5 ms·

Facebook breaks RFC2045 with quoted printable

86 points by drewr 17y ago

sneakums 17y ago
Ah, so that's why people pronounce it "SuckMail".
- deleted 17y ago
  [deleted]
htsh 17y ago
a couple of questions out of curiosity: first, why would facebook do this? Is it anything more than negligence? Second, what are the consequences besides some facebook messages ending up truncated? Do excessive messages of this type choke up mailservers or anything else of the sort?
- w1ntermute 17y ago
  why would facebook do this? Is it anything more than negligence? That's pretty much it. They already fail to provide cross-browser compatibility for their website (Opera has long had problems with it), so this is just another way of thumbing their nose at open standards. what are the consequences besides some facebook messages ending up truncated? Do excessive messages of this type choke up mailservers or anything else of the sort? From TFA: as spammers make the same mistake rather often - I've seen line length checks for Quoted-Printable implemented in antispam software. So I'm guessing quite a few emails from Facebook are getting sent to people's spam folders.
  - iseff 17y ago
    > so this is just another way of thumbing their nose at open standards. It's likely much less "thumbing their nose at open standards" as it is just a matter of making sure their software works for the vast majority of their users. I know that's how I develop software, anyways -- if there's a quirk in a browser used by a very small percentage of users that's not entirely simple to fix, I don't. It's just a matter of priorities: create new features and upgrade existing ones for 99% of your users or fix features for 1% of users. Depending on the feature, you make a rational decision.
    - w1ntermute 17y ago
      Facebook has 200 million users. If they don't fix a feature for 1% of their users, that's affecting 2 million people. I'd say that's pretty significant. When you consider that this bug probably affects a lot more than 1% of the users, you're looking at tens of millions of affected users. Moreover, I seriously doubt that a company like Facebook has any manpower issues when it comes to fixing bugs on their site.
      - zimbabwe 17y ago
        I've heard this argument - the "if a large company ignores a small percentage then they're still doing awful things" - to justify a hell of a lot of griping. If Facebook was doing this willfully then I'd agree with you, but as it is they're an enormous company dealing with possibly the most complex consumer site (interface-wise) out there, and I'd be willing to bet they've got a few dozen priorities that are messing up for more than a percentage point, and that all those priorities are really tricky problems.
jseifer 17y ago
Facebook's response to the guy demonstrates a total lack of understanding of the issue: I apologize for this inconvenience. Unfortunately, this is not an error on our end. You will need to speak with your email provider in order to resolve this issue. That said, I'm sure this just hasn't been a priority yet rather than something willful. That along with with browser compatibility as w1ntermute said above.
- mseebach 17y ago
  No, it demonstrates that they are likely to get 1000s of e-mail every day from random people claiming that their servers are down, or they send out corrupted emails or whatever, when in fact the problem is squarely on the users end. Processing all these to catch the odd legitimate one has a very unfavourable cost/benefit ration. Yeah, it is a legitimate complaint, and it'd be quite simple to fix. I want them to make their AJAX degrade more gracefully, so the site will work on my cell in Opera mobile. I would be nice with a "I know what I'm talking about" certificate that would bypass front-line support for those who really do understand what they're talking about. A secret handshake or something :)
  - TomOfTTB 17y ago
    I think there are ways to address a lot of issues like this when you have Facebooks financial resources but I agree with your point in that I think a lot of people don’t see the issue here. The issue with low level tech support people is they lack judgment. Nice people, don’t get me wrong, but if you’re the guy answering tech support inquiries for $10 an hour you probably don’t have great judgment. So if you give tech support people carte blanche access to the engineers they will generally pester those engineers to death. But the reverse of that is sometimes those lower level people ignore a legit problem. Now I don’t know Facebook’s policy. If I had their money I’d probably create a tree structure of some kind where more competent people supervise the less competent people and so those less competent people can pester an intermediary who can then forward worthwhile info up the chain. But even still you’re dealing with the judgment of low level people.
