the first resource I found was a W3C specification[1] about <input type=email>. The specification clearly states that email addresses should match: /^[a-zA-Z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/ Since this is an official W3C doc, I see no reason why people shouldn't use this. Edit: There is also a version by WHATWG[2] here: /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/ It apparently does a more thorough validation than the W3C one in the domain part, but the difference between the two is not apparent in practice. [1]: http://www.w3.org/TR/html-markup/input.email.html http://www.w3.org/TR/html-markup/input.email.html [2]: https://html.spec.whatwg.org/multipage/forms.html#e-mail-state-(type=email) https://html.spec.whatwg.org/multipage/forms.html#e-mail-sta...
  - wyldfire 11y ago
    >Since this is an official W3C doc, I see no reason why people shouldn't use this. Well, as far as authority/canon goes, it's typically dictated by the IETF and not W3. And, sure, they could cooperate with one another but, really -- if there's an authority on the protocols that describe email (SMTP, POP, IMAP, etc) -- it shouldn't be the World Wide Web Consortium. That said, the IETF does tend to draft RFCs that reflect actual implementations (at least their intended design), but since they often bias towards interoperability, it's unlikely they'd narrow the scope of the email address grammar.
  - oinksoft 11y ago
cookiecaper 11y ago
I find a lot of websites will eat passwords that contain special characters. I don't mean that they'll tell you it doesn't match the password policy, I mean that they'll accept the password and then tell you the password is wrong when you come back to sign in. I eventually had to teach my password generator to use only a few usually-properly-handled special characters when generating to avoid the hassle of having to reset the password every time. The same thing is often true of long passwords -- websites will accept the password at the UI level, but it probably gets truncated somewhere in the processing, and you don't know which character you got cut off at, so you have to reset to something shorter.
- ars 11y ago
  If it's going to eat a character it should at least be consistent and also eat it at the validation stage.
Animats 11y ago
"Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems." Yes. My favorite was a Coyote Point load balancer bug. If the last character of the HTTP options is "m", the connection will not get past the load balancer.[1] I found this because a web crawler was having trouble with one site. Fortunately, I knew someone with their own Coyote Point load balancer, and was able to establish that the connection went into the load balancer and never came out. The load balancer has a big file of rules which contain regular expressions. Somewhere, I think there's a "\m" where they meant "\n". Reporting this to the vendor, along with a Python program to demonstrate the problem, was of course futile; they suggested "upgrading the software". I demonstrated that the bug existed on their own load balancer on their own site. I finally added a completely useless field to the HTTP header so that the last character was not "m". [1] https://www.webmasterworld.com/webmaster_hardware/3312997.htm https://www.webmasterworld.com/webmaster_hardware/3312997.ht...
- chris_wot 11y ago
  Tell them they've violated their contract and you are migrating from them ASAP.
  - rdancer 11y ago
    That doesn't work when it's software on your client's computer. Remember when all the web devs revolted and ditched IE6 back in 2001, because MS was just taking the Mickey? Yeah, me neither.
    - Animats 11y ago
      Right. I didn't have a Coyote Point unit. Many other sites did, and they all appeared to be down to my web crawler until I figured out the problem. (Current web crawler problem: sites that won't let you read their robots.txt file if they don't like your user-agent string.)
      - ThisIs_MyName 11y ago
raverbashing 11y ago
From what I've seen from "regular people" writing regular expressions, they seem to not have the slightest clue on how to do it And then putting it into the program without testing it properly So, sorry, the issue is not regexes, but people just going for it at an "trial and error" fashion (and sometimes just trial)
- TeMPOraL 11y ago
  For people here that may ask themselves just how exactly one could test regular expressions, I recommend a visual tool like [0]. Having the regex structure and meaning drawn in front of you helps tremendously. That, and for the love of God please comment any non-trivial regexp. Either like this, with 'x' option: preg_match('/^ .* # Match any number of characters... (?=.{6,}) # ... AND match at least 6 characters (lookahead) ... (?=.*\d) # ... AND match one digit after any number of characters (lookahead) ... (?=.*[a-zA-Z]) # ... AND match one letter after any number of characters (lookahead) ... .* # ... AND allow any number of characters later. $/x', $password); ... or just with normal programming language comments and stitching regexp from multiple strings in multiple lines. Also give some semantic meaning to groups if you use them, e.g. tag them with constants so that your code isn't full of stuff "result.get(3)", which makes you waste time on trying to recall what was that group 3 in the code from last month. I know it's pretty much software engineering 101. It's the basics of basics. But from my experience, even the brightest of engineers in most serious projects suddenly forget how to write code when they touch regular expressions. [0] - https://www.debuggex.com https://www.debuggex.com
  - raverbashing 11y ago
    Using tools is good, but also people should test them in their unit test, for what it should/should not be accepted If you're forbidding items beginning with numbers, just have a test try passing '1a' and failing the match
    - TeMPOraL 11y ago
noonespecial 11y ago
Regex's in perl5 are what introduced me to test automation. Hard.
annnnd 11y ago
> Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems. Great quote. However, I think regexes got a bad reputation just because of the way people use them. In essence they are a pretty reliable way of parsing because the parsing engine is well tested. But the expression should be kept as simple as possible and developer should avoid using any nonstandard / nonexplicit extensions. I even avoid using \w because, well, what IS a word character? I am sure it is defined somewhere... but I'll always use explicit form (like "[a-zA-Z]" when I want ASCII chars) instead. Anyway, if you use the form as used in the regex puzzle [0], you'll be fine. As long as you use regex only for what it was meant for, of course [1]... [0] https://news.ycombinator.com/item?id=10787509 https://news.ycombinator.com/item?id=10787509 [1] http://blog.codinghorror.com/parsing-html-the-cthulhu-way/ http://blog.codinghorror.com/parsing-html-the-cthulhu-way/
ifdefdebug 11y ago
> Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems. Yeah sure. I think I heard that quote before... just about a million times? People expect regex to be an easy-to-use tool. Well it's not, and it's a foot gun if you don't take your time to learn it right. But no, people hack up some expressions, hit their feet and blame... the tool of course, not themselves. Just learn it right, it's a great tool if you know how to make it work for you :)
pg_is_a_butt 11y ago
yeah, very remarkable... only 1 of your contacts is fucked up in google contacts? and you were able to figure out which one? whoa. remarkable. at least 20 of mine are like this, and i swear it isn't the same 20. google creates terrible software that breaks with every other release. deal with it.

