• tyler@programming.dev
      link
      fedilink
      arrow-up
      18
      arrow-down
      1
      ·
      4 days ago

      You shouldn’t be validating emails yourself anyway. Use a library or check for only the @ and then send an email confirmation.

      • zurohki@aussie.zone
        link
        fedilink
        English
        arrow-up
        11
        ·
        4 days ago

        Even if it’s a completely valid address and the domain exists, they still might’ve fat fingered the username part. Going to extreme lengths to validate email addresses is pointless, you still have to send an email to it anyway.

        • psud@aussie.zone
          link
          fedilink
          English
          arrow-up
          3
          ·
          3 days ago

          I seem to have annoyed an admin of an instance enough for them to subscribe my signup email to hundreds of dating profiles (presumably using a service that offers to harass someone for you)

          Many of them aren’t good at validating email

          One in ten has one email arrive, asking me to click a link to confirm

          9 in ten have 5 emails before I notice them:

          • Please click a link to confirm
          • You received a wink
          • You received a wink
          • You received 3 chat requests
          • You received a link

          So it’s important to not send emails beyond the validate one to unvalidated addresses, to perfect your service annoying or harassing this parties

          Also, use a disposable address for signing up to Lemmy

    • lemmyng@piefed.ca
      link
      fedilink
      English
      arrow-up
      45
      ·
      4 days ago

      13/21 here. Mostly got hung up on several “this was valid in earlier RFC, and later removed” kind of situations. There are several where I picked the correct answer, but where I know many websites that won’t accept it as valid, and that’s not even the more esoteric ones.

      • NaibofTabr@infosec.pub
        link
        fedilink
        English
        arrow-up
        30
        ·
        4 days ago

        Yeah I feel like the correct answer for anything obsoleted by a more recent RFC should be “Invalid”.

        • JohnEdwa@sopuli.xyz
          link
          fedilink
          arrow-up
          20
          ·
          edit-2
          4 days ago

          But they will work, and according to the spec, you have to build your system so that it can handle those cases. Obsolete doesn’t mean incorrect or invalid, just a “you shouldn’t do this any more”.

          Obsolete Syntax
          Earlier versions of this standard allowed for different (usually more liberal) syntax than is allowed in this version. Also, there have been syntactic elements used in messages on the Internet whose interpretation have never been documented. Though some of these syntactic forms MUST NOT be generated according to the grammar in section 3, they MUST be accepted and parsed by a conformant receiver.

          https://datatracker.ietf.org/doc/html/rfc2822#section-4

          • NaibofTabr@infosec.pub
            link
            fedilink
            English
            arrow-up
            6
            ·
            4 days ago

            Well shit, yeah, that “MUST be accepted and parsed” is pretty explicit. That sucks. What is even the point of revising standards? How the fuck do we ever get rid of some of these bad ideas?

  • pyre@lemmy.world
    link
    fedilink
    arrow-up
    21
    ·
    4 days ago

    nice. though valid but obsolete is not a thing… if it’s obsolete it’s invalid.

  • isaacd@lemmy.world
    link
    fedilink
    arrow-up
    28
    ·
    4 days ago

    Let us recite the email validator’s oath:

    If it has something before the @, something between the @ and the ., and something after the ., it’s valid enough.

    • TechieDamien@lemmy.ml
      link
      fedilink
      arrow-up
      3
      arrow-down
      1
      ·
      3 days ago

      Fails for when there is no TLD. Just send an email and validate a response eg from a link.

      • isaacd@lemmy.world
        link
        fedilink
        arrow-up
        2
        ·
        3 days ago

        No. The number of users who have a real email with no TLD is far less than the number of users who will accidentally type an email with no TLD if you don’t validate on the front end.

        I’m here to help 99.9% of users sign up correctly, not to be completely spec-compliant for the 0.1% who think they’re special.

        • ulterno@programming.dev
          link
          fedilink
          English
          arrow-up
          0
          ·
          2 days ago

          Guess my mail@IPv6 won’t be accepted because I was too poor to pay for a domain name after having paid for a static IPv6.

