How not to check the validity of an email address

http://www.dellsystem.me/posts/dont-do-drugs-kids/

by limelight • 13 years ago

437 230 13 years ago

I've had something similar delivered to me on a project I hired out. The most frustrating part was not the code but the developers reaction to why it was so bad. He had no idea what the big deal was and thought I was being nitpicky.

Worse yet, was an initial claim that it was more efficient to do it that way. That was followed up with a claim that doing it differently wasn't possible.

Needless to say, I stopped working with that team of "developers".

meowface2• 13 years ago

The most frustrating part was not the code but the developers reaction to why it was so bad. He had no idea what the big deal was and thought I was being nitpicky.

This is always the worst. I've had experiences like that on many an occasion, where the person is simply like "huh? what's wrong?"

You can't really fix that level of sheer incompetence, ignorance, and arrogance all wrapped into one.

ketralnis• 13 years ago

You can't really fix that level of sheer incompetence, ignorance, and arrogance all wrapped into one.

Sure you can. You can tell them why it's wrong and point them at reading material to fix it. Fixes incompetence and ignorance, and if you're lucky, arrogance. All wrapped into one.

Everyone had to start somewhere.

shousper• 13 years ago

Or more simply, you can't help people who don't want to be helped =)

annnnd• 13 years ago

Worse yet, was an initial claim that it was more efficient to do it that way

This is a classic excuse... so what if it leaks e-mail addresses (who looks at source code anyway?), makes clients wait (at least server's CPU is intact), and is just plain illegible (there is always a debugger if you want to fix a bug).

eksith2• 13 years ago

It's not possible the teach these people without encountering a massive, irreparable, hack. Nothing short of complete obliteration of their project through their own incompetence will work because the Dunning-Kruger effect is in full swing.

The smartest people I know are acutely aware of how little they actually know compared to how much there is to know.

rachelbythebay2• 13 years ago

Gradebusters / Making the Grade, or something with names like that, used to use a Java applet to "secure" the web site with student grades. You could just download the applet and decompile it to figure out their trivial encoding of the IDs and PINs (which were just params in the HTML).

Or you could figure out just an ID (typically a student ID number, although more than a few were social security numbers, apparently), and use "1066" since they had a backdoor PIN in quite a few releases. Battle of Hastings, eh?

Want to know how users did web security instead of asking their admins for a proper .htaccess/server-level config setup? That's how.

MichaelGG• 13 years ago

Heh, I've seen a great example of "high end" software for partitioning servers for a specific vertical (so multiple hostile customers could share the same hardware). Java applet to provide "rich" experience cross platform. OK, debatable.

Security? On start, the Java app downloads a connection string to the MySQL DB. Which contains the root login for both SSH and MySQL. Then it prompts for your password and queries the Users table to see if you're allowed. And it helpfully logs this info into user's temp directory. "Ah yes, this is a known limitation in our current design."

Edit: They repeatedly lied to customers about various security fixes (I didn't do full disclosure on the numerous issues I found). They didn't care as they were sold for a world of money, then the entire product line was nixed. Most customers don't seem to care (I've found similar stuff across the board); hackers are targeting lower hanging fruit for the time being.

girvo• 13 years ago

Education software is literally the worst.

Moodle was pretty ick to begin with, but you should've seen the state of one install I had to work on by the time I got to it.

I still have nightmares.

fnordfnordfnord3• 13 years ago

Needs disrupting

sergiotapia• 13 years ago

I've worked with Moodle adding custom reports and features to it. The shop where I worked at was stuck at Moodle 2.x and couldn't upgrade because it was a clusterfuck of custom code mixed with outdated plugins.

I feel you.

It worked, but god damn; I literally quit that job because of the stress of working with Moodle day in day out.

aestra2• 13 years ago

So were unauthorized users able to modify grades? Or just view them?

rachelbythebay2• 13 years ago

View. It was a system where the teacher would export things from their personal machine and it would dump a bunch of files into their ~/public_html.

kaeruct• 13 years ago

this should be submitted to thedailywtf.com...

emiliobumachar• 13 years ago

It's #1 on HN, it has plenty of exposure already.

cdcarter• 13 years ago

McGill seems to use a LMS branded as "myCourses", apparently the newest label Blackboard is using for it's "Learn" line.

ssalenik• 13 years ago

McGill switched to 'Desire2Learn' last summer as Blackboard no longer supports 'webCT', I think (access to old courses hosted on webCT is now very limited). 'myCourses' was the branding chosen by McGill... I think now they just call it 'myCourses2', after the switch.

ivan_ah• 13 years ago

Hm... how come Desire2Learn hasn't been sued by Blackboard yet? Usually, as soon as a uni stops switches away to use a competing course management software, the competitor get sued based on the LMS patent: http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=H...

