19 ms·
How not to check the validity of an email address
- MichaelApproved 13y agoI've had something similar delivered to me on a project I hired out. The most frustrating part was not the code but the developers reaction to why it was so bad. He had no idea what the big deal was and thought I was being nitpicky. Worse yet, was an initial claim that it was more efficient to do it that way. That was followed up with a claim that doing it differently wasn't possible. Needless to say, I stopped working with that team of "developers".
- meowface 13y ago>The most frustrating part was not the code but the developers reaction to why it was so bad. He had no idea what the big deal was and thought I was being nitpicky. This is always the worst. I've had experiences like that on many an occasion, where the person is simply like "huh? what's wrong?" You can't really fix that level of sheer incompetence, ignorance, and arrogance all wrapped into one.
- ketralnis 13y ago> You can't really fix that level of sheer incompetence, ignorance, and arrogance all wrapped into one. Sure you can. You can tell them why it's wrong and point them at reading material to fix it. Fixes incompetence and ignorance, and if you're lucky, arrogance. All wrapped into one. Everyone had to start somewhere.
- meowface 13y agoTrue, but it depends how arrogant and stubborn they are. If they're just simply arrogant and don't understand, you can do something, but in many cases they'll insist "this is fine. what's your problem?"
- shousper 13y agoOr more simply, you can't help people who don't want to be helped =)
- annnnd 13y ago> Worse yet, was an initial claim that it was more efficient to do it that way This is a classic excuse... so what if it leaks e-mail addresses (who looks at source code anyway?), makes clients wait (at least server's CPU is intact), and is just plain illegible (there is always a debugger if you want to fix a bug).
- eksith 13y agoIt's not possible the teach these people without encountering a massive, irreparable, hack. Nothing short of complete obliteration of their project through their own incompetence will work because the Dunning-Kruger effect is in full swing. The smartest people I know are acutely aware of how little they actually know compared to how much there is to know.
- deleted 13y ago[deleted]
- rachelbythebay 13y agoGradebusters / Making the Grade, or something with names like that, used to use a Java applet to "secure" the web site with student grades. You could just download the applet and decompile it to figure out their trivial encoding of the IDs and PINs (which were just params in the HTML). Or you could figure out just an ID (typically a student ID number, although more than a few were social security numbers, apparently), and use "1066" since they had a backdoor PIN in quite a few releases. Battle of Hastings, eh? Want to know how users did web security instead of asking their admins for a proper .htaccess/server-level config setup? That's how.
- MichaelGG 13y agoHeh, I've seen a great example of "high end" software for partitioning servers for a specific vertical (so multiple hostile customers could share the same hardware). Java applet to provide "rich" experience cross platform. OK, debatable. Security? On start, the Java app downloads a connection string to the MySQL DB. Which contains the root login for both SSH and MySQL. Then it prompts for your password and queries the Users table to see if you're allowed. And it helpfully logs this info into user's temp directory. "Ah yes, this is a known limitation in our current design." Edit: They repeatedly lied to customers about various security fixes (I didn't do full disclosure on the numerous issues I found). They didn't care as they were sold for a world of money, then the entire product line was nixed. Most customers don't seem to care (I've found similar stuff across the board); hackers are targeting lower hanging fruit for the time being.
- girvo 13y agoEducation software is literally the worst. Moodle was pretty ick to begin with, but you should've seen the state of one install I had to work on by the time I got to it. I still have nightmares.
- fnordfnordfnord 13y agoNeeds disrupting
- 13y ago
- kaeruct 13y agothis should be submitted to thedailywtf.com...
- emiliobumachar 13y agoIt's #1 on HN, it has plenty of exposure already.
- cdcarter 13y agoMcGill seems to use a LMS branded as "myCourses", apparently the newest label Blackboard is using for it's "Learn" line.
- ssalenik 13y agoMcGill switched to 'Desire2Learn' last summer as Blackboard no longer supports 'webCT', I think (access to old courses hosted on webCT is now very limited). 'myCourses' was the branding chosen by McGill... I think now they just call it 'myCourses2', after the switch.
