4 ms·

This is one of those features that seems so common sense that it's surprising it's taken this long to show up. It reminds me of when Gmail and Outlook started g

by Exmoor 6y ago

This is one of those features that seems so common sense that it's surprising it's taken this long to show up. It reminds me of when Gmail and Outlook started giving you a warning if you said the word "attached" or "attachment" in an email, but didn't attach files. This reminds me of the best email storm I ever saw. Someone at a large company I worked at sent an email to a discussion group that everyone had filtered with rules, but they put a one-letter typo in the domain name. So imagine something like sending it to HugeGroup@enail.com instead of @email.com. The thing was, the company actually owned enail.com to keep competitors from squatting on it, so the email actually went through, but completely broke almost everyone's rules. The results were quite spectacular, and entertaining.

sjwright 6y ago
Great story. Ridiculous that MX records were assigned to a defensively held domain name. Just asking for edge cases. Lucky this one didn’t have security consequences.
- crankylinuxuser 6y ago
  > Ridiculous that MX records were assigned to a defensively held domain name. Just asking for edge cases. Lucky this one didn’t have security consequences. Not really. Think of it from the customer's side. You sent an email to who you were thinking was legitimate. You want it to go to the person/group you sent it to. So, because of that, the admins (and customer facing) want to deliver the message. I do understand the complexity of this problem. I'm sure for large corps that wouldn't be true...
  - koheripbal 6y ago
    The solution here is a bounce message, not completed delivery.
    - crankylinuxuser 6y ago
      But why bounce when you can do what was intended? To me, that seems like the "Technical is the worst kind of correct" answer. And if your smaller org does good customer service, then you liberally accept and help. We on HN like to talk about horror company one of. We never talk much of the ones that do things right (or better).
      - koheripbal 6y ago
        For two reasons. Firstly, you want people to have the correct email address - because they can see the domain, and if it's wrong, you'll cause brand confusion. Secondly, you have to setup all these special mechanisms to correct peoples' typos, permutations of which can be numerous. Think about the compounding complexity of your system as you cater to the very few cases of people making an error that can otherwise be alerted to them to be fixed. ...not to mention the potential for security vulnerabilities. Will your anti-spam filters work on all these alternate domains? Will you setup SPK DKIM etc for them all to prevent spoofing as well? Will you have website forwards... ...the list of things to think about goes on. For what? To cater to that one idiot and his fat fingers? Just tell him he fucked up.

by Exmoor 6y ago

sjwright 6y ago

Great story. Ridiculous that MX records were assigned to a defensively held domain name. Just asking for edge cases. Lucky this one didn’t have security consequences.

crankylinuxuser 6y ago
> Ridiculous that MX records were assigned to a defensively held domain name. Just asking for edge cases. Lucky this one didn’t have security consequences. Not really. Think of it from the customer's side. You sent an email to who you were thinking was legitimate. You want it to go to the person/group you sent it to. So, because of that, the admins (and customer facing) want to deliver the message. I do understand the complexity of this problem. I'm sure for large corps that wouldn't be true...
- koheripbal 6y ago
  The solution here is a bounce message, not completed delivery.
  - crankylinuxuser 6y ago
    But why bounce when you can do what was intended? To me, that seems like the "Technical is the worst kind of correct" answer. And if your smaller org does good customer service, then you liberally accept and help. We on HN like to talk about horror company one of. We never talk much of the ones that do things right (or better).
    - koheripbal 6y ago
      For two reasons. Firstly, you want people to have the correct email address - because they can see the domain, and if it's wrong, you'll cause brand confusion. Secondly, you have to setup all these special mechanisms to correct peoples' typos, permutations of which can be numerous. Think about the compounding complexity of your system as you cater to the very few cases of people making an error that can otherwise be alerted to them to be fixed. ...not to mention the potential for security vulnerabilities. Will your anti-spam filters work on all these alternate domains? Will you setup SPK DKIM etc for them all to prevent spoofing as well? Will you have website forwards... ...the list of things to think about goes on. For what? To cater to that one idiot and his fat fingers? Just tell him he fucked up.