Hacker News new | ask | show | jobs
by zAy0LfpBZLC8mAC 3573 days ago
> Checking whether an email address's domain-part is an RFC1918 IP is actually pretty easy.

What I still don't understand: Why do that at all? What's the point of this? Security? Preventing user errors? What else?

1 comments

Little of both.

We were pretty sure it would already be impossible, or nearly so, for a malicious user to probe our infrastructure this way, but when it's so simple to be even more sure, why not?

Similarly, we'd already observed a low but nonzero rate of users inadvertently providing such addresses - not during signup or onboarding so much, but in recipient lists they submitted. Since we used the same recipient checking code everywhere, why not cut that back to zero, too?