- ivan_ah 13y agoHm... how come Desire2Learn hasn't been sued by Blackboard yet? Usually, as soon as a uni stops switches away to use a competing course management software, the competitor get sued based on the LMS patent: http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=6988138.PN.&OS=PN/6988138&RS=PN/6988138 http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=H... UPDATE: they //did// get sued, but won, and the above patent is invalid now. Way to go! http://en.wikipedia.org/wiki/Blackboard_Inc.#Legal_matters http://en.wikipedia.org/wiki/Blackboard_Inc.#Legal_matters
- willvarfar 13y agoA timely reminder to everyone: http://thedailywtf.com/ http://thedailywtf.com/ is still going strong! Be there or be ... competent?
- chanux 13y agoUse of potent instead of competent saves three characters and conveys the idea better... or ruder.
- danielweber 13y agoI quit them when Alex tried to takeover Programming Praxis by force when negotiations didn't seem to be moving fast enough for him.
- _sh 13y agoThis was news to me. http://programmingpraxis.com/2009/08/13/the-daily-wtf-maliciously-infringes-programming-praxis-trademark/ http://programmingpraxis.com/2009/08/13/the-daily-wtf-malici...
- weichi 13y agoIn order to truly understand the madness at play here, we really need to know how the list of email addresses was generated.
- deleted 13y ago[deleted]
- burntsushi 13y agoThe verbiage is sometimes used to exaggerate the condition of being stupid. I tend to enjoy that sort of flamboyant post on occasion, but others don't have much tolerance for it. YMMV. [EDIT] Original poster took the "drug usage" vernacular a bit too literally.
- MichaelGG 13y agoTo be fair (I didn't see the original comment), I'm not sure which drugs would result in designing such a terrible solution. I'm sure addicts around the world would not want to be painted with such a broad brush ;)
- Zikes 13y agoClearly they should have optimized this by stripping the @mail.mcgill.ca on the server side before serving the list.
- mmariani 13y agoClearly you must be joking. They should've kept the emails on the server-side the entire time. Then would be a matter of validating the request by searching the email in let's say SQLite. Would it be done? Probably not. But at least it'd be a lot stronger than sending sensitive data to clients every damn request.
- banachtarski 13y agoYou're missing the sarcasm :P
- mmariani 13y agoUnless it's clearly stated sarcasm gets garbled over the wire. So in the hope of helping those who don't get it I decided to do the right thing just to be on the safe side. ;)
- PakG1 13y agoOh come on, then sarcasm loses its humor. Anyone who didn't get it the first time probably falls into the same category of developer that is being criticized here. :P
- biot 13y agoFrom now on, when you see a post taking the form "Clearly [obviously bad idea]", please read it out loud in The Simpson's Comic Book Guy voice and place extra emphasis on the irony. This ensures you will get the correct intent 99% of the time.
- mmariani 13y ago
- Glyptodon 13y agoEvery single legacy application I've ever worked on has had analogous code buried in it somewhere. An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a web page. The page takes around 20 seconds to load. Switching it to use a single properly formatted SQL reduced load times to under a second. Another legacy app I'm employed to "repair" has one single 'template' for every page on the whole site. Its first ~500 lines conveniently consist of a giant and highly nested if/else clause to set the page variables and inline javascript. Such things are the result of "IT experts," "Software Managers," and "Product Administrators" who've never done real software/web development in their lives hiring random "programmers" who have history or psychology degrees and think they can program because they made a form in PHP. It only gets lovelier when eventually somebody realizes it's a huge security risk and hires an outside development firm to "secure" it. (Giant eye roll. If they couldn't vet a programmer, you can bet they're great at vetting security consultants and contract developer shops.) Did you know that randomly moving code into folders named "private" and "public" for a few thousand dollars can solve giant architectural and security issues like ridiculously easy XSS and SQL injection? I don't know what the deal is, but a huge proportion of people writing code are plain incompetent. At my last company we fired someone who created huge amounts of work for everyone (he thought he could secure page content and alert messages by using base 64 encoding as a stand in for hashing and encryption, for example) and a few months later he was hired as lead developer by a pretty reputable educational business. ... sigh
- sown 13y ago> Every single legacy application I've ever worked on has had analogous code buried in it somewhere. I'm not old enough to be responsible for stuff like that but I am incompetent enough.