suprjami 11y ago

I didn't get the reference. https://en.m.wikipedia.org/wiki/Chad_(paper) https://en.m.wikipedia.org/wiki/Chad_(paper)

snydly 11y ago
Ohh, I didn't get it at first either. Thought of the country. Best image to explain a hanging "chad": http://images1.fanpop.com/images/photos/1400000/Halloween-how-i-met-your-mother-1469279-1008-758.jpg http://images1.fanpop.com/images/photos/1400000/Halloween-ho...
huac 11y ago
Chad's also the stereotypical douchebag name.

db48x 11y ago

Is that "chad@" or "chаd@" (homoglyphs)?

mrb 11y ago
No homoglyphs.

raldi 11y ago

I bet there's a hashtable involved somewhere, and Chad's address just happens to hash to, like, 0x00000, and it turns out when that happens, there's a bug. As a workaround, I bet you can use CHAD@... or chad+blah@...

mrb 11y ago
A hashtable bug seems possible. (Hangouts Dialer still does not see him if saved as CHAD@. It sees him when saved as chad+bla@ but it's annoying because then his email is wrong in my contact list as his email provider does not support + aliases.)
- AnkhMorporkian 11y ago
  You could try chad()@. () is an empty e-mail address comment which, by the RFC, is supposed to be ignored during delivery. Not every mail server supports it, but it's worth a try until they fix that bug.
  - marcoperaza 11y ago
    Email address comment? What the hell were they thinking?
    - deleted 11y ago
      [deleted]
    - csours 11y ago
      Think about pre-outlook days, you may want some notes to remember who you are emailing.
      - Dylan16807 11y ago
        I'm thinking about it. Still doesn't make sense to put it in the address.
  - mrb 11y ago

deleted 11y ago

[deleted]

nbakshi 11y ago

This reminds me my favorite name while testing: "McNulla". I have seen quite a few webforms which had a regex to remove any NULL string, because of which it would not take this name as it has a "Null" string in the name.