UPDATE: they //did// get sued, but won, and the above patent is invalid now. Way to go! http://en.wikipedia.org/wiki/Blackboard_Inc.#Legal_matters

willvarfar• 13 years ago

A timely reminder to everyone:

http://thedailywtf.com/ is still going strong! Be there or be ... competent?

chanux2• 13 years ago

Use of potent instead of competent saves three characters and conveys the idea better... or ruder.

danielweber2• 13 years ago

I quit them when Alex tried to takeover Programming Praxis by force when negotiations didn't seem to be moving fast enough for him.

_sh• 13 years ago

This was news to me.

http://programmingpraxis.com/2009/08/13/the-daily-wtf-malici...

weichi• 13 years ago

In order to truly understand the madness at play here, we really need to know how the list of email addresses was generated.

Zikes• 13 years ago

Clearly they should have optimized this by stripping the @mail.mcgill.ca on the server side before serving the list.

mmariani3• 13 years ago

Clearly you must be joking. They should've kept the emails on the server-side the entire time. Then would be a matter of validating the request by searching the email in let's say SQLite. Would it be done? Probably not. But at least it'd be a lot stronger than sending sensitive data to clients every damn request.

banachtarski• 13 years ago

You're missing the sarcasm :P

saiko-chriskun• 13 years ago

wooooow

taspeotis• 13 years ago

mmariani 41 minutes ago | link
Clearly you must be joking

No shit.

ArbitraryLimits2• 13 years ago

You know, for all the ridiculousness of this code, at least it actually performed its function correctly, i.e. it would correctly identify all McGill email addresses. From the title I was expecting another multi-page regexp.

pavel_lishin2• 13 years ago

Unless a new user was added after that page was loaded.

Glyptodon2• 13 years ago

Every single legacy application I've ever worked on has had analogous code buried in it somewhere.

An application I've just been "repairing" recently has a spot where it uses two separate queries to pull two full table sized lists of values, then manually joins them with a loop, and then manually re-orders the joined values into groups selectively ignoring some rows, and then embeds the the whole reordered list in a web page. The page takes around 20 seconds to load. Switching it to use a single properly formatted SQL reduced load times to under a second.

Another legacy app I'm employed to "repair" has one single 'template' for every page on the whole site. Its first ~500 lines conveniently consist of a giant and highly nested if/else clause to set the page variables and inline javascript.

Such things are the result of "IT experts," "Software Managers," and "Product Administrators" who've never done real software/web development in their lives hiring random "programmers" who have history or psychology degrees and think they can program because they made a form in PHP.

It only gets lovelier when eventually somebody realizes it's a huge security risk and hires an outside development firm to "secure" it. (Giant eye roll. If they couldn't vet a programmer, you can bet they're great at vetting security consultants and contract developer shops.) Did you know that randomly moving code into folders named "private" and "public" for a few thousand dollars can solve giant architectural and security issues like ridiculously easy XSS and SQL injection?

I don't know what the deal is, but a huge proportion of people writing code are plain incompetent.

At my last company we fired someone who created huge amounts of work for everyone (he thought he could secure page content and alert messages by using base 64 encoding as a stand in for hashing and encryption, for example) and a few months later he was hired as lead developer by a pretty reputable educational business.

... sigh

sown2• 13 years ago

Every single legacy application I've ever worked on has had analogous code buried in it somewhere.

I'm not old enough to be responsible for stuff like that but I am incompetent enough.

impressive• 13 years ago

I'm not old enough to be responsible for stuff like that but I am incompetent enough.

Now that is a great conversation starter! I assume you think you know more than the senior/lead/architect on the team. You might, but have fun with that mentality. It's not sure to last. :)

petenixey• 13 years ago

I love your comment. Funny and humble.

jmadsen• 13 years ago

Another legacy app I'm employed to "repair" has one single 'template' for every page on the whole site. Its first ~500 lines conveniently consist of a giant and highly nested if/else clause to set the page variables and inline javascript.

oh, oh! I'm doing one of those. Only, it's a modern, MVC version, so there's actually a couple of dozen controllers with a single function each, and all actions snake through The Great Maze of Ifelsedom to set their rightful values, before traversing it once more on the page view file

Manager: "Uhm, I thought you said changing that label would be a 5 minute task?"

umsm• 13 years ago

Whenever something like that happens, this is my reference: http://developerexcuses.com

evincarofautumn2• 13 years ago

Switching it to use a single properly formatted SQL reduced load times to under a second.

