So, recently I bit the bullet and decided to sign up for an account with AliExpress.
So far, what I’ve bought from there has been clothing (unbranded stuff, not counterfeit) … while there’s some very cheap electronics there, I’m leery about the quality of some of it, preferring instead to spend a little more to buy through a more reliable supplier.
Basically, it’s a supplier of last resort, if I can’t buy something anywhere else, I’ll look here.
So far the experience has been okay. The sellers so far have been genuine, while the slow boat from China takes a while, it’s not that big a deal.
That said, it would appear the people who actually develop its back-end are a little clueless where it comes to matters on the Internet.
Naïve email address validation rules
Yes, they’re far from the first culprits, but it would seem perfectly compliant email addresses, such as foo+bar@gmail.com, are rejected as “invalid”.
News to you AliExpress, and to anyone else, You Can Put Plus Signs In Your Email Address!
Lots of SMTP servers and webmail providers support it, to quote Wikipedia:
Addresses of this form, using various separators between the base name and the tag, are supported by several email services, including Runbox (plus), Gmail (plus),[11] Yahoo! Mail Plus (hyphen),[12] Apple’s iCloud (plus), Outlook.com (plus),[13] ProtonMail (plus),[14] FastMail (plus and Subdomain Addressing),[15] MMDF (equals), Qmail and Courier Mail Server (hyphen).[16][17] Postfix allows configuring an arbitrary separator from the legal character set.[18]
You’ll note the ones that use other characters (e.g. MMDF, Yahoo, Qmail and Courier) are in the minority. Postfix will let you pick nearly anything (within reason), all the others use the plus symbol.
Doing this means instead of using my regular email address, I can use user+secret@example.com — if I see a spoof email pretending to be from you sent to user@example.com, I know it is fake. On the other hand, if I see someone else use user+secret@example.com, I know they got that email address from you.
Email validation is actually a lot more complex than most people realise… it’s gotten simpler with the advent of SMTP, but years ago …server1!server2!server3!me was legitimate in the days of UUCP. During the transition, server1!server2!server3!user@somesmtpserver.example.com was not unheard of either. Or maybe user%innnerhost@outerhost.net? Again, within standards.
Protocol-relative URIs don’t work outside web browsers
This, I’ve reported to them before, but basically the crux of the issue is their message notification emails. The following is a screenshot of an actual email received from AliExpress.
Now, it would not matter what the email client was. In this case, it’s Thunderbird, but the same problem would exist for Eudora, Outlook, Windows Mail, Apple Mail, The Bat!, Pegasus Mail … or any other email client you care to name. If it runs outside the browser, that URI is invalid. Protocol-relative means you use the same protocol as the page the hyperlink exists on.
In this case, the “protocol” used to retrieve that “page” was imap; imap://msg.aliexpress.com is wrong. So is pop3://msg.aliexpress.com. The only place I see this working, is on webmail sites.
Clearly, someone needs a clue-by-four to realise that not everybody uses a web browser to browse email.
Weak password requirements
When I signed up, boy where they fussy about the password. My standard passwords are gibberish with punctuation… something AliExpress did not like. They do not allow anything except digits and letters, and you must choose between 6 and 20 characters. Not even XKCD standards work here!
Again, they aren’t the only ones… Suncorp are another mob that come to mind (in fact, they’re even more “strict”, they only allow 8… this is for their Internet banking… in 2018). Thankfully the one bank account I have Internet banking on, is a no-fee account that has bugger all cash in it… the one with my savings in it is a passbook account, and completely separate. (To their credit though, they do allow + in an email address. They at least got that right.)
I can understand the field having some limit… you don’t want to receive two blu-ray discs worth of “password” every time a user authenticates themselves… but geez… would it kill you to allow 50 characters? Does your salted hashing algorithm (you are using salted hashes aren’t you?) really care what characters you use? Should you be using it if it does? Once hashed, the output is going to be a fixed width, ideal for a database, and Bobby Tables is going to be hard pushed to pick a password that will hash to “‘; drop table users; –“.
By requiting these silly rules, they’ve actually forced me to use a weaker password. The passwords I would have used on each site, had I been given the opportunity to pick my own, would have featured a much richer choice of characters, and thus been harder to break. Instead, you’ve hobbled your own security. Go team!
Reporting website issues is more difficult than it needs to be
Reporting a website issue is neigh on impossible. Hence the reason for this post. Plenty is there if I want to pick a fight with a seller (I don’t), or if I think there’s an intellectual property issue (this isn’t). I eventually did find a form, and maybe they’ll do something about it, but I’m not holding my breath.
Forget to whitelist a script, and you get sworn at, in Mandarin
This is a matter of “unhappy code paths” not receiving the attention that they need. In fact, there are a few places where they haven’t really debugged their l10n support properly and so the untranslated Alibaba pops up.
Yeah, the way China is going with global domination, we might some day find ourselves having to brush up on our Mandarin, and maybe Cantonese too… but that day is not today.
Anyway, I think that more or less settles it for now. I’ll probably find more to groan about, but I do need to get some sleep tonight and go to work tomorrow.
and here are the connections to its UART (bottom two):
and the PPS pin (LCD_D16):
Recent Comments