- impressive 13y ago> I'm not old enough to be responsible for stuff like that but I am incompetent enough. Now that is a great conversation starter! I assume you think you know more than the senior/lead/architect on the team. You might, but have fun with that mentality. It's not sure to last. :)
- itengelhardt 13y agoI love how she gives away the name of the actual software (desire2learn) in the tag. :-)
- morgante 13y agoshe
- deleted 13y ago[deleted]
- justinator 13y agoVRFY is usually disabled. The only way to verify an address is to send a message to it. If it doesn't bounce back, it... well, probably exists.
- AYBABTME 13y agoI've once come across: if (!Boolean.FALSE.equals(aBoolean)) { // ... } I was pretty baffled.
- prodigal_erik 13y agoI've seen undergrads trying to write Ada: case x is when true => y; when others => z; end case; You know, so the code doesn't stop compiling when someone comes along and adds values to the Boolean type.
- jsight 13y agoWell, FileNotFound is a popular addition from what I hear.
- arethuza 13y agoI've seen a surprising amount of code that does: if (aBoolean == true) { .... }
- jlgreco 13y agoTypically that isn't done from ignorance, just some (imho misguided) idea about readability.
- arethuza 13y agoProbably the same kind of place that bans use of the ternary conditional operator because it's "too complicated" <sigh>
- jlgreco 13y agoEh, I can't say that I have any love for the ternary if operator. It is an ugly construct made necessary by the other flow control constructs being statements. Scala lets you just use if/else like that, the result is much clearer at the cost of 4 or so characters.
- w-ll 13y agoif input_email in valid_emails_set: send_email(input_email, another_param, etc) Their solution, while isn't wrong, could still be improved. With a somewhat modified 2822 regex with a more strict domain rule. But I would also assume you could just query the db.
- tantalor 13y agoYou assume "in valid_emails_set" doesn't make a query. It's fairly trivial to define your own __contains__ in python.
- masklinn 13y agoIndeed, since this is an internal system validating the uni's own emails it could easily query the uni's MSA for valid addresses. Although for a set of 80k items and long-running processes (fcgi or wsgi) you could also load the whole thing in memory directly and not bother with a custom `__contains__`.
- eru 13y agoI don't see how regular expression come in here. They'd have a list of valid addresses (in a Python dict or in a database or wherever) and they check against them.
- pmiller2 13y agoMan. Reading posts like these has several effects on me. One is utter shock that anyone could be so stupid. Another is to remind me of how little I know (because I'm sure in the eyes of someone who actually knows anything about security, I'd probably provoke the same reaction). I'm also amazed that some of the people responsible for these things can still find work. Here's my own personal story. The other day, I had a brain fart regarding my password for my online banking account. So, I got lazy and just clicked the "forgot password" link, answered the security questions, and within seconds, I got an email. It had my old password in it. Yes, my bank stores passwords in clear text. sigh. BTW, I'm also looking for a new job right now, so if you're after someone with 2 brain cells to rub together who also happens to be a decent Python programmer, shoot me an email. (It's in my profile.)
- dclowd9901 13y agoNot necessarily. They may be using a reversible hash. Not much more secure, but it beats plaintext.
- paulnechifor 13y agoIsn't that an oxymoron?
- harshreality 13y agoHow does it beat plaintext? A reversible hash isn't so much a hash as a bijective function. The security of all stored passwords then depends on the secrecy of the "hash" function.