We need you to change it back because the system that scrapes that page is relying on the page load time.

nwh• 13 years ago

That is, computer running the sign on the front of the store pulls data from here, and you've completely broken it because now the page loads a second time before it can finish drawing the screen. It /needs/ that delay on the HTTP request in order to catch up. A real programmer would have thought of that. Add some loops, sleeps and rands; we can talk about your reckless conduct in the morning.

nnnnni2• 13 years ago

What's worse is when fake delays are put into the code because (stupid) people think that the computer can't possibly be doing a good job if it retrieves the results in under a second. If it's "thinking", it's working well!

jfb• 13 years ago

Just put a four way Cartesian join in a subselect that gets discarded. All unit tests pass! Ship it!

jbaiter• 13 years ago

hiring random "programmers" who have history or psychology degrees and think they can program because they made a form in PHP.

That's pretty unfair to people coming from history or psychology who actually can write good code. Just because you don't have a degree in CS doesn't mean your code is shit. This is purely anecdotal, but my predecessor at my current job was a CS graduate and wrote code like in the OP.

rmc2• 13 years ago

Here here. There are plenty of people who have CS degrees and can't programme. Why else do we need "FizzBuzz".

hcayless• 13 years ago

Speaking as a former history major, thanks! :-) Code like that is written by people who don't really understand how their code works and there are plenty of CS majors in that category. With any luck, they are swiftly promoted to management where they can do less harm.

einhverfr4• 13 years ago

As a history major, I would agree with you.

One of the real issues has to do with the mentality of coding. There are people regardless of background who approach coding as a job, and those who approach it as a craft. You want the latter, not the former.

Here's my rule:

If you don't look back at code you wrote a decade ago with some degree of horror, you are either an extraordinarily good coder, or you aren't a good coder at all.

stinos• 13 years ago

I know it's unfair to generalize, but seriously if we'd had to put numbers on it and perform statistics on it (something most psychology degrees are pretty capable of even though the way they do it might raise questions) I'm rather sure the outcome would be close to: sorry, but 90% cannot write good code. Why I think this? Because I've seen and fixed code written in multiple laguages by psychology degrees (about 20 in total, from more than one institution) for the last ten years. And there are just no words for how awful it was. Hell, I've seen matlab scripts in which I would use the same dataset for both dataset arguments and still the result was there was a statistically relevant (p < 0.01) difference between the two.

Glyptodon2• 13 years ago

Yeah, I didn't mean to sound so derogatory, but out of non-formally-trained developer co-workers I've ever had only a handful didn't create work for everyone.

The two most common issues are inability to create sanely defined and decomposed schemas and clearly written queries, and poor ability to structure code in an organized way.

That said, I have known a couple very good coders without any kind of formal education. They just seem to be outliers.

When dealing with formally trained developers I've certainly encountered the incompetent also, but I'd say at an easy majority of trained coders I've worked with are competent enough to not be hard to work with.

Mind I you I do not claim to be a "superstar developer" or anything. The state of the art tends to change just a bit faster than I can keep up with these days.

superuser22• 13 years ago

Indeed. It would have been better as "CS degrees from JavaSchools."

protomyth• 13 years ago

I knew a music major who was a better coder than most of the CompSci grads.

At one job, I judged coding ability by the number of times your SQL woke me up due to huge I/O usage[1]. Many a CS graduate cannot read a query plan.

1) if it looked like a reasonable query and it was just Sybase's crap optimizer, I gave them a pass. Although, after a while, you learned to force the indexes.

mncolinlee• 13 years ago

I became an English major because I'd been coding since I was six years old and preferred to learn how to become a better writer.

At the time, the majority of incoming CS freshman did not even harbor the most basic ideas or curiosity about how a computer functioned. They had all heard they could make mounds of money. When I took elective CS classes in college, I had graduate CS students attempting to copy off of me.

It's possible CS students and programs have changed since the 90s, but based upon the CS graduates I encounter, I expect they haven't improved that much.

etler• 13 years ago

I'm starting to really dislike the term "legacy code". It implies the code is bad because it's old. It perpetuates the misconception that code gets "stale" and problems build up. But that's not true. "Legacy code" is bad because it's BAD. All code is "legacy code" because unless the project is brand new, it has some history. We just don't call good old code "legacy code" because it hasn't caused us any problems. There is no reason to correlate bad code with age.

cperciva• 13 years ago

I think you're misunderstanding the term. Legacy code -- like legacy lots of other things -- is the intersection of "bad" and "it's too late to fix now".

