Hacker News Reader

Comment by nthitz | Hacker News Reader

I don't care for overaggressive email validators myself, but if you are registering with my service using an email of ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org" I'll probably want you to enter something more reasonable.

Anyway just because it is valid according to the RFC, doesn't mean that it's actually a valid user's email address.

View on HN

I guess I won't be using your service then! Quite frequently I find that services will not accept my perfectly valid email address as valid. This is on the whole their loss, since if they can't even properly validate an email address there are probably more loose ends and I'd rather not find out which.

I run into this a lot using a "+" in my Gmail address. I like to use "username+site_name@gmail.com" for easy filtering, but there are still quite a large number of sites that do not accept this as valid, and it is extremely annoying.

Years ago, I must have signed up or given my email address to Urban Outfitters with a +uo. They happily continue to send me emails, but their unsubscribe form does not accept it as a valid address! I've tried reporting the bug, but now just send the messages straight to spam.

I think you can get paid $25 for each and every one of those. You've made every effort to unsubscribe, and they're still spamming you.

On the whole, it's probably not a loss. It's probably a gain. On the whole, they validated almost all of the email addresses. They spent their corner case money instead on making the product awesome, and instead of poor []:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org getting a copy, everyone else got something better.

I don't understand. Won't a correct-to-spec validation procedure take about as long to implement as an ad hoc procedure? I'm guessing a maximum of two developer-hours, and that's if you're extremely careful (i.e. unit tests).

I recently did this:

    def is_email_address(email):
         return '@' in email

LGTM.

ship it.

Seriously, the only way to validate an email is to send them an email and make them click a validation link. I

It's not the worst way, but it's far from being the best way.

Sometimes you don't want the user to stop what they are doing, wait for an email to arrive, hope it doesn't land in spam, read it, click then link, and then continue. This is usually the case if you want them to buy something.

Secondly, what happens when they don't get the email? We had lots of problems where people where signing up from the following domains: gmail.cm, gmail.co, gmail.con, tmail.com, gmail.oom, gamil.com, hotamail.com, homtail.com, etc.

You want to firstly do some simple checks to see if it looks roughly like an email address. I like to see if it matches \S+@\S+\.\S+ (and ignore the few people with a top-level domain). Then you want to validate the actual domain to see if it's a misspelling of a popular address.

Why not use a librairy that validates emails? You save time, and you actually accept valid emails.

I agree that the example with a lot of symbols is over the top, but when a website doesn't accept foo+bar@host.com, I assume the product will be sub-par quality wise. The author did not follow of rigorous process for something as simple as email validation, I doubt he'll be more rigorous in other parts of his project.

There are other concerns too. I submitted a bug report to Zappos because their emailer did not URL-escape '+' in foo+bar@example.com. Resulting in:

  http://www.zappos.com/?email=foo+bar@example.org

which was treated as:

  http://www.zappos.com/?email=foo%20bar@example.org

by the browser. It worked fine when I manually encoded the '+'.

I've given up on using + addresses. As other people have pointed out, the worst thing about them is that sometimes you will find that it works initially but will break other parts of the application now or later. For example, account creation works fine, but in two years, you can no longer log in.

Accepting "()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org versus accepting j@ww.com

Hardly a valid comparison. Yes my theoretical non existant service would validate addresses like yours. That is vastly different to the one I mentioned.

No, but I like to use e.g. joe+SERVICE_NAME@gmail.com and a lot of places flag this as an invalid address. There are use cases.

I once had an issue with a ticket purchasing website which accepted my "name+SERVICE" email address when I signed up, but it refused it when I tried to sign in later, or possibly just when I was trying to use the "forgot password" functionality - it's been a while. Either way, I was effectively locked out of a website that was storing my credit card information.

Since I was in a hurry to buy the tickets (a last minute gift), I signed up for a second account without the "+SERVICE" section, bought the tickets, and sent them an email asking them to either merge the accounts, delete the old one, or otherwise allow me access the other account so I could purge my credit card data.

What happened next was a bit shocking. They sent me an email back a few days later saying that they had fixed the issue with my account by removing the '+' symbol.

The risk of exploit was relatively low due to the extreme obscurity, but it was technically possible for a short while for a person to go to my email provider and register the username "nameSERVICE" and access my account on the ticketing website, including my credit card information.

The sites that let you sign up using the + and then don't work later tend to be using URL encoding/decoding and converting that + into a space in some cases but not in others.

It's a bit extreme to correlate not being able to validate an email address (that isn't in a common format) to having other loose ends.

My email address is in a very common format.

Please be mindful that you responded to a post citing the example of

  ""()<>[]:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org"

That address is not "common" even if it is technically valid. If you want to talk about your own email address, you should provide a sample address that is similar so we know what you're talking about.

[edit: I see your address in your profile. It is nothing like the example given.]

If it's the one that you have on some of your social media sites, nice. I can suspect why they reject it but is it primarily because of the short length?

At a guess the problem is probably a code snippet that checks for minimum length. You could have an even shorter one for a single letter domain in a two letter tld, for instance x@y.nu

I remember what it is, and you're completely right - it's certainly legitimate and legible (though unusual ;) ).

"just because it is valid according to the RFC, doesn't mean that it's actually a valid user's email address."

I'm sorry but abiding by the RFC is the definition of a valid email address.

Postel said it best "be conservative in what you do, be liberal in what you accept from others."

Just because myname@xyz.com is valid according to the RFC does not mean xyz.com is an existing domain name with a mail server setup that an account 'myname', let alone that user who inputted actually has access to that account. Just send a validation email

You are confusing "valid email address" with "a valid email address, functioning mail server and user with appropriate credentials to access the system that processes email for the supplied email address."

What you quoted was "valid user's email address", not "valid email address". While "valid email address" is arguable, a "valid user"'s email address is more clearly about whether it accepts mail. :)

A "valid" email address does not have to mean a "well-formed" email address.

Without getting too existential what else could "valid" possibly mean.

One that someone is using to accept mail.

Reply on news.ycombinator.com