EvanAnderson 11y ago
I knew a family w/ the last name of "Null" from high school. I wonder, from time to time, if they have suboptimal experiences using the 'net.
- isp 11y ago
  Obligatory: https://news.ycombinator.com/item?id=3900224 https://news.ycombinator.com/item?id=3900224
jehna1 11y ago
I learned there was a place called Nan[1], when my json importer crashed to it while interpreting it as a NaN (not a number) [1]:https://en.wikipedia.org/wiki/Nan,_Thailand https://en.wikipedia.org/wiki/Nan,_Thailand

mattbillenstein 11y ago

Android is a wasteland.

frik 11y ago

Many sites don't support the plus in email addresses ("+" = comment, supported e.g. by GMail). Not so funny if the register process works but the login or password reset features are broken. Example: a site let me register and login with the plus. But resetting the password was hard, I had to escape the plus to get it working.

timberburn 11y ago

When I was setting up an account on Comcast's website, I was consistently getting an nondescript internal server error when submitting the form. Took me quite awhile and many failed attempts to find that Comcast will throw an error when your requested username contains "comcast".

hidroto 11y ago
i wonder if that is to stop people from using names like comcastSucks or worse.
- rdancer 11y ago
  It may not have been the rationale, but it sure must be the most common use-case.
- akurtzhs 11y ago
  It also avoids security problems with fraudsters creating official looking emails - "comcastsupport" and the like.
josegonzalez 11y ago
Same for ConEd. Moneygram will freeze payments with the word "moneygram" in the associated email. Which is great for those of us that use catch-all emails and use the email address to discern what to do with an email...
rincebrain 11y ago
I've had a number of fun failure modes like that. My current favorite two include when the change password form permitted longer passwords than the login page, and one where the change password form happily allowed special characters, but if there was e.g. a semicolon in the password, submitting it from the login page would throw a SQL error.

edent 11y ago

It's a pity there's no way to report bugs like this to Google. The only way I've found of getting anything resolved is to forward issues to a friend inside the company, or hope that you can write a blog post which gets enough attention. I get that filtering and testing millions of random bug reports from all corners of the Internet is hard - but it's a problem which Google desperately needs to solve if it wants to retain the trust of its users.

chris_wot 11y ago
LibreOffice, RedHat, Debian, Canonical and Mozilla can do it. This is not a particularly hard problem to solve.
asuffield 11y ago
(Tedious disclaimer: not speaking for anybody else, my opinion only, etc. I'm an SRE at Google.) > It's a pity there's no way to report bugs like this to Google. This is a popular myth. General instructions are here: https://www.google.com/tools/feedback/intl/en/ https://www.google.com/tools/feedback/intl/en/ In this particular case, it's an android app, so what you do is tap on the hamburger menu, hit "help and feedback", then "send feedback".
- edent 11y ago
  Having reported many bugs this way - I don't think I've ever had a response, let alone seen anything fixed. Looking at Android (OS) issues - https://code.google.com/p/android/issues/list?can=2&q=&sort=-stars+-opened&colspec=ID%20Status%20Priority%20Owner%20Summary%20Stars%20Reporter%20Opened https://code.google.com/p/android/issues/list?can=2&q=&sort=... - it's clear that the majority of bugs are ignored. Even when they're well described and affect multiple users / devices.
  - asuffield 11y ago
    We do not routinely release information about what happens to bugs, so you should not expect a response. I've certainly seen bugs reported on these channels be fixed. I cannot release any statistics. > Looking at Android (OS) issues - https://code.google.com/p/android/issues/list?can=2&q=&sort=.. https://code.google.com/p/android/issues/list?can=2&q=&sort=.... - it's clear that the majority of bugs are ignored. A quick glance at that page appears to disprove this claim. If you flip it to display "all issues", there are 206689 bugs in that tracker at the moment, of which 44583 are open. That tells you that 79% of all bugs filed have been closed - so, at least 79% of bugs were not ignored. Note that this tracker is for the operating system only, and does not include any of the Google apps that the feedback system covers.

abhishekash 11y ago

Do people with other android version or the phone make face the same issue while using this email id ?

