1,312 reputation
11022
bio website matt.life
location
age
visits member for 3 years, 1 month
seen yesterday

I code stuff with my bare hands.

Caddy, Papa Parse, GoConvey, binding

Donate or cashtag $MattHolt

I like to make programs and devices smarter and easier to use. I experiment with new, brilliant interface concepts, data structures, and algorithms. I'm a programmer, web developer, and a Mormon.


May
13
awarded  Notable Question
Apr
14
awarded  Good Question
Apr
12
awarded  Yearling
Feb
20
awarded  Famous Question
Dec
31
revised Does cynicism have a valid role in information security?
fixed wording
Dec
31
asked Does cynicism have a valid role in information security?
Sep
30
comment What is a good practical (and sane) way to manage all your passwords for online sites?
@bahamat I don't think I'm clever. I trust the math.
Sep
30
revised What is a good practical (and sane) way to manage all your passwords for online sites?
Added Blum's method
Sep
24
awarded  Autobiographer
Aug
25
comment Why is “www.” considered unsafe in this HTTPS URL?
Web security strongly relies on hostnames. And a hostname www.soundcloud.com is not the same as soundcloud.com -- browsers and SSL certs are very strict about this. (And there are right and wrong ways to configure servers to handle these discrepancies. Sometimes mistakes, like a faulty 301 redirect, cause errors like this.)
Aug
15
comment What are the security reasons for disallowing the plus sign in email addresses?
@JamesT.Huggett At that point it's more of an engineering/UX problem than a real security issue. There's ways to strip out or ignore the "plus" portion of a Gmail address and check for duplicates. It can be inconvenient to implement, but it gives more security/control to the user.
Aug
13
comment What are the security reasons for disallowing the plus sign in email addresses?
Oh, I dunno about that. Their site works really well for arranging meetups and I've enjoyed the ones I've attended. Though the problem may reflect a poor UX decision, if all it takes is to change some regular expression, that really has little to do with the effectiveness of the service as a whole.
Aug
13
awarded  Notable Question
Aug
13
awarded  Good Question
Aug
13
comment What are the security reasons for disallowing the plus sign in email addresses?
The DBA perspective is refreshing, thanks! I would suppose, though, that a little pre-processing of the email address to strip out the plus-portion could save that extra query. This steps into UX bounds, but is interesting since, as you suggest, I should be able to change my email address to have a plus-sign later without negative consequence. (I agree; but I doubt most sites implement it that way.)
Aug
13
accepted What are the security reasons for disallowing the plus sign in email addresses?
Aug
13
revised What are the security reasons for disallowing the plus sign in email addresses?
Meetup responded positively
Aug
13
awarded  Popular Question
Aug
13
awarded  Nice Question
Aug
12
comment What are the security reasons for disallowing the plus sign in email addresses?
That was my thinking too but I wasn't quite sure. Thanks for the explanation. I assume that most of these sites aren't really incompetent, but it's probably likely that there is misinformation and wild assumptions that go on. So I guess the real issue at hand is more of a UX thing, not security.