News for hackers. Stuff that matters.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by kevin_thibedeau on Monday December 16, 2019 @09:20PM (#21809870)
You can't assume that '+' has special meaning that can be stripped away.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by microcolonel on Monday December 16, 2019 @09:22PM (#21809889)
Why not? On most major hosts it has a special meaning, and otherwise it is a relatively ridiculous thing to just add willy-nilly to your email address. We keep your verified mailbox address, the one you gave us, for sending mail.

I doubt we'll ever turn away a customer by preventing registration of a new account sharing the prefix to a plus sign in their email address with an existing customer.

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by kevin_thibedeau on Monday December 16, 2019 @09:29PM (#21809948)
Senders don't get to dictate how a recipient encodes their addresses.

RFC 822:

The local-part of an addr-spec in a mailbox specification (i.e., the host's name for the mailbox) is understood to be whatever the receiving mail protocol server allows.

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by microcolonel on Monday December 16, 2019 @09:32PM (#21809969)
I am well aware of that, but I'm comfortable requiring that new customers don't register an account with an email address foolishly designed to resemble another customer's email address in this particular way. We don't throw away their specified mailbox address, we just don't accept registrations which look suspiciously similar, or intended to cause confusion.

I repeat, this has absolutely nothing to do with the mailbox address, where we send mail.

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by tzs on Monday December 16, 2019 @11:57PM (#21810747)
So if on my system we name users by their last name unless that is taken and then we add initials, and so Mike Nesmith (our only Nesmith) gets "nesmith", but we have several Smiths so Norman Edward Smith is given "n.e.smith", then only one of them can use your service?
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by swish_bob on Tuesday December 17, 2019 @09:33AM (#21813776)
So, when I registered for my primary email account (many, many years ago), Firstname.Lastname@provider was already taken, so I took FirstnameLastname@provider.

Are you suggesting I shouldn't be allowed an account with you if the person who beat me to my preferred email address also beat me to registering with you?

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by dathinab on Monday December 16, 2019 @10:12PM (#21810175)
Can agree with this, maybe except for dot stripping, while this will block out some legal mail addresses it's generally worth it and close to impossible to have accidental collisions in practice.

It's like deciding to not allow quoting and with this whitespace. Sure ":"@example.com is a legal mail address (surprised?) but nothing good will come from allowing it.

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by kevin_thibedeau on Monday December 16, 2019 @09:45PM (#21810043)
You can't decide for yourself what the semantics of someone else's address do or do not mean.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by msandford on Monday December 16, 2019 @09:53PM (#21810077)
Yes they can! It's their prerogative to allow people to sign up or not with any email address, full stop.

It might make them bad netizens and you may not like it. But the spec doesn't compel any behavior. It's just a way to communicate technical ideas and ideals.

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by hirsin on Monday December 16, 2019 @10:28PM (#21810249)
Precisely. This sketch always comes to mind https://youtu.be/hNoS2BU6bbQ

You're under no obligation to accept names that are hard (as in painful) for you (except if you're the police, I suppose. Ironically)

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by RyanCavanaugh on Monday December 16, 2019 @10:02PM (#21810120)
This is paltry nonsense. Gmail and similar host users are used to treating the dots as decorative, and will register with john.smith@ then try to use "Forgot username?" with johnsmith@ instead. They'll end up with three GitHub accounts registered to the same mailbox and be confused as heck about how they're still getting email notifications for an account that they can't recover a password for.

You can't break user expectations and mental models by pointing to the spec as justification. The spec exists to serve users, not the other way around.

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by _jal on Monday December 16, 2019 @10:26PM (#21810242)
Sure, and meanwhile if there are collisions without periods on that domain (randy@somewhere, r.andy@somewhere and rand.y@somewhere, for instance), only one of them gets an account.

In the absence of being able to count on specs, I guess the user should expect a race?

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by RyanCavanaugh on Monday December 16, 2019 @10:48PM (#21810338)
The fact that we just now found out that this is the case, yet would be completely unable to find anyone complaining about it except in hypothetical terms, tells you exactly how important it is.
Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by tialaramex on Tuesday December 17, 2019 @05:42AM (#21812373)
This stuff just causes your business to mysteriously have low customer satisfaction. You're doing 95% as well as the successful business but for 5% of your customers these "unimportant" problems make it awful to deal with you and they stay away and tell others.

Most of them can't specifically point to the problem, their impression is just that your services don't work properly. They're right.

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by swish_bob on Tuesday December 17, 2019 @09:38AM (#21813819)
How would they complain to you? How would they know what the problem is?

Assuming they don't just fail to register and move on ...

Re:Hacking GitHub's Auth with Unicode's Turkish Dotless 'I' by asveikau on Monday December 16, 2019 @11:22PM (#21810551)
> Why not? On most major hosts it has a special meaning

So at best you can special case for those "major hosts" and not apply such treatment to any other domain.

The RFCs for email don't say "uhh dude whatever, just check what gmail does and maybe hotmail too lol". You are playing fast and loose with these things.