PhasmaFelis 11y ago

> I exported the contacts and looked at the raw Google CSV data. One of the 2 problematic contacts had a whitespace character at the end of its phone number. I removed it. Bingo, Dialer can now find it! This is kind of horrifying. Google being tripped up by trailing whitespace?

mwpmaybe 11y ago

The Lando system?

GotAnyMegadeth 11y ago

I also see this with one of my brothers' names which is Olly <surname>.

packetized 11y ago

I wonder if this is related to i18n or country lookup. Chad is the only semi-common English-language name that's also a country name, that I can think of.

benplumley 11y ago
Jordan, Georgia. I feel like if this were the cause then the bug would be a lot more common. My guess is the dialler hashes some parts of the contact to get a UUID, but for this contact it happens to be outside the range the dialler can look at - perhaps off-by-one, where the dialler looks for UUIDs of 1 and above and this happens to hash to 0.
NLips 11y ago
There are also: India Georgia Jordan I'd guess they are all as common or more common than Chad.
stevoski 11y ago
My niece is called "Ireland". Continents too: I met a girl called "Africa", and "Asia" is certainly used as a name. However I don't ever expect to meet someone called "Democratic People's Republic of Korea"

Eyas 11y ago

I wonder if this is the only case where the name/first name of the contact is exactly the same as the recipient's address.

ryporter 11y ago

Somewhat similarly, I encountered a possible bug in Google Docs many years back. I was reorganizing my documents, and I temporarily changed one of the names to "delete". Poof -- I could not longer find it anywhere (or even search for words that I knew were in it). I forget how I got back to it (maybe via my browser history), but I changed the name a bit, and then the document was "found". This could have simply been a race case unrelated to the filename, but it's much more amusing to speculate that it was due to hack introduced during development. I now regret not trying to reproduce it, but I was pretty frustrated after I found my document again. I did contact support, but didn't hear anything back.

tmaly 11y ago

regex bugs are bad, I have been bitten by one before. Its pure technical debt

Gravityloss 11y ago

So, when computing power increases, we just add useless parsing at every level of software, decreasing performance and causing bugs like these.

dougdonohoe 11y ago

Was it the Chad? https://www.youtube.com/watch?v=_79BtELxB2k https://www.youtube.com/watch?v=_79BtELxB2k

incepted 11y ago

> Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems. jwz's wit was a lot of fun in the early 2000s but that quote is too often used wrong. This quote is not about regexps, it's about using wrong tools for the job. Using it without context makes it sound dumb. "Well, what if regexp is exactly the right solution for that problem?".

lmm 11y ago
A regexp is almost always the wrong solution. It's a way of representing a finite state machine that obscures the states, which are the only valuable part of the state machine abstraction (they're inherently incomprehensible otherwise). And most implementations these days have random extensions, meaning you have all the performance and safety issues of a turing-complete programming language - but a much worse UX. They may have made sense in the days of ed and the teletype, when a terse incomprehensible expression was better than a slightly longer readable one, but they don't now.
- incepted 11y ago
  > A regexp is almost always the wrong solution. That's quite a sweeping statement. Sure, complex regexps can be hard to read but state machines are just hard to read for humans in general, whatever the form. What do you recommend for parsing simple text entries, then?
  - lmm 11y ago
    If there are no existing libraries, parser combinators. More verbose but so much more readable, and they make it much easier to parse into an actual structure rather than a list of match groups.
    - incepted 11y ago
      > More verbose but so much more readable First of all, "more readable" is extremely subjective. Second, there are a lot of different parser combinators, all with very different syntaxes. Finally, parser combinators are readable by people familiar with them and regexps are readable by people familiar with them. Regexps are also much more widespread and approachable. And very often, writing a parser combinator to parse a simple text entry is way overkill. There are many good reasons why regexps are so popular.

tyingq 11y ago

A potential workaround...quote the local part: "chad"@example.com It seems to be supported by Exchange, gmail, and a few other MTA's I tested, and gets routed to the right place.