The discussion revolves around using Discourse’s profanity filter to block email addresses, particularly to protect user privacy. downey initiates the topic, noting the filter’s potential for blocking common email domains like @gmail.com and @yahoo.com. codinghorror warns that using regex patterns for this purpose is “extremely dangerous” due to the risks of over-blocking and unintended consequences, referencing his blog post on the topic. Mittineague elaborates on the complexity of regex, highlighting how easily it can match unintended content, such as using (.)* to match everything. downey clarifies that the filter masks banned text with squares (e.g., ■) rather than replacing it with other characters, and emphasizes that the goal is not perfection but preventing common email addresses. outofthebox seeks a safe way to block email addresses, suggesting patterns like *@*.com. codinghorror cautions that broad patterns are risky, while Mittineague suggests safer alternatives like *.?@gmail.com to limit scope.
Continuing the discussion from Inappropriate / Obscenity / Profanity Language Filter:
So the profanity filter works well … not that we see it used often.
But is there a way to add regex/patterns so it could block people from putting an email address in a post?
That would be extremely dangerous, though.
“Extremely dangerous” is a strong phrase. Can you say more about why you feel that way?
Etc etc etc
Regex is like a language unto itself. Even a lot of seasoned programmers have trouble with it.
Using it requires not only understanding every possible variation you want to match, but also every possible variation you want to not match.
A lot of people do fairy well with the first, but fail with the second.
For example, using (.)* matches everything, anything, and nothing.
I see it used way too often as a “short cut” to get things to match, but unfortunately it often results in matching what it shouldn’t.
I guess if it were under the “developers only” section it might be enough to scare off Admins that shouldn’t mess with it. But human nature being what it is, give out loaded guns and it’s only a matter of time before someone shoots themselves in their foot.
And as for a valid email regex, it is notoriously difficult to craft a fool-proof one. Many come close and are “good enough” but without additional processing there will likely be problems at some point.
Fair enough, but the filter already exists in Discourse, even if you aren’t using it personally. Also, keep in mind (in response to your blog post) that the Discourse filter doesn’t replace strings, it masks them with squares. 
Regexes are inherently difficult, so I’m not necessarily proposing that you ask everyday users to use them as the mainstream use case. The current system works fine for most cases, but there’s no way to surefire way prevent people from posting most common email addresses. (I am not interested in the debate on the “perfect” email regex.)
Meanwhile, I’m simply blocking some of the most common domain names like @gmail.com, @yahoo.com, etc.
I am not interested in letting perfect get in the way of good here. Just trying to prevent the most common occurrences.
Actually, last I knew it replaces the characters with the box decimal value
eg. blocking “@gmail.com”, “someone@gmail.com” would look like
someone■■■■■■■■■■
and the source would be
someone■■■■■■■■■■
That is what I meant when I finished the sentence with:
Forgive my error of specificity. What I meant was that it doesn’t replace it with other letters to change the word, as described in the blog post above. 
Hi,
So, I’m interested in preventing people from sharing their email address in public discussions in our community, for the sake of their privacy (perhaps some people don’t realize, despite our best efforts, that the discussions are public?).
Would this be suitable? Or would it have significant risks I am not appreciating?
*@*.com
*@*.org
*@*.net
*@*.edu
*@*.info
*@*.biz
All regexes carry huge risk, the more broad, the more risk. Those are.. quite risky.
My naive hope would be that the “@” and the inclusion of top level domains would narrow it down to just email addresses. Is there no way to target these?
Something like *.?@gmail.com would be significantly safer. Ideally I would say word characters only not asterisk (all chars) too.