Code which can be fixed easily isn't "legacy". Code where a replacement would need to be bug-for-bug compatible in order to avoid breaking things is "legacy".

andyroid2• 13 years ago

While code may not go bad with age, the surrounding world (compilers, frameworks, dependencies) change constantly. So while the code quality of a million LOC Java 1.0 application might be stellar, maintaining it may still be a royal pain. So in one way code does get "stale" when left untouched for too long.

danielweber2• 13 years ago

Code sitting on the same machine can keep on performing the same way forever.

But other things change. The library changed its interface. You coded your crypto lib when MAC-then-Ecrypt was all the rage. You aren't handling HTTP/1.0 headers. Windows 7 doesn't even have those 16-bit drivers any more.

I hate the "throw everything away and rewrite with the brand new frame work every two years" that some parts of the web development community seem to have (and then get angered when you ask about a version over six months old because it is what you installed everywhere). But sometimes software does rot if it's old and no one is trying to keep it up-to-date.

willthames• 13 years ago

In 'Working with Legacy Code', Michael Feathers defines legacy code as code without sufficient tests.

The great thing about this definition is that it doesn't matter how old the code is - if it can be changed without worry about introducing unwanted behaviour because of test coverage, then it's not legacy.

It also means that you can write new legacy code right now!

MartinCron2• 13 years ago

Look at it this way: any legacy code that people care enough to still support is code that works, at least a little bit.

stephen_g• 13 years ago

I take the term more to mean 'under-maintained code' than just old code.

jrgnsd• 13 years ago

The only legacy code that people talk about is bad legacy code. People never fondly remember the function they wrote ten years ago that's still doing what it should do, no debugging required.

It's always the function that's been rewritten twenty times that gets labelled as legacy code.

skizm• 13 years ago

I don't know what the deal is, but a huge proportion of people writing code are plain incompetent.

Hooray for short term job security!

itengelhardt• 13 years ago

I love how she gives away the name of the actual software (desire2learn) in the tag. :-)

morgante• 13 years ago

she

AYBABTME• 13 years ago

I've once come across:

   if (!Boolean.FALSE.equals(aBoolean)) { 
      // ...
   }

I was pretty baffled.

prodigal_erik• 13 years ago

I've seen undergrads trying to write Ada:

  case x is
    when true => y;
    when others => z;
  end case;

You know, so the code doesn't stop compiling when someone comes along and adds values to the Boolean type.

_ea1k• 13 years ago

Well, FileNotFound is a popular addition from what I hear.

arethuza4• 13 years ago

I've seen a surprising amount of code that does:

    if (aBoolean == true) {
       ....
    }

jlgreco2• 13 years ago

Typically that isn't done from ignorance, just some (imho misguided) idea about readability.

asynchronous133• 13 years ago

At university I worked with small unmanned aircraft. We had a crash due to a piece of code with this form:

  int landing_flag;
  ...
  if( landing_flag ) {
    do_landing();
  }

It was C code that pre-dated a boolean type. A single corrupt data packet in a wireless link made landing_flag == 2345923 (some arbitrary large value) and thus the landing routine was triggered mid-flight.

We changed every instance of if( flag ) to if( flag == specific_flag_value ) to ensure that particular bug didn't rear it's ugly head again. I keep doing that now.

grecy7• 13 years ago

eh, that's not so bad really.

If I were writing something, and I really wanted to make it clear that I was testing a boolean to be true, I might write that. Then I can be absolutely certain the person reading it in 5 years won't misread it.

Actually, the more I think about it, the more I'd be inclined to do that in the false case ( ie if(aBoolean == false)... rather than if(!aBoolean).. ) because I worry that it's too easy to skip over the '!' - and I personally read that as "not aBoolean" rather than "aBoolean is false"...

I'll bet it complies to the same thing anyway, so it's just about readability at this point.

drderidder3• 13 years ago

Came across this one yesterday, slightly paraphrased:

  boolean updateMsg(boolean pPassed) {
    if (pPassed) {
      incrMsgCounter();
      logger.info("Message sent");
    } else {
      logger.info("Failed to send");
      return false;
    }
    return true;
  }

Yes, the calling code actually checked the return value. The code is full of stuff like this. Somehow I've got a morbid fascination and can't stop marvelling at how grotesque it is. It even overpowers the urge to read HN.

krapp2• 13 years ago

What's so bad about this one?

