Hacker News Reader

Comment by digitalsushi | Hacker News Reader

On the whole, it's probably not a loss. It's probably a gain. On the whole, they validated almost all of the email addresses. They spent their corner case money instead on making the product awesome, and instead of poor []:,;@\\\"!#$%&'*+-/=?^_`{}| ~ ? ^_`{}|~.a"@example.org getting a copy, everyone else got something better.

View on HN

I don't understand. Won't a correct-to-spec validation procedure take about as long to implement as an ad hoc procedure? I'm guessing a maximum of two developer-hours, and that's if you're extremely careful (i.e. unit tests).

I recently did this:

    def is_email_address(email):
         return '@' in email

LGTM.

ship it.

Seriously, the only way to validate an email is to send them an email and make them click a validation link. I

It's not the worst way, but it's far from being the best way.

Sometimes you don't want the user to stop what they are doing, wait for an email to arrive, hope it doesn't land in spam, read it, click then link, and then continue. This is usually the case if you want them to buy something.

Secondly, what happens when they don't get the email? We had lots of problems where people where signing up from the following domains: gmail.cm, gmail.co, gmail.con, tmail.com, gmail.oom, gamil.com, hotamail.com, homtail.com, etc.

You want to firstly do some simple checks to see if it looks roughly like an email address. I like to see if it matches \S+@\S+\.\S+ (and ignore the few people with a top-level domain). Then you want to validate the actual domain to see if it's a misspelling of a popular address.

Why not use a librairy that validates emails? You save time, and you actually accept valid emails.

I agree that the example with a lot of symbols is over the top, but when a website doesn't accept foo+bar@host.com, I assume the product will be sub-par quality wise. The author did not follow of rigorous process for something as simple as email validation, I doubt he'll be more rigorous in other parts of his project.

There are other concerns too. I submitted a bug report to Zappos because their emailer did not URL-escape '+' in foo+bar@example.com. Resulting in:

  http://www.zappos.com/?email=foo+bar@example.org

which was treated as:

  http://www.zappos.com/?email=foo%20bar@example.org

by the browser. It worked fine when I manually encoded the '+'.

I've given up on using + addresses. As other people have pointed out, the worst thing about them is that sometimes you will find that it works initially but will break other parts of the application now or later. For example, account creation works fine, but in two years, you can no longer log in.

Reply on news.ycombinator.com