  • CommanderCloon@lemmy.ml
    link
    fedilink
    arrow-up
    52
    ·
    edit-2
    3 days ago

    Question 5 is incorrect, name@example is a fully valid email address, even after RFC 2822

    The spec of RFC 2822 defines an address (3.4.1) as:

    local-part "@" domain
    

    domain is defined (3.4.1) as:

    domain = dot-atom / domain-literal / obs-domain
    

    dot-atom is defined (3.2.4) as:

    dot-atom = [CFWS] dot-atom-text [CFWS]
    dot-atom-text = 1*atext *("." 1*atext)
    

    1*atext meaning at least 1 alphanumeric character, followed by *("." 1*atext) meaning at least 0 "." 1*atext


    If tomorrow, google decided to use its google top-level domain as an email domain, it would be perfectly valid, as could any other company owning top-level domains

    Google even owns a gmail TLD so I wouldn’t even be surprised if they decided to use it

    • HereIAm@lemmy.world
      link
      fedilink
      arrow-up
      21
      ·
      4 days ago

      I don’t know if they changes the answer to the question, but it now says name@example is valid.

      • CommanderCloon@lemmy.ml
        link
        fedilink
        arrow-up
        26
        ·
        4 days ago

        It does say it’s valid, but also that it’s obsolete, and while the RFC does define valid but obsolete specs, there is nothing defining domains without a dot as obsolete, and it is in fact defined in the regular spec, not the obsolete section

      • snooggums@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        4 days ago

        It says valid but obsolete, which sounds like a contradiction to me.

        This is technically valid but considered obsolete. RFC 822 allowed domains without dots, but RFC 2822 made this obsolete.

        Do email suffix not indicate a different domain like .org and .com for websites?

      • mobotsar@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        3 days ago

        In response to your edit.

        Yes, or countries could use their cctld, e.g. email@us or noreply@uk.

        Or any tld owner could do the same with theirs, of course.

      • DaPorkchop_@lemmy.ml
        link
        fedilink
        arrow-up
        4
        ·
        4 days ago

        Yes, the top-level domain is still just a domain. I’m not aware of any public Internet services which are reachable from a TLD directly, and it’s strongly discouraged by ICANN, but there isn’t any technical limitation preventing e.g. someone at Verisign from setting up example@com.

      • Atherel@lemmy.dbzer0.com
        link
        fedilink
        arrow-up
        1
        ·
        3 days ago

        you could also send mails within your local network, the hostname just has to resolve and have a mail service running

  • irish_link@lemmy.world
    link
    fedilink
    arrow-up
    64
    ·
    4 days ago

    THIS THING IS STUPID!!!

    Or it’s just me that is the fool. Thanks for sharing. I just learned about 9 new things.

    • rtxn@lemmy.world
      link
      fedilink
      arrow-up
      37
      ·
      edit-2
      4 days ago

      All of the modern internet is built on the decaying carcasses of temporary solutions and things that seemed like a good idea at the moment but are now too widely used to change.

  • ikidd@lemmy.world
    link
    fedilink
    English
    arrow-up
    27
    ·
    4 days ago

    I gave up when I got like 5 wrong. I’ve ran mail servers for decades, most of the invalid “valids” would get rejected by any mailservers I’ve administered.

    • Xatolos@reddthat.com
      link
      fedilink
      arrow-up
      4
      ·
      3 days ago

      Just because it’s not something you’d use anymore doesn’t mean it isn’t valid.

      WEP is still a valid form of wireless encryption, but no one would use it anymore (and so would be obsolete). It’s still a part of the 802.11 standard.

  • codapine@lemmy.zip
    link
    fedilink
    arrow-up
    18
    ·
    4 days ago

    Also as the registrant of one of those new fancy TLDs, much like the owner of this website (email.wtf), their own email addresses will fail those stupid email validation checks that only believe in example@example.[com|net|org]

    Shitty websites will fail “example@email.wtf”, guaranteed - despite it being 100% valid AND potentially live.

    Source - I have a “.family” domain for my email server. Totally functional, but some shitty websites refuse to believe it.