Other than its returning a boolean being pointless, I mean?

w-ll• 13 years ago

     if input_email in valid_emails_set:
        send_email(input_email, another_param, etc)

Their solution, while isn't wrong, could still be improved. With a somewhat modified 2822 regex with a more strict domain rule. But I would also assume you could just query the db.

tantalor• 13 years ago

You assume "in valid_emails_set" doesn't make a query.

It's fairly trivial to define your own __contains__ in python.

masklinn• 13 years ago

Indeed, since this is an internal system validating the uni's own emails it could easily query the uni's MSA for valid addresses.

Although for a set of 80k items and long-running processes (fcgi or wsgi) you could also load the whole thing in memory directly and not bother with a custom `__contains__`.

eru• 13 years ago

I don't see how regular expression come in here. They'd have a list of valid addresses (in a Python dict or in a database or wherever) and they check against them.

pmiller22• 13 years ago

Man. Reading posts like these has several effects on me. One is utter shock that anyone could be so stupid. Another is to remind me of how little I know (because I'm sure in the eyes of someone who actually knows anything about security, I'd probably provoke the same reaction). I'm also amazed that some of the people responsible for these things can still find work.

Here's my own personal story. The other day, I had a brain fart regarding my password for my online banking account. So, I got lazy and just clicked the "forgot password" link, answered the security questions, and within seconds, I got an email. It had my old password in it. Yes, my bank stores passwords in clear text. sigh.

BTW, I'm also looking for a new job right now, so if you're after someone with 2 brain cells to rub together who also happens to be a decent Python programmer, shoot me an email. (It's in my profile.)

dclowd99012• 13 years ago

Not necessarily. They may be using a reversible hash. Not much more secure, but it beats plaintext.

paulnechifor• 13 years ago

Isn't that an oxymoron?

harshreality• 13 years ago

How does it beat plaintext?

A reversible hash isn't so much a hash as a bijective function. The security of all stored passwords then depends on the secrecy of the "hash" function.

mason2402• 13 years ago

Yeah, maybe they just look up the MD5 hash on http://md5.gromweb.com/ and sent him the result.

I used that site to show my boss his plaintext password to explain why MD5 alone is barely more than security though obscurity when trying to convince him that we needed to salt them as well - he agreed with me on the spot.

evincarofautumn2• 13 years ago

Every financial institution I have interacted with has failed to store hashed passwords. So I looked up the reason why. Turns out that the Payment Card Industry Security Standards Council Data Security Standard (PCI DSS[1]) stipulates only that passwords and other sensitive are to be stored with encryption, and also transmitted as such†—but only amongst other financial institutions‡. So while they can’t keep your password in cleartext, they are free to send it by email, text message, or town crier.

[1] https://www.pcisecuritystandards.org/documents/pci_dss_v2.pd...

†Requirement 8 (part 4):

Render all passwords unreadable during transmission and storage on all system components using strong cryptography.

‡Introduction and PCI Data Security Standard Overview:

PCI DSS applies to all entities involved in payment card processing–including merchants, processors, acquirers, issuers, and service providers, as well as all other entities that store, process or transmit cardholder data.

(It appears this does not include cardholders.)

pmiller22• 13 years ago

> Render all passwords unreadable during transmission and storage on all system components using strong cryptography.
(It appears this does not include cardholders.)

Ah, very informative. So, here is the problem: the fact that crypto is specified when it's the wrong tool for this particular job (that of storing my online banking password). I don't want my password encrypted. I wanted hashed and salted with something like bcrypt, and I don't want it sent in the clear over email.

auctiontheory• 13 years ago

You know what would be awesome?! If the developer in question happens to frequent HN and responds to this thread, eh?

slig2• 13 years ago

Developers like these don't even know HN exists.

mherdeg3• 13 years ago

Gosh. For some reason, the "right answer" I expected to see was "do not try to validate the address; just send the e-mail and handle the bounce if it fails".

There is a whole other layer which is very good at handling incorrect or undeliverable addresses.

dclowd99012• 13 years ago

I recently sat in on a presentation regarding javascript module loading. Someone in our company had taken it upon themselves to roll their own solution, because, shit, they're being paid and apparently have no oversight.

The solution involved creating an entire cache/hash layer on the client using local storage.

At the end of the presentation I had to try to be as respectful as possible when I asked why basic browser caching and content expiration weren't enough. Apparently it wasn't even considered -_-

arethuza4• 13 years ago

So they had used HTML5 local storage and missed the fact that HTML5 has a pretty nice offline caching feature?

kybernetikos2• 13 years ago

Perhaps they wanted it to work even when offline? It can be a struggle to get basic browser caching to work nicely in online/offline scenarios. As arethuza points out though, that is better addressed using appcache.

