...

all 51 comments

sorted by: hot top controversial new old
[–] 206 points 9 months ago (18 children)

Jokes aside, I have been blocked many times by overzealous email validation. Yes, my email has a plus sign in it. This is allowed under RFC5322, so deal with it. It is better to have no validation at all than incorrect validation.

  • source
  • hideshow 18 child comments
  • [–] 84 points 9 months ago (4 children)

    The best email validation is just sending an email to whatever provided by the user. If user receives an email and validates it, than its validated.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 9 months ago (2 children)

    Email validation for a form should at most look for

    • at least one character
    • followed by @
    • followed by at least one character
    • followed by .
    • followed by at least two characters

    Sending an email can take a few minutes. Form validation is instant.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 9 months ago

    Which would still not be perfect because "foo@bar", "foo@[123.123.123.123]" and "💩 @[IPv6 :::1]" are all technically valid email addresses.

    It looks like the only validation that doesn't block something valid pretty much would start and end at "It has at least one @ symbol, and something on both sides".

  • source
  • parent
  • [–] 59 points 9 months ago (4 children)

    The worst sites are the ones that let you sign up with an unusual address but not log in. The worst I‘ve seen was some ticket system that rejected dfyx+theirdomain@mydomain after I clicked the link in their confirmation email.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 19 points 9 months ago (3 children)

    There's an aspect of my surname which is somewhat unusual (at least in my country). As a result I occasionally get form validation errors when entering it. Sometimes those errors are extremely inscrutable. Sometimes a form validates but something elsewhere makes unvalidated assumptions about names which then breaks in completely unpredictable names...

  • source
  • parent
  • hideshow 3 child comments
  • [–] 17 points 9 months ago (2 children)
  • [–] 6 points 9 months ago (1 child)

    Actually no. In fact, I think most people who thought for a minute would realise names like mine exist, it's just that sometimes people working systems don't think for a minute ;)

  • source
  • parent
  • hideshow 1 child comment
  • [–] 34 points 9 months ago (2 children)

    Even worse is when they strip the plus sign out after the fact and then you can't log in anymore because you didn't realize that's what has happened.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 11 points 9 months ago

    Yees this has happened to me before but with passwords. They have some length limit that they clamp to so you can't login after registering and I have to do a password reset right after signing up. Happened multiple times to me.

  • source
  • parent
  • [–] 14 points 9 months ago (1 child)

    Not sure if you also do aliases as well but I’ve seen an increase in websites flagging providers like addy.io as well. Extremely annoying that so many websites think they are so important that they refuse an alias.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 10 points 9 months ago

    Same although for a totally different reason. There are some services that really don't like gtlds and they will say your address is invalid if it doesn't end in .com, .net, or .org...all my serious domains are gtld...so some services have emails on meme domains because the only domains I have with traditional tlds are memes

  • source
  • parent
  • [–] 63 points 9 months ago* (5 children)

    The issue this is referring to is because the user cannot paste into a text field. And the user was not rude about it either.

    So instead of fixing the actual problem, the developer went nuclear and removed the validation. A dick move in my opinion given the developer’s attitude.

    It’s more sad than funny. 🤷‍♂️

  • source
  • hideshow 5 child comments
  • [–] 23 points 9 months ago (1 child)

    IMO as a developer this is a sane change. There's no telling when the format of the first-party api key will change. They may switch from reference tokens to JWT tokens tomorrow. The validation should be using the token and seeing if it works.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 42 points 9 months ago (18 children)

    I hate when websites have some weird rules for passwords, and show the rule when you are creating the password, but not when entering it. How am I supposed to remember the password must begin and end with a special character?

  • source
  • hideshow 18 child comments
  • [–] 18 points 9 months ago* (last edited 9 months ago) (10 children)

    and when the rule is also wrong example: password must contain special charcters

    the password in question contained : and ^

    if those aren't special characters idk what is

  • source
  • parent
  • hideshow 10 child comments
  • [–] 12 points 9 months ago* (6 children)

    maybe they were looking for extra special characters like 🁄 or ⶸ. Who am I kidding, RFC 1738 tells us that literally everything is unsafe and you know, we need to prepare for the inevitable occasion when the password somehow ends up inside an URL.

    The characters "<" and ">" are unsafe because they are used as the delimiters around URLs in free text;
    the quote mark (""") is used to delimit URLs in some systems.
    The character "#" is unsafe
    The character "%" is unsafe

    It ends up with

    Thus, only alphanumerics, the special characters
    $ - _ . + ! * ' ( ) ,
    are safe

  • source
  • parent
  • hideshow 6 child comments
  • [–] 5 points 9 months ago (3 children)

    If the password is going in URLs you already have a problem.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 9 months ago (2 children)
  • [–] 1 point 9 months ago (1 child)

    In terms of the transport, sure.

    But if you put the password in a URL, the user's browser is going to turn around and store that plaintext password in its history, then sync it to the user's other devices, and then pop it up on their screen in the address bar autocomplete, perhaps when the user is screen sharing or streaming to hundreds of people. The browser does not expect a password to be stored there and will mishandle it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 7 points 9 months ago (5 children)

    Having to alter my one generic password I use for random ass website because there's a stupid extra rule is usually annoying me enough that I don't register lmao.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 18 points 9 months ago (4 children)
  • [–] -4 points 9 months ago (3 children)

    I use it for important things that require actual security. Everything else gets the one password treatment.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 12 points 9 months ago

    So the users realized their mistakes and stopped complaining……and other jokes public project maintainers tell themselves while laughing in tears

  • source
  • [–] 7 points 9 months ago

    Prismlauncher! I remember browsing through the changelog and spotting this, made me chuckle internally.

  • source
  • [–] 10 points 9 months ago
    [–] 5 points 9 months ago

    If only I had a penny each time a user told something doesn't work when it shouldnt've.

  • source
  • [–] 3 points 9 months ago

    I've done this before. it's funny when the users are all, "why??!" and to respond with, "because you asked for it!"

  • source
  • [–] -3 points 9 months ago (1 child)

    Usernames removed to prevent brigading

    What is this gatekeeping nonsense? We live in the free world. I don't want that reddit "anti-brigading" crap here.

    Post breaks web accessibility by withholding web connectivity: it needs a link to source.Images of text break much that text alternatives do not. Losses due to image of text lacking alternative such as link:

    • usability
      • we can't quote the text without pointless bullshit like retyping it or OCR
      • text search is unavailable
      • the system can't
        • reflow text to varied screen sizes
        • vary presentation (size, contrast)
        • vary modality (audio, braille)
    • accessibility
      • lacks semantic structure (tags for titles, heading levels, sections, paragraphs, lists, emphasis, code, links, accessibility features, etc)
      • some users can't read the image due to lack of alt text (markdown image description)
      • users can't adapt the text for dyslexia or vision impairments
      • systems can't read the text to them or send it to braille devices
    • web connectivity
      • we have to do failure-prone bullshit to find the original source
      • we can't explore wider context of the original message
    • authenticity: we don't know the image hasn't been tampered
    • searchability: the "text" isn't indexable by search engine in a meaningful way
    • fault tolerance: no text fallback if
      • image breaks
      • image host is geoblocked due to insane regulations.

    Contrary to age & humble appearance, text is an advanced technology that provides all these capabilities absent from images.

  • source
  • hideshow 1 child comment