    - 17y ago
kragen 17y ago
I don't see how truncating lines can be "correct" behavior. Be liberal in what you accept and conservative in what you send.
- smanek 17y ago
  I know that's in the RFCs, but that's the kind of thinking that caused the web standards nightmare everyone has to deal with today. If you accept incorrect input, then people will expect you to continue to do so into eternity - and if you have significant market share (facebook, IE, etc) you've just created a defacto (ill-conceived, poorly documented) standard that every other implementor now has to try to reverse engineer and try conform to.
  - kragen 17y ago
    That's also the kind of thinking that made the internet and the Web workable systems, while Hyper-G, OSI, SNA, DECNET, Xanadu, and so on ended up in the dustbin of history. Yeah, it's too bad that at some point someone has to build quirksmode.org and write the HTML5 standard, but that's better than not having widely-used web standards to deal with in the first place.
  - wmf 17y ago
    The alternative to Postel's Law is usually data loss. When your mail server receives one of these malformed emails from Facebook, what should it do? Delete it? Bounce it? (Facebook will just delete the bounce.) Print it out and mail it to Zuckerberg COD?
    - smanek 17y ago
      Probably alert the user that it can't be parsed (like browsers currently do for XHTML). Maybe do something like firefox does when it encounters a self signed SSL cert - allow the user to accept it - but make that choice explicit and painful. If most parsers actually did this, I doubt people would carelessly violate standards anymore. Of course, it's a bit of a prisoners dilemma to get everyone to actually do this. The one guy who doesn't will likely become immensely more popular than his competitors ... Oh well, it's nice to dream.
justin_vanw 17y ago
I'm going to start submitting stories like "${trendy_website} breaks ${random_official_sounding_standard} with ${what_can_break[random_official_sounding_standard]}" and link it to a post on some newsgroup. My karma will go through the roof.
- wmf 17y ago
  Despite the sarcasm, there is a kernel of truth here. It is difficult to be fully compliant with every standard at all times. Bugs happen. Support people deny that bugs exist. If Facebook is sending some improperly formatted mail, that's hardly news.
  - justin_vanw 17y ago
    It's mundane, very very mundane. I don't think you can be, like, super-mundane, because being surprising in any way, even if it is for how mundane you are, would make you in fact not mundane at all. So although I don't know how to say it, this is as mundane as you could possibly get before you cause some kind rip in the mundane-exciting continuum.
    - ramidarigaz 17y ago
      I'm not sure what you're trying to say, but it's funny.
- drewr 17y ago
  My purpose in posting the message was actually to try and get Markus's issue in front of someone other than a first-tier support person. I'm fairly certain that facebook developers frequent HN. I wanted them to at least know that they were violating a standard and someone feels the pain of their decision. I've been a mail admin. Dealing with the traffic that facebook generates is not trivial. It's akin to the hoops I would have to jump through for AOL and Hotmail five years ago. Quoted-printable breakage is not a major problem in the long run, but if there isn't a good reason for the violation, then why not fix it? It may have just been oversight. I used a provocative title because I wanted people to read it, mod it up, and allow fb engineers the chance to speak for themselves. If no one found it compelling then it wouldn't have garnered any karma and you wouldn't have seen it.
avner 17y ago
Facebook quite intermittently displays careless amateurism in its conduct. However, what exudes more concern in their response is the 'possibility' of any random employee having the audacity to respond to a matter like this, without actual insight.
- michaelfairley 17y ago
  It's very possible that the employee shot some emails around internally, got back some responses from various engineers responsible for this functionality, and then replied with a slightly inaccurate paraphrase of the information he was given. I know that's how it works at my employer (hopefully without the incorrect/rude-ish responses).
drewr 17y ago
Props to facebook for fixing it! http://article.gmane.org/gmane.mail.qmail.general/55843 http://article.gmane.org/gmane.mail.qmail.general/55843 Although he credits reddit, this is the only post I can find and its karma score is less than 10: http://www.reddit.com/r/reddit.com/comments/8u78r/facebook_breaks_rfc2045_with_quoted_printable/ http://www.reddit.com/r/reddit.com/comments/8u78r/facebook_b... It had to be HN! :-)