I could imagine doing something like this if you wanted to support say es6 modules, and so each file needed to be processed after it was loaded to work in the current browser. In that case, I can imagine wanting to cache a processed one on the client side, although if you control your whole stack, it'd be better to do that work on the server.

retube• 13 years ago

Not sure you read the article - there is an additional constraint in that only email addresses pertaining to the institution in question are allowed.

mherdeg3• 13 years ago

Yes, I decided to ignore that constraint because it doesn't make sense :).

The article suggests performing "server-side membership testing, which is O(1)", but I think this is a bit too much — you can do even easier server-side validation without the list of all valid e-mail addresses, just the information that "@[anything but these two domains] is not an OK target".

Ntrails• 13 years ago

Checking against the two viable email endings and handling bounces should they occur is reasonable. It wouldn't give the immediate user feedback though in case of spelling error etc.

lolcraft• 13 years ago

Which is a much easier problem to solve. I suppose this web server is in the same LAN, or at least whitelisted, so send the email directly to the institution's SMTP server, which is presumably not an open relay.

dellsystem2• 13 years ago

Certainly that solution would have avoided this whole fiasco in the first place. Though immediate user feedback when entering an invalid email address is a somewhat useful feature as well, so maybe that's why the vendor included it.

joshfraser2• 13 years ago

In college I was hired to build an auction site. I was billing my client $20 / hour and subcontracting out the work to some of my fellow classmates at $10 / hour. I was swamped with other work and didn't have much time to review the code. I just made sure it satisfied the specifications and shipped it. We launched the site and did a few hundred thousands dollars worth of transactions in the first 24 hours. Then something strange happened... all of the bids mysteriously disappeared from our admin panel and users started emailing in asking why their bids weren't showing up anymore. I got a panicked call asking what had happened. I had no clue, but promised to look into it. I started digging through the server logs and noticed that all the bids had been deleted around the time that Google had discovered and crawled the site. Sure enough, my friend had added links to delete bids via the admin panel that were executed via GET requests. It wouldn't have been that big of a deal except the poor guy had used JavaScript for authentication! Google's crawlers had carefully hit every single Delete link and wiped out the site. I fixed the authentication system, refunded everyone's credit cards and relaunched the site with a huge apology for the issues. Needless to say, from that day on I became far more diligent about doing code audits.

beambot• 13 years ago

How did GoogleBot get access to the (presumably) private admin panel to crawl the links in the first place? Also, these sort of things require server-side authentication, not just JS. Just because GoogleBot won't crawl your PUT requests doesn't mean others won't -- including users (malicious or otherwise)! Just sayin'.

joshfraser2• 13 years ago

If I recall correctly the code looked something like this:

<?php

if (!admin())

  echo "<script>window.location = '/signin';</script>";

delete_bid($_GET['bid_id']);

m_mueller3• 13 years ago

This story almost had me in tears (a mix of schadenfreude and shame for my profession). I hope they learned something not to give business critical work to college students. Makes me think that IT Risk management should be right at the top of what MBAs have to learn.

fnordfnordfnord3• 13 years ago

I hope they learned something not to give business critical work to college students.

I've had the same kind of experience hiring a 'real' consulting firms. We were sent a PhD, who banged out a pretty standard looking interface for us that worked terribly. Ostensibly we could've sued, but that just takes more time, and doesn't really fix things.

aestra2• 13 years ago

Wow. Just because someone is a college student doesn't mean they are incompetent! Plenty of people do business critical work as college students, haven't you ever heard of co-op before? A degree doesn't make you competent either, I've worked with enough people who have degrees who are completely incompetent. College students might need some extra supervision to make sure they are doing the right thing, but so do jr engineers.

Anyways, those are the things that a code review would catch.

ArbitraryLimits2• 13 years ago

I agree with the sentiment, but in this particular case, do you really think an MBA'd IT manager was in charge of a project that paid $20 per hour? (As opposed to Accenture rates.)

noptic• 13 years ago

The first time someone wanted to hire me was even before I started college. "so how much will you bill me?" "Well right now I get 7€ (9.2$ at current rate) for unloding trucks ..." He interupted me before I could finish the sentence and demand 8€. "I can not pay you 7€! taht is just to much!"

Sooooo I declined but someone took the job ... for under 8$ an hour.

