1,238 reputation
722
bio website twitter.com/mholt6
location
age
visits member for 2 years, 7 months
seen Nov 24 at 6:37

I code stuff with my bare hands.

(Like Papa Parse, GoConvey, binding, etc...)

Donate

I like to make programs and devices smarter and easier to use. I experiment with new, brilliant interface concepts. I'm a programmer, designer, and web developer.

I believe choices are a fundamental part of our happiness.

https://twitter.com/mholt6

Follow me on Twitter! I tweet stuff with the interest of my followers in mind.


Sep
30
comment What is a good practical (and sane) way to manage all your passwords for online sites?
@bahamat I don't think I'm clever. I trust the math.
Sep
30
revised What is a good practical (and sane) way to manage all your passwords for online sites?
Added Blum's method
Sep
24
awarded  Autobiographer
Aug
25
comment Why is “www.” considered unsafe in this HTTPS URL?
Web security strongly relies on hostnames. And a hostname www.soundcloud.com is not the same as soundcloud.com -- browsers and SSL certs are very strict about this. (And there are right and wrong ways to configure servers to handle these discrepancies. Sometimes mistakes, like a faulty 301 redirect, cause errors like this.)
Aug
15
comment What are the security reasons for disallowing the plus sign in email addresses?
@JamesT.Huggett At that point it's more of an engineering/UX problem than a real security issue. There's ways to strip out or ignore the "plus" portion of a Gmail address and check for duplicates. It can be inconvenient to implement, but it gives more security/control to the user.
Aug
13
comment What are the security reasons for disallowing the plus sign in email addresses?
Oh, I dunno about that. Their site works really well for arranging meetups and I've enjoyed the ones I've attended. Though the problem may reflect a poor UX decision, if all it takes is to change some regular expression, that really has little to do with the effectiveness of the service as a whole.
Aug
13
awarded  Notable Question
Aug
13
awarded  Good Question
Aug
13
comment What are the security reasons for disallowing the plus sign in email addresses?
The DBA perspective is refreshing, thanks! I would suppose, though, that a little pre-processing of the email address to strip out the plus-portion could save that extra query. This steps into UX bounds, but is interesting since, as you suggest, I should be able to change my email address to have a plus-sign later without negative consequence. (I agree; but I doubt most sites implement it that way.)
Aug
13
accepted What are the security reasons for disallowing the plus sign in email addresses?
Aug
13
revised What are the security reasons for disallowing the plus sign in email addresses?
Meetup responded positively
Aug
13
awarded  Popular Question
Aug
13
awarded  Nice Question
Aug
12
comment What are the security reasons for disallowing the plus sign in email addresses?
That was my thinking too but I wasn't quite sure. Thanks for the explanation. I assume that most of these sites aren't really incompetent, but it's probably likely that there is misinformation and wild assumptions that go on. So I guess the real issue at hand is more of a UX thing, not security.
Aug
12
comment What are the security reasons for disallowing the plus sign in email addresses?
Ah, that's a cool trick with Postfix. Thanks for the extra tip!
Aug
12
revised What are the security reasons for disallowing the plus sign in email addresses?
added 48 characters in body
Aug
12
revised What are the security reasons for disallowing the plus sign in email addresses?
Hopefully made the question a little more clear
Aug
12
asked What are the security reasons for disallowing the plus sign in email addresses?
Jul
2
awarded  Curious
Jun
18
awarded  Enlightened