I also reached out to them on Twitter but they directed me to this form. I followed up with them on Twitter with what happened in this screenshot but they are now ignoring me.
I also reached out to them on Twitter but they directed me to this form. I followed up with them on Twitter with what happened in this screenshot but they are now ignoring me.
Probably, from what I can see the address in question isn’t really that exotic. but an email regex that validates 100% correctly is near impossible. And then you still don’t know if the email address actually exists.
I’d just take the user at their word and send an email with an activation link to the address that was supplied. If the address is invalid, the mail won’t get delivered. No harm done.
The best of validation is just to confirm that the email contains a
@and a.and if it does send it an email with a confirmation link.TLDs are valid in emails, as are IP V6 addresses, so checking for a
.is technically not correct. For examplea@banda@[IPv6:2001:db8::1]are both valid email addresses.I feel like using
a@[IPv6:2001:db8::1]is asking for trouble everywhere online.But its tempting to try out, not many people would expect this.
try user@123.45.67.89.in-addr.arpa or user@d.e.a.d.b.e.e.f.0.1.2.3.4.5.6.7.8.9.a.b.c.d.e.f.0.0.0.0.1.2.3.4.ip6.arpa just for the giggles. Mix it with BANG-Adressing:
123.45.67.89.in-addr.arpa!d.e.a.d.b.e.e.f.0.1.2.3.4.5.6.7.8.9.a.b.c.d.e.f.0.0.0.0.1.2.3.4.ip6.arpa!user
Email standard sucks anyway. By the official standard, User@email.com and user@email.com should be treated as separate users…
Personally I don’t think that sucks or is even wrong. Case-independent text processing is more cumbersome. ‘U’ and ‘u’ are two different symbols. And you have to make such rules for every language a part of your processing logic.
If people can take case-dependence for passwords (or official letters and their school papers), then it’s also fine for email addresses.
The actual problem is cultural, coming from DOS and Windows where many things are case-independent. It’s an acquired taste.
Unicode has standard rules for case folding, which includes the rules for all languages supported by Unicode. Case-insensitive comparisons in all good programming languages uses this data.
Note that you can’t simply convert both strings to uppercase or lowercase to compare them, as then you’ll run into the Turkish i problem: https://haacked.com/archive/2012/07/05/turkish-i-problem-and-why-you-should-care.aspx/
So good that we all use Unicode now. No CP1251, no ISO single-byte encodings, no Japanese encoding hell.
Yeah, living in 2123 sure is good
It’s that capitalization is language dependent, which email addresses shouldn’t be as I hope the rules for France shouldn’t be different than for Dutch. For instance é in Dutch is capitalized as E, but in French it is É. The eszett didn’t even have an official capital before 2017
In most programming languages, case-insensitive string compare without specifying the culture became deprecated. It should imo only be used for fuzzy searching doubles, which you probably will do with ToUpper for performance reasons, or maybe some UI validation.
Sure, but we’re just talking about string comparison rules, and Unicode sees all three of those as being equal. For example, a search engine that uses proper case folding rules in its indexer should return results for “entrée” if you search for “entree”, “Čech” if you search for “cech”, etc.
You can’t just use ToUpper for comparisons due to issues like you mentioned, and the Turkish i problem. You need to do proper case-insensitive comparisons, which is where the Unicode case folding rules are used.
offtopic: The eszett strictly speaking was a ligature for ‘sz’, which Hungarian orthography kinda preserved while for German the separated version is ‘ss’, and there’s plenty of such stuff in nature.
Thank you for saying that more clearly.
Im with the earlier “yeah… No.”
Because
“If people can take case-dependence for passwords”
They cant now do they ? If they could passwords would be a-okay and there wouldn’t be any need for stickies on monitors, password managers, biometrics, SSO, MFA and passwordless authentication.
The dumbest idea in computing is assuming everyone is as smart as you.
They aren’t. Why isn’t *nix any bigger? Here’s your answer. People are stupid.
Why did IT only finally took off with windows 3.11? because people could understand that. Barely. Most of us where way to dumb for everything which came before.
Why does ipv6 acception takes so long? Because people are stupid and don’t get it. Nobody really gets hex. So they just stay with what they can read and more or less get. Even the hardest part of ip4, subnetting, has an easy way out: just add 255.255.255.0 in there and it works. Doesnt work? Keep replacing 255 with zeros and eventually it will. Subnetting on ipv6? No idea. Let’s just disable ipv6 on the internal lan and leave everything on ipv4. Zero migration, zero risk, zero training needed.
Why do so many companies only go half assed into cloud? Because they don’t get it.
Powershell? Only half, a third even, of the admins truly get it.
I could go on.
Succes is build on simplicity.
Oh, I like writing such rants too, so I’ll answer with lots of words.
Hardware tokens. With sufficient demand the scale would make them really cheap.
It’s exactly because of having experience with making work the whole zoo that engineers don’t understand how much easier that would be for normies.
Assuming that everyone is as dumb as me in areas where I’m dumb would also be a mistake.
Because of oligopoly. People are not stupid, but they have priorities and they don’t have some of the knowledge we have. Also it doesn’t really have to be that big immediately, all in good time.
Can’t comment on that, I was born in 1996.
Because not everything supports it right, including some industrial equipment and network hardware, there may be new bugs in everything involved, the old ways work and it’s not just v4 with longer address, so people fear making mistakes in configuration.
Now think about similar horrors in, say, piping in houses, or other construction stuff. Or cars. Or roads. Everything is half-assed. It’s normal.
I kinda get it, but also hate it. Hard to read.
In general:
The most precious secret you can get from experience is that people are not stupid when they are given easy opportunity to try many things and choose what they like.
But then you run into the issue of incredibly trivial impersonation on any email service which doesn’t reserve all variants of registered names
Yes, email as it really exists kinda sucks, but the idea was nice. When it ran over UUCP, LOL.
I know at least one bank that has case-insensitive password in their app 🌚
Life being scary is not news to me
Yeah, no
Sometimes standards are wrong lol
Email doesn’t state anything about how you should treat users. User@email.com and user@email.com may be different addresses, but that doesn’t mean you can’t just reserve User@email.com when user@email.com reserves an account. Just don’t send your email to user@email.com when they registered with User@email.com, because the email address is the part you need to leave alone.
If you user modern email services (you probably aren’t, but oh well) this can become a real problem when İ.Akbas@email.tr and I.Akbas@email.tr register. Try to do a caseless compare in your database (
select id from users where email ilike ?) and the result will depend on the collation you use.The Turkish dotted i(distinct from the dotless ı form just one of the reasons you leave user input alone once you’ve filtered out all non-text characters.
We’re gonna need a bigger regex
https://pdw.ex-parrot.com/Mail-RFC822-Address.html
TLDs could theoretically have MX records too! Email addresses as specified also support IPv6 addresses! The regex would need to be
.+@.+and at this point it’s probably easier to just send an email.I’m with you, and I agree that is technically correct, but I believe the sheer number of people who might accidentally write “gmail” instead of “gmail.com” compared to people using an IPv6 address (seems like a spam bot) or using a TLD like “admin@com” make requiring the dot worthwhile.
That’s why I have an “allow anyway” button for addresses that look misspelled but are still technically valid.
Edit: believe it or not, that was a typo.