I once signed up to a service (privately run VPN thing) run by a university club that required confirming a real university student email address without having such an address. So, you needed to click a confirm link sent to "[email protected]".
Then, mostly as a goof, I tried signing up with an address like "[email protected]@example.com" where I controlled the second domain. Lo and behold, the confirmation email showed up in my catchall inbox on that domain.
Pretty sure the only check the site did was .contains("@uni.tld") and assumed it was good enough. (or whoever wrote it put it in as a backdoor) Really regret not reporting that bug to them.
I'm more into the juxtapositions of interactions between idiots vs experts, specialists vs generalists, startup-billionaire vs unemployed-drug-addict-hacker, and the level of insight that can be gained from these conversations.
I believe that the civility, and desire for unfettered conversation (avoiding ad-hominem, flame-wars. etc···) are more of an instrumental-goal of this process, than the true goal.
I don't really know why the comments on hn are the way they are, and I doubt anyone ever will. But that's what keeps me coming back here.
It's the only place on the internet I can get this kind of thing, whatever it is.
I do have to say, there's something special and unique here. Like the userbases of wikipedia, stack overflow, 4chan, or twitter, there's something here that's impossible to recreate and worth preserving.
> And this is how backwards compatibility comes to kill innovation.
With all of the novel and esoteric programming languages that exist, I wonder why hasn't there been a "I can't believe it's not c/c++" language that breaks these things, but isn't taken seriously enough to diverge completely from the ISO language standards. (for bonus points, with standardized gcc extensions, and something like embedded asm but for compiled languages (like iso standard c))
Then, mostly as a goof, I tried signing up with an address like "[email protected]@example.com" where I controlled the second domain. Lo and behold, the confirmation email showed up in my catchall inbox on that domain.
Pretty sure the only check the site did was .contains("@uni.tld") and assumed it was good enough. (or whoever wrote it put it in as a backdoor) Really regret not reporting that bug to them.