- mason240 13y agoYeah, maybe they just look up the MD5 hash on http://md5.gromweb.com/ http://md5.gromweb.com/ and sent him the result. I used that site to show my boss his plaintext password to explain why MD5 alone is barely more than security though obscurity when trying to convince him that we needed to salt them as well - he agreed with me on the spot.
- 13y ago
- auctiontheory 13y agoYou know what would be awesome?! If the developer in question happens to frequent HN and responds to this thread, eh?
- slig 13y agoDevelopers like these don't even know HN exists.
- mherdeg 13y agoGosh. For some reason, the "right answer" I expected to see was "do not try to validate the address; just send the e-mail and handle the bounce if it fails". There is a whole other layer which is very good at handling incorrect or undeliverable addresses.
- dclowd9901 13y agoI recently sat in on a presentation regarding javascript module loading. Someone in our company had taken it upon themselves to roll their own solution, because, shit, they're being paid and apparently have no oversight. The solution involved creating an entire cache/hash layer on the client using local storage. At the end of the presentation I had to try to be as respectful as possible when I asked why basic browser caching and content expiration weren't enough. Apparently it wasn't even considered -_-
- arethuza 13y agoSo they had used HTML5 local storage and missed the fact that HTML5 has a pretty nice offline caching feature?
- venomsnake 13y agoDon't judge them too harshly. I am currently developing web app with offline capabilities. FT which provide the scaffolding code recommend using the cache manifest only for the absolutely minimum requirements (jquery + 10 lines of html) and use local storage for all the rest. I suppose they know what they are talking about.
- kybernetikos 13y agoMaybe, but I'd worry that they're only suggesting that because the appcache can be a pain to work with. localStorage is synchronous, and so putting huge amounts of data in there can delay page load.
- 13y ago
- joshfraser 13y agoIn college I was hired to build an auction site. I was billing my client $20 / hour and subcontracting out the work to some of my fellow classmates at $10 / hour. I was swamped with other work and didn't have much time to review the code. I just made sure it satisfied the specifications and shipped it. We launched the site and did a few hundred thousands dollars worth of transactions in the first 24 hours. Then something strange happened... all of the bids mysteriously disappeared from our admin panel and users started emailing in asking why their bids weren't showing up anymore. I got a panicked call asking what had happened. I had no clue, but promised to look into it. I started digging through the server logs and noticed that all the bids had been deleted around the time that Google had discovered and crawled the site. Sure enough, my friend had added links to delete bids via the admin panel that were executed via GET requests. It wouldn't have been that big of a deal except the poor guy had used JavaScript for authentication! Google's crawlers had carefully hit every single Delete link and wiped out the site. I fixed the authentication system, refunded everyone's credit cards and relaunched the site with a huge apology for the issues. Needless to say, from that day on I became far more diligent about doing code audits.
- beambot 13y agoHow did GoogleBot get access to the (presumably) private admin panel to crawl the links in the first place? Also, these sort of things require server-side authentication, not just JS. Just because GoogleBot won't crawl your PUT requests doesn't mean others won't -- including users (malicious or otherwise)! Just sayin'.
- joshfraser 13y agoIf I recall correctly the code looked something like this: <?php if (!admin()) echo "<script>window.location = '/signin';</script>"; delete_bid($_GET['bid_id']); ?>
- mbenjaminsmith 13y agoWhen you think about it it's actually pretty elegant -- if your purpose is to write something that appears to work but will do the worst possible thing when crawled.
- Uchikoma 13y agoFor me it depends on what "validity" means. 1.) Prevent typos etc. Regex or Mailgun or Kicksend is enough. 2.) Prevent bounces, prevent wrong signups one needs to do double opt in.
- anjc 13y agoThe article has nothing to do with this aspect of address validation
- Uchikoma 13y ago1.) Yes, the article was about choosing the right approach for validation 2.) I urge developers to step back and think about the requirements they get. Concerning those I would have thought what validity in this situation means, e.g. light validation in JS, send validation / validation list on the server etc.