How much quality can you expect for that price???

xhrpost2• 13 years ago

This sadly still happens. I remember looking through Craigslist jobs and legit companies wanting someone with html/css/javascript/php experience for $8/hr, kid you not.

infectoid• 13 years ago

This sounds like a scary story that nerds would tell by a fire while camping.

Uchikoma2• 13 years ago

For me it depends on what "validity" means.

1.) Prevent typos etc. Regex or Mailgun or Kicksend is enough. 2.) Prevent bounces, prevent wrong signups one needs to do double opt in.

anjc• 13 years ago

The article has nothing to do with this aspect of address validation

Uchikoma2• 13 years ago

1.) Yes, the article was about choosing the right approach for validation

2.) I urge developers to step back and think about the requirements they get. Concerning those I would have thought what validity in this situation means, e.g. light validation in JS, send validation / validation list on the server etc.

asdfs• 13 years ago

Somewhat unrelated, but out of curiosity, does anyone know of a site that lists — for all popular languages — various libraries/code snippets/routines which one can use to correctly (according to the RFCs) check the validity of e-mail addresses?

If not I may be compelled to create one.

taproot• 13 years ago

There isn't. Look up the regex for validating an email address it you'd like to know why.

computer• 13 years ago

Just send an email and see if it arrives.

jabr• 13 years ago

/.@./ is pretty much the best you can do.

And even the dots are a bit iffy.

rmc2• 13 years ago

The RFC-compliant email address is actually incredibly complex. There are loads of things that are RFC-valid email addresses that basically hardly anyone uses (like spaces).

callahad• 13 years ago

The HTML5 standard actually defines a mostly-sane regex, which achieves that sanity through "a willful violation of RFC 5322, which defines a syntax for e-mail addresses that is simultaneously too strict (before the "@" character), too vague (after the "@" character), and too lax (allowing comments, whitespace characters, and quoted strings in manners unfamiliar to most users) to be of practical use here."

I like it.

Link: http://www.whatwg.org/specs/web-apps/current-work/multipage/...

mason2402• 13 years ago

@"^[^@]{1,}[@]{1}[^@]{1,}\.{1}[^@]{1,}$"

I check it with this RegEx to make sure it's in the right format of [string]@[string].[string] to make sure that user at least tries to enter an email address, but beyond that sending and email and getting a response is the only way.

drdaeman• 13 years ago

@"^[^@]{1,}[@]{1}[^@]{1,}\.{1}[^@]{1,}$"

Is not

[string]@[string].[string]

It's mere ^.+@.+\..+ (in both POSIX extended and PCRE dialects) that properly represents the latter.

And even such regexp filters out many technically-valid but obscure cases of RFC-compliant email addresses (for example ai, io, kh and ws TLDs have MX records, and supposedly hostmaster@io should be a valid email address).

neurostimulant• 13 years ago

Check out this incredibly complex rfc822 regex in action: http://regex101.com/r/fZ6cD5

hussfelt• 13 years ago

Check out our Eduware startup Coursio http://coursio.com/ for hassle-free education!

I vouch for the code, wrote it myself with some really good advisors around! ;-)

Get in touch with me personally, I'll give you a brief introduction!

samirhurshal• 13 years ago

This would have been so simple to just make right in the beginning. They should have just hashed each of those user names and put the hash into a dictionary. Whenever someone entered an email check if it is in the dictionary. O(1) time and it wouldn't be a "data leak vulnerability". So close...

jheriko• 13 years ago

i wouldn't blame drugs... this is just stupidity, or perhaps even naivete. :)

kirab• 13 years ago

Am I the only one who thinks that the amount of flaming is kind of unproductive?

ramblerman• 13 years ago

It seems to be part of HN culture. Putting down this code make people feel better about themselves. Because obiously this is bad, even they can see that.

There is certainly value to the post but, yes, the flaming gets old - very quickly.

dellsystem2• 13 years ago

Unproductive, probably; fun to write, definitely.

adamdavis2• 13 years ago

It's a common thing I see with programmers. I know I've been guilty of it before. I see some poorly coded module and I'm just disgusted of how bad it is and then proceed to say some of the nastiest things about the developer who wrote it, sometimes just aloud to myself, other times to my peers.

These days I do my best to try to remember we all make mistakes, and that instead of flaming whoever is responsible for a mistake when it rears its ugly head, it's probably best to take it as an opportunity to discuss what I saw as shortcomings in the code with them and turn it into a learning experience if possible. Sometimes of course this isn't possible when you inherit code from devs who are long gone. Either way, I'm not sure any good is done throwing all that negative energy into the air.

eksith2• 13 years ago

People who write similar code are what I like to call low-hanging fruit factories. I'm counting on them to make things as rubbish as possible, as long as they're not involved in any service I use, so anyone tempted to find vulnerabilities will go there first.

babuskov2• 13 years ago

I'm sad to see so many smart people wasting their time discussing what some stupid person did. :(

I'm also disappointed I lost a couple of minutes of my life reading about this stupidity as well... just because it got 233 points.

