Abstract
Everything you're sure about — names, time, addresses, money, even file paths — is wrong in ways that'll page you at 3am. Falsehoods collects the best of the genre into one place.
The "falsehoods programmers believe about X" genre is sharp but scattered: dozens of great posts, every one a different shape and depth. I built Falsehoods to pull the best sources for each topic and merge them into one clean doc — the gut-punch surprises first, then the long tail of why it's harder than it looks, then what to actually do about it. 36 topics so far, all rendered right on GitHub.
Repo: github.com/carlkibler/falsehoods
Below are a few "oh hell" items to show the flavor. Every one is a real edge case that has broken a real system.
Names
Your name model is wrong, and it's wrong in ways that hurt real people. (full list)
- "Null" is a perfectly valid legal surname. Tech journalist Christopher Null spent years fighting Bank of America and American Express, because the string null in his data evaluates to nothing and makes their systems reject, loop, or crash. Amex addressed mail to him as just "Mr."
- Picasso's full legal name was 23 words long. "Pablo Diego José Francisco de Paula Juan Nepomuceno María de los Remedios Cipriano de la Santísima Trinidad Ruiz y Picasso." Your 30-character name field is not going to cut it.
- Jennifer 8. Lee has the numeral 8 as her legal middle name. Your alphanumeric validation just rejected a real person's real name.
Phone Numbers
A phone number isn't a number, isn't unique, and won't hold still. (full list)
- Kosovo has three country calling codes simultaneously. Depending on when and where you got your number, a Kosovo phone may be reached via Serbia (+381), Slovenia (+386), or Monaco (+377). One territory, three codes, no clean answer.
- ``1-800-MICROSOFT`` is an invalid phone number that still calls Microsoft. Extra digits beyond what's needed are silently discarded on some networks. Phone numbers also contain * and letters — store one as an integer and you destroy all of it.
- Old phone numbers are recycled. The number you verified a user with six months ago may now belong to a stranger. Any "this belongs to our user" you cache against a number has an expiration date you can't know in advance.
Your email-validation regex is wrong, and the RFC is far weirder than you think. (full list)
- A valid email address can contain multiple ``@`` signs. RFC 5321 permits source-routing syntax like @1st.relay,@2nd.relay:user@final.domain, and common public mail services accept and deliver it.
- The local part is case-sensitive. Jschauma@netmeister.org and jschauma@netmeister.org do not have to reach the same mailbox — you can't assume they're the same, and you can't assume they're different. (Only the domain half is safe to lowercase.)
- You can put emoji in the local part. RFC 6531 permits UTF-8 when the server supports SMTPUTF8, making "💩"@domain syntactically valid. Stripping + suffixes, meanwhile, breaks users who deliberately chose john+doe@example.com to track who sells their data.