- asdfs 13y agoSomewhat unrelated, but out of curiosity, does anyone know of a site that lists — for all popular languages — various libraries/code snippets/routines which one can use to correctly (according to the RFCs) check the validity of e-mail addresses? If not I may be compelled to create one.
- taproot 13y agoThere isn't. Look up the regex for validating an email address it you'd like to know why.
- computer 13y agoJust send an email and see if it arrives.
- jabr 13y ago/.@./ is pretty much the best you can do. And even the dots are a bit iffy.
- rmc 13y agoThe RFC-compliant email address is actually incredibly complex. There are loads of things that are RFC-valid email addresses that basically hardly anyone uses (like spaces).
- callahad 13y agoThe HTML5 standard actually defines a mostly-sane regex, which achieves that sanity through "a willful violation of RFC 5322, which defines a syntax for e-mail addresses that is simultaneously too strict (before the "@" character), too vague (after the "@" character), and too lax (allowing comments, whitespace characters, and quoted strings in manners unfamiliar to most users) to be of practical use here." I like it. Link: http://www.whatwg.org/specs/web-apps/current-work/multipage/states-of-the-type-attribute.html#valid-e-mail-address http://www.whatwg.org/specs/web-apps/current-work/multipage/...
- mason240 13y ago@"^[^@]{1,}[@]{1}[^@]{1,}\.{1}[^@]{1,}$" I check it with this RegEx to make sure it's in the right format of [string]@[string].[string] to make sure that user at least tries to enter an email address, but beyond that sending and email and getting a response is the only way.
- hussfelt 13y agoCheck out our Eduware startup Coursio http://coursio.com/ http://coursio.com/ for hassle-free education! I vouch for the code, wrote it myself with some really good advisors around! ;-) Get in touch with me personally, I'll give you a brief introduction!
- samirhurshal 13y agoThis would have been so simple to just make right in the beginning. They should have just hashed each of those user names and put the hash into a dictionary. Whenever someone entered an email check if it is in the dictionary. O(1) time and it wouldn't be a "data leak vulnerability". So close...
- jheriko 13y agoi wouldn't blame drugs... this is just stupidity, or perhaps even naivete. :)
- kirab 13y agoAm I the only one who thinks that the amount of flaming is kind of unproductive?
- ramblerman 13y agoIt seems to be part of HN culture. Putting down this code make people feel better about themselves. Because obiously this is bad, even they can see that. There is certainly value to the post but, yes, the flaming gets old - very quickly.
- dellsystem 13y agoUnproductive, probably; fun to write, definitely.
- adamdavis 13y agoIt's a common thing I see with programmers. I know I've been guilty of it before. I see some poorly coded module and I'm just disgusted of how bad it is and then proceed to say some of the nastiest things about the developer who wrote it, sometimes just aloud to myself, other times to my peers. These days I do my best to try to remember we all make mistakes, and that instead of flaming whoever is responsible for a mistake when it rears its ugly head, it's probably best to take it as an opportunity to discuss what I saw as shortcomings in the code with them and turn it into a learning experience if possible. Sometimes of course this isn't possible when you inherit code from devs who are long gone. Either way, I'm not sure any good is done throwing all that negative energy into the air.
- eksith 13y agoPeople who write similar code are what I like to call low-hanging fruit factories. I'm counting on them to make things as rubbish as possible, as long as they're not involved in any service I use, so anyone tempted to find vulnerabilities will go there first.
- babuskov 13y agoI'm sad to see so many smart people wasting their time discussing what some stupid person did. :( I'm also disappointed I lost a couple of minutes of my life reading about this stupidity as well... just because it got 233 points. So, I'm looking at YOU 233 who upvoted this. WHY DID YOU DO IT?
- babuskov 13y agoAs expected. :) Just click the downvote button on my comment. Don't bother to explain anything. Oh, I know, you disapprove I called you smart. Sorry about that.
