Skip to content
HomeVideosBooksBlogs
AllTop postsTopics
Podcasts
HistoryListsWatch laterLiked videosFollowing

The videos, books, blogs and podcasts Hacker News keeps recommending, all in one place.

VideosBooksBlogsPodcastsAboutPrivacySettings

Data from Hacker News, HackerTube, HackerBooks, HackerBlogs and Open Library. Credits · Not affiliated with Y Combinator.

HomeVideosBooksBlogsPodcasts
Ctrl K
    J

    John Graham-Cumming

    blog.jgc.org · Personal blog · on HN since 2007

    John Graham-Cumming, a programmer and former Cloudflare CTO, writes about code, GNU Make, security, watches, and assorted technical projects.

    Visit blogRSSHN submissions
    ProgrammingHardware & ElectronicsSecurity
    What HN says

    Commenters mention his site's personal, behind-the-screens style and his homemade watch designs; the given comments offer little opinion on specific posts.

    Stats for nerds
    161HN people shared it
    699linked in comments
    25Kstory points
    May 2026last shared
    2008people per year2026

    Top posts on HN

    1. 1
      Controlling the Taylor Swift Eras Tour wristbands with Flipper Zero
      1 person · 971 points · first shared 2024 · 261 comments on HN
    2. 2
      The secret message hidden in every HTTP/2 connection
      1 person · 600 points · first shared 2015 · 119 comments on HN
    3. 3
      My Email Canary
      2 people · 581 points · first shared 2011 · 118 comments on HN
    4. 4
      Original WWW proposal is a Word for Macintosh 4 file from 1990, can we open it?
      1 person · 478 points · first shared 2024 · 205 comments on HN
    5. 5
      How I coded in 1985
      2 people · 470 points · first shared 2013 · 118 comments on HN
    6. 6
      The greatest Google Mail feature you may not be using
      1 person · 426 points · first shared 2012 · 173 comments on HN
    7. 7
      Low-background Steel: content without AI contamination
      1 