5 ms·

Netflix can also solve this on their end by sanitizing gmail addresses before saving them, stripping all dots and discarding everything after the plus sign from

by tcgv 8y ago

Netflix can also solve this on their end by sanitizing gmail addresses before saving them, stripping all dots and discarding everything after the plus sign from the account name. Any attempt to submit additional gmail "dot addresses" would result in a violation of primary key constraint.

matthewmacleod 8y ago
This is, however, not a valid way to treat email addresses in general. At a company the size of Netflix, maybe it’s reasonable - but not generally. It might be better to look at solutions that actually fix the underlying issue - like requiring a login.
josteink 8y ago
Why should anyone expect or tolerate a email service (like Gmail) to exhibit such dangerous, non-standard behavior? Imagine what would happen if we let this kinda sloppiness play loose on DNS instead. Terrifying, right? So why do we allow google to mangle standard internet email?
- ASalazarMX 8y ago
  Because that was a known feature since 2008 that helps making aliases on the fly. For example, you register on SomeForum as myemail+someforum@gmail.com, and if you ever receive spam on that address, you know it was SomeForum who sold email lists. This was a good thing when email lists were being sold without regulations. https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-more-from-your.html https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...
  - josteink 8y ago
    So every website everywhere on the internet which has anything to do with email will have to consider each and every hack which every email provider has done which deviates from Internet email standards, ever, before sending an email or registering an account or anything... or else the website is at fault if these standards-violations leads to security issues? Fuck that shit! Oh... We should only give Google and Gmail a free pass because they’re big? No, fuck that too. That’s not how internet standards and internet emailing works. It’s level playing field because everyone plays by the rules, and when you cause fuck-ups like this, it’s entirely on your base. Gmail is the one who needs fixing, not everyone else.
    - koolba 8y ago
      I don’t see how this very pleasant user friendly feature of Gmail is an issue. IIRC, email addresses are not even case insensitive. So foo@example.com isn’t necessarily FOO@example.com. Websites should be validating email addresses by sending them an email with an (expiring quickly) link and having the user act upon it. Short of that there’s no way for you to know that a user controls a given address.
      - josteink 8y ago
        Gmail enables a high-risk non-standard feature to 100% of its users, while optimistically only 0.00000001% uses it. That’s grossly irresponsible. Let the users who needs aliases enable them explicitly and manage them themselves.
        koolba 8y ago
        I’m clearly biased working in tech but from my anecdata the gmail “address hacks” are used by significantly more than 0.00000001% of the population. And not just because that’s 1 out 10 billion people. Regardless that’s no excuse for shitty software and websites that don’t follow standards. Literally anything before the @ sign is fair game to be interpreted by the email server as it sees fit. That include emojis, case sensitive names, and most punctuation. Assuming email addresses are unique because the text is unique is simply wrong.
- deleted 8y ago
  [deleted]

by tcgv 8y ago

matthewmacleod 8y ago

This is, however, not a valid way to treat email addresses in general. At a company the size of Netflix, maybe it’s reasonable - but not generally. It might be better to look at solutions that actually fix the underlying issue - like requiring a login.

josteink 8y ago

Why should anyone expect or tolerate a email service (like Gmail) to exhibit such dangerous, non-standard behavior? Imagine what would happen if we let this kinda sloppiness play loose on DNS instead. Terrifying, right? So why do we allow google to mangle standard internet email?

ASalazarMX 8y ago
Because that was a known feature since 2008 that helps making aliases on the fly. For example, you register on SomeForum as myemail+someforum@gmail.com, and if you ever receive spam on that address, you know it was SomeForum who sold email lists. This was a good thing when email lists were being sold without regulations. https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-more-from-your.html https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...
- josteink 8y ago
  So every website everywhere on the internet which has anything to do with email will have to consider each and every hack which every email provider has done which deviates from Internet email standards, ever, before sending an email or registering an account or anything... or else the website is at fault if these standards-violations leads to security issues? Fuck that shit! Oh... We should only give Google and Gmail a free pass because they’re big? No, fuck that too. That’s not how internet standards and internet emailing works. It’s level playing field because everyone plays by the rules, and when you cause fuck-ups like this, it’s entirely on your base. Gmail is the one who needs fixing, not everyone else.
  - koolba 8y ago
    I don’t see how this very pleasant user friendly feature of Gmail is an issue. IIRC, email addresses are not even case insensitive. So foo@example.com isn’t necessarily FOO@example.com. Websites should be validating email addresses by sending them an email with an (expiring quickly) link and having the user act upon it. Short of that there’s no way for you to know that a user controls a given address.
    - josteink 8y ago
      Gmail enables a high-risk non-standard feature to 100% of its users, while optimistically only 0.00000001% uses it. That’s grossly irresponsible. Let the users who needs aliases enable them explicitly and manage them themselves.
      - koolba 8y ago
        I’m clearly biased working in tech but from my anecdata the gmail “address hacks” are used by significantly more than 0.00000001% of the population. And not just because that’s 1 out 10 billion people. Regardless that’s no excuse for shitty software and websites that don’t follow standards. Literally anything before the @ sign is fair game to be interpreted by the email server as it sees fit. That include emojis, case sensitive names, and most punctuation. Assuming email addresses are unique because the text is unique is simply wrong.
deleted 8y ago
[deleted]