- Nicholas_C 13y agoI've been on HN for a while (lurking), never seen a downvote button but here people referencing them on occasion. Why do I not see downvote buttons? Or is this some inside joke?
- Domenic_S 13y agoYou need 500 karma to get a downvote button. "Why don't I see down arrows?" http://ycombinator.com/newsfaq.html http://ycombinator.com/newsfaq.html
- MertsA 13y agoNot all users can downvote things, I'm not sure if it's directly tied to how much karma you have but it's a measure to give more weight to the opinions of the more respected members of the community instead of anyone who has an account. Hopefully this will mean that Hacker News never turns into Reddit.
- plg 13y agothere is a huge market (education and higher education) where institutions (sometimes governments) will pay huge money for these sorts of apps, and for whatever reason, the only real players are often of this quality at my university we use a similar system called OWL, which replaced a system called Web-CT. Both are horrendously slow, with fantastically poorly thought out interfaces. There is a ton of money to be made here. Low hanging fruit.
- chenglou 13y agoHow ironic that you mention WebCT, because that's what McGill in the article uses until very recently.
- slig 13y agoGee, what a newb. Here's how to do it in O(1): return userNamesStr.indexOf(curForwardUserName) >= 0 ;) (I'd love to not have to explain sarcasm, but people have an incredible difficult time understanding it here.)
- lstamour 13y agolol, I was thinking that too -- "but indexOf is faster..."
- nkg 13y agolol
- jrochkind1 13y agoIt's good to be reminded how many employed programmers don't actually know how to program. Actually, I'm not quite sure why or whether it's good to be reminded of this. Maybe it's better to try and forget it.
- deleted 13y ago[deleted]
- hawkharris 13y ago"I stumbled upon this snippet while doing research for my thesis, 'Prolonged drug use and its effect on code quality.'" Lol.
- Sami_Lehtinen 13y agoOld slogan, booze bottle a day, keeps good code away.
- powertower 13y ago> I would really like to know the combination and quantities of drugs consumed that resulted in this code. Do you know? Can you hook me up? Meth. Two week binge. SilkRoad. I can't imagine opiates did that. And the only thing you'd do on coke is more coke in combination with hating yourself; not coding shit like this up.
- drderidder 13y agoDang, that programmer sure gets around! They did a stint on my team, too.
- AMcQuarrie 13y agoUnrelated fact: Desire2Learn likes to employ large quantities of first year CS student interns.
- jb17 13y agoAm I the only one who thinks that the repeated attacks on drugs and drug usage are really unnecessary (and not well informed on the topic)?
- Sami_Lehtinen 13y agoOne coder used framework he didn't completely understand. Originally there wasn't password requirement for users. But when site got more confidential data password feature had to be added. Well how it was done? When user gave login and clicked ok, came page asking for password. But if you changed url at this point, everything worked. When I checked the actual code, the user form logged user in and password form logged user out if password was incorrect. Oh boy, I did praise that guy. Same guy used base64 encryption, so urls would be unguessable. Guess if there's real authentication at all if you modify the url content correctly. - Well, of course there isn't. Btw. Why there aren't negative recommendations at linkedin?
- hadem 13y agoSadly, this looks like something my boss might try to pull off...
- apinstein 13y agoThis made my day. After spending the last 6 months turning down developers based on horrible code reviews, I finally feel vindicated for sticking to my instincts and hoping to eventually find someone that doesn't think code like that from TFA is "programming" and subsequently destroying my codebase and crushing my soul.
- Buzaga 13y agoI was waiting for the part of story where she would describe how the developer had an actual drug habit or something, so much she talked about it. I wonder if she's ever really met someone who 'uses drugs', this mockery seems incredibly infantile.
- lstamour 13y agoHate to burst people's bubble here on the privacy of email addresses, but it's routine at universities to have open, relatively unprotected LDAP directories or even web listings. That said, under Canadian PIPEDA (privacy laws), email addresses are considered personal information, so this would be a severe breach... As are all the times I get CC'd a bulk email rather than BCC'd.