So, I'm looking at YOU 233 who upvoted this. WHY DID YOU DO IT?

babuskov2• 13 years ago

As expected. :)

Just click the downvote button on my comment. Don't bother to explain anything.

Oh, I know, you disapprove I called you smart. Sorry about that.

Nicholas_C• 13 years ago

I've been on HN for a while (lurking), never seen a downvote button but here people referencing them on occasion. Why do I not see downvote buttons? Or is this some inside joke?

plg• 13 years ago

there is a huge market (education and higher education) where institutions (sometimes governments) will pay huge money for these sorts of apps, and for whatever reason, the only real players are often of this quality

at my university we use a similar system called OWL, which replaced a system called Web-CT. Both are horrendously slow, with fantastically poorly thought out interfaces.

There is a ton of money to be made here. Low hanging fruit.

chenglou• 13 years ago

How ironic that you mention WebCT, because that's what McGill in the article uses until very recently.

slig2• 13 years ago

Gee, what a newb. Here's how to do it in O(1):

    return userNamesStr.indexOf(curForwardUserName) >= 0

;)

(I'd love to not have to explain sarcasm, but people have an incredible difficult time understanding it here.)

lstamour3• 13 years ago

lol, I was thinking that too -- "but indexOf is faster..."

nkg• 13 years ago

lol

jrochkind1• 13 years ago

It's good to be reminded how many employed programmers don't actually know how to program.

Actually, I'm not quite sure why or whether it's good to be reminded of this. Maybe it's better to try and forget it.

hawkharris• 13 years ago

"I stumbled upon this snippet while doing research for my thesis, 'Prolonged drug use and its effect on code quality.'" Lol.

Sami_Lehtinen2• 13 years ago

Old slogan, booze bottle a day, keeps good code away.

powertower• 13 years ago

I would really like to know the combination and quantities of drugs consumed that resulted in this code. Do you know? Can you hook me up?

Meth. Two week binge. SilkRoad.

I can't imagine opiates did that.

And the only thing you'd do on coke is more coke in combination with hating yourself; not coding shit like this up.

drderidder3• 13 years ago

Dang, that programmer sure gets around! They did a stint on my team, too.

AMcQuarrie• 13 years ago

Unrelated fact: Desire2Learn likes to employ large quantities of first year CS student interns.

jb17• 13 years ago

Am I the only one who thinks that the repeated attacks on drugs and drug usage are really unnecessary (and not well informed on the topic)?

adamdavis2• 13 years ago

Nope, blog post was loaded with snark - her attitude offended me more than the poor code D:

tcfunk• 13 years ago

Glad to hear that I wasn't the only one.

Sami_Lehtinen2• 13 years ago

One coder used framework he didn't completely understand. Originally there wasn't password requirement for users. But when site got more confidential data password feature had to be added. Well how it was done? When user gave login and clicked ok, came page asking for password. But if you changed url at this point, everything worked. When I checked the actual code, the user form logged user in and password form logged user out if password was incorrect. Oh boy, I did praise that guy. Same guy used base64 encryption, so urls would be unguessable. Guess if there's real authentication at all if you modify the url content correctly. - Well, of course there isn't. Btw. Why there aren't negative recommendations at linkedin?

hadem• 13 years ago

Sadly, this looks like something my boss might try to pull off...

apinstein• 13 years ago

This made my day. After spending the last 6 months turning down developers based on horrible code reviews, I finally feel vindicated for sticking to my instincts and hoping to eventually find someone that doesn't think code like that from TFA is "programming" and subsequently destroying my codebase and crushing my soul.

Buzaga• 13 years ago

I was waiting for the part of story where she would describe how the developer had an actual drug habit or something, so much she talked about it. I wonder if she's ever really met someone who 'uses drugs', this mockery seems incredibly infantile.

lstamour3• 13 years ago

Hate to burst people's bubble here on the privacy of email addresses, but it's routine at universities to have open, relatively unprotected LDAP directories or even web listings. That said, under Canadian PIPEDA (privacy laws), email addresses are considered personal information, so this would be a severe breach... As are all the times I get CC'd a bulk email rather than BCC'd.

How not to check the validity of an email address

Related Stories