      • Appoxo@lemmy.dbzer0.com
        link
        fedilink
        arrow-up
        1
        ·
        3 days ago

        Seems like a weird choice as the primary TLD.
        I’d switch it just to reduce the annoying typing hassle and to avoid misspelling.

        It’s already unusual if I say “My email is givenName@LastName.eu
        And that trips so many persons.
        First: I have my own domain
        Second: It’s not gmail, apple or a local provider
        Third: The TLD isnt .de or .com but .eu

    • BlushedPotatoPlayers@sopuli.xyz
      link
      fedilink
      arrow-up
      2
      ·
      3 days ago

      I have a spam collecting address @freemail.hu , the domain is live and working since 96, sometimes it’s not accepted, because it’s not Gmail I guess

    • notarobot@lemmy.zip
      link
      fedilink
      arrow-up
      1
      ·
      3 days ago

      I’m not sure I blame the sites. The spec is so complex that it’s not even possible to know which regex to use

      • bignose@programming.dev
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        2 days ago

        The spec is so complex that it’s not even possible to know which regex to use

        Yes. Almost like a regex is not the correct tool to use, and instead they should use a well-tested library function to validate email addresses.

        • notarobot@lemmy.zip
          link
          fedilink
          arrow-up
          1
          ·
          edit-2
          2 days ago

          Exactly! But its not obvios. So most of those shitty websites don’t even know they have a problem.

          Then there are also people ignoring it on purpose. I once read a reddit comment saying 'well of your address looks like “John wick 🐶❤️”@2001:0db8:85a3:0000:0000:8a2e:0370:7334 I don’t event want your email in my DB because oit will break something

      • ulterno@programming.dev
        link
        fedilink
        English
        arrow-up
        0
        ·
        2 days ago

        I have a feeling, the ones codapine is stating, didn’t even care to half-read the spec and just went with what they knew from experience.
        Maybe they didn’t even know there was a spec.
        Maybe they asked ChatGPT for the regex.

        • notarobot@lemmy.zip
          link
          fedilink
          arrow-up
          2
          ·
          3 days ago

          That’s one very random place to find that. There are a lot of different one and there is no way we all just agree to use that one.

          Look art his site that shows a more complete and (in theory) official website. While also explaining that there is no regex that is perfect

          https://emailregex.com/

          (Compete regex for the lazy)

          (?:\[a-z0-9!#$%&'\*+/=?^\_\`{|}\~-]+(?:\\.\[a-z0-9!#$%&'\*+/=?^\_\`{|}\~-]+)\*|"(?:\[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\\\\[\x01-\x09\x0b\x0c\x0e-\x7f])\*")@(?:(?:\[a-z0-9]\(?:\[a-z0-9-]\*\[a-z0-9])?\\.)+\[a-z0-9]\(?:\[a-z0-9-]\*\[a-z0-9])?|\\\[(?:(?:25\[0-5]|2\[0-4]\[0-9]|\[01]?\[0-9]\[0-9]?)\\.){3}(?:25\[0-5]|2\[0-4]\[0-9]|\[01]?\[0-9]\[0-9]?|\[a-z0-9-]\*\[a-z0-9]:(?:\[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\\\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\\])
          
  • TomasEkeli@programming.dev
    link
    fedilink
    arrow-up
    30
    ·
    4 days ago

    I don’t validate emails, I test them.

    That’s your email? OK, what did we send it? if we couldn’t send to it or the user can’t read it there’s no reason to accept it.

    OK, maybe I do some light validation first, but I don’t trust the email address just because it’s email-address-shaped.

  • rumba@lemmy.zip
    link
    fedilink
    English
    arrow-up
    22
    ·
    4 days ago

    I lost it at the fork bomb. I mean I hit valid because there was no way it was on the and not valid, but there’s no way i’d have expected that. after that I just kept guessing the most stupid answer and did pretty well

  • marzhall@lemmy.world
    link
    fedilink
    arrow-up
    24
    ·
    4 days ago

    I scored 16/21 on https://e-mail.wtf/ and all I got was this lousy text to share on social media.

    Damn, and here I thought I had this locked down because I was salty that so many places struggle with + in the email addy. But my god, there’s comments?