86 points by drewr 17y ago

sneakums 17y ago

Ah, so that's why people pronounce it "SuckMail".

deleted 17y ago
[deleted]

htsh 17y ago

a couple of questions out of curiosity: first, why would facebook do this? Is it anything more than negligence? Second, what are the consequences besides some facebook messages ending up truncated? Do excessive messages of this type choke up mailservers or anything else of the sort?

w1ntermute 17y ago
why would facebook do this? Is it anything more than negligence? That's pretty much it. They already fail to provide cross-browser compatibility for their website (Opera has long had problems with it), so this is just another way of thumbing their nose at open standards. what are the consequences besides some facebook messages ending up truncated? Do excessive messages of this type choke up mailservers or anything else of the sort? From TFA: as spammers make the same mistake rather often - I've seen line length checks for Quoted-Printable implemented in antispam software. So I'm guessing quite a few emails from Facebook are getting sent to people's spam folders.
- iseff 17y ago
  > so this is just another way of thumbing their nose at open standards. It's likely much less "thumbing their nose at open standards" as it is just a matter of making sure their software works for the vast majority of their users. I know that's how I develop software, anyways -- if there's a quirk in a browser used by a very small percentage of users that's not entirely simple to fix, I don't. It's just a matter of priorities: create new features and upgrade existing ones for 99% of your users or fix features for 1% of users. Depending on the feature, you make a rational decision.
  - w1ntermute 17y ago
    Facebook has 200 million users. If they don't fix a feature for 1% of their users, that's affecting 2 million people. I'd say that's pretty significant. When you consider that this bug probably affects a lot more than 1% of the users, you're looking at tens of millions of affected users. Moreover, I seriously doubt that a company like Facebook has any manpower issues when it comes to fixing bugs on their site.
    - zimbabwe 17y ago
      I've heard this argument - the "if a large company ignores a small percentage then they're still doing awful things" - to justify a hell of a lot of griping. If Facebook was doing this willfully then I'd agree with you, but as it is they're an enormous company dealing with possibly the most complex consumer site (interface-wise) out there, and I'd be willing to bet they've got a few dozen priorities that are messing up for more than a percentage point, and that all those priorities are really tricky problems.

jseifer 17y ago

Facebook's response to the guy demonstrates a total lack of understanding of the issue: I apologize for this inconvenience. Unfortunately, this is not an error on our end. You will need to speak with your email provider in order to resolve this issue. That said, I'm sure this just hasn't been a priority yet rather than something willful. That along with with browser compatibility as w1ntermute said above.

mseebach 17y ago
No, it demonstrates that they are likely to get 1000s of e-mail every day from random people claiming that their servers are down, or they send out corrupted emails or whatever, when in fact the problem is squarely on the users end. Processing all these to catch the odd legitimate one has a very unfavourable cost/benefit ration. Yeah, it is a legitimate complaint, and it'd be quite simple to fix. I want them to make their AJAX degrade more gracefully, so the site will work on my cell in Opera mobile. I would be nice with a "I know what I'm talking about" certificate that would bypass front-line support for those who really do understand what they're talking about. A secret handshake or something :)
- TomOfTTB 17y ago
  I think there are ways to address a lot of issues like this when you have Facebooks financial resources but I agree with your point in that I think a lot of people don’t see the issue here. The issue with low level tech support people is they lack judgment. Nice people, don’t get me wrong, but if you’re the guy answering tech support inquiries for $10 an hour you probably don’t have great judgment. So if you give tech support people carte blanche access to the engineers they will generally pester those engineers to death. But the reverse of that is sometimes those lower level people ignore a legit problem. Now I don’t know Facebook’s policy. If I had their money I’d probably create a tree structure of some kind where more competent people supervise the less competent people and so those less competent people can pester an intermediary who can then forward worthwhile info up the chain. But even still you’re dealing with the judgment of low level people.
  - 17y ago

kragen 17y ago

I don't see how truncating lines can be "correct" behavior. Be liberal in what you accept and conservative in what you send.

smanek 17y ago
I know that's in the RFCs, but that's the kind of thinking that caused the web standards nightmare everyone has to deal with today. If you accept incorrect input, then people will expect you to continue to do so into eternity - and if you have significant market share (facebook, IE, etc) you've just created a defacto (ill-conceived, poorly documented) standard that every other implementor now has to try to reverse engineer and try conform to.
- kragen 17y ago
  That's also the kind of thinking that made the internet and the Web workable systems, while Hyper-G, OSI, SNA, DECNET, Xanadu, and so on ended up in the dustbin of history. Yeah, it's too bad that at some point someone has to build quirksmode.org and write the HTML5 standard, but that's better than not having widely-used web standards to deal with in the first place.
- wmf 17y ago
  The alternative to Postel's Law is usually data loss. When your mail server receives one of these malformed emails from Facebook, what should it do? Delete it? Bounce it? (Facebook will just delete the bounce.) Print it out and mail it to Zuckerberg COD?
  - smanek 17y ago
    Probably alert the user that it can't be parsed (like browsers currently do for XHTML). Maybe do something like firefox does when it encounters a self signed SSL cert - allow the user to accept it - but make that choice explicit and painful. If most parsers actually did this, I doubt people would carelessly violate standards anymore. Of course, it's a bit of a prisoners dilemma to get everyone to actually do this. The one guy who doesn't will likely become immensely more popular than his competitors ... Oh well, it's nice to dream.

justin_vanw 17y ago

I'm going to start submitting stories like "${trendy_website} breaks ${random_official_sounding_standard} with ${what_can_break[random_official_sounding_standard]}" and link it to a post on some newsgroup. My karma will go through the roof.

wmf 17y ago
Despite the sarcasm, there is a kernel of truth here. It is difficult to be fully compliant with every standard at all times. Bugs happen. Support people deny that bugs exist. If Facebook is sending some improperly formatted mail, that's hardly news.
- justin_vanw 17y ago
  It's mundane, very very mundane. I don't think you can be, like, super-mundane, because being surprising in any way, even if it is for how mundane you are, would make you in fact not mundane at all. So although I don't know how to say it, this is as mundane as you could possibly get before you cause some kind rip in the mundane-exciting continuum.
  - ramidarigaz 17y ago
    I'm not sure what you're trying to say, but it's funny.
drewr 17y ago
My purpose in posting the message was actually to try and get Markus's issue in front of someone other than a first-tier support person. I'm fairly certain that facebook developers frequent HN. I wanted them to at least know that they were violating a standard and someone feels the pain of their decision. I've been a mail admin. Dealing with the traffic that facebook generates is not trivial. It's akin to the hoops I would have to jump through for AOL and Hotmail five years ago. Quoted-printable breakage is not a major problem in the long run, but if there isn't a good reason for the violation, then why not fix it? It may have just been oversight. I used a provocative title because I wanted people to read it, mod it up, and allow fb engineers the chance to speak for themselves. If no one found it compelling then it wouldn't have garnered any karma and you wouldn't have seen it.

avner 17y ago

Facebook quite intermittently displays careless amateurism in its conduct. However, what exudes more concern in their response is the 'possibility' of any random employee having the audacity to respond to a matter like this, without actual insight.

michaelfairley 17y ago
It's very possible that the employee shot some emails around internally, got back some responses from various engineers responsible for this functionality, and then replied with a slightly inaccurate paraphrase of the information he was given. I know that's how it works at my employer (hopefully without the incorrect/rude-ish responses).

drewr 17y ago

Props to facebook for fixing it! http://article.gmane.org/gmane.mail.qmail.general/55843 http://article.gmane.org/gmane.mail.qmail.general/55843 Although he credits reddit, this is the only post I can find and its karma score is less than 10: http://www.reddit.com/r/reddit.com/comments/8u78r/facebook_breaks_rfc2045_with_quoted_printable/ http://www.reddit.com/r/reddit.com/comments/8u78r/facebook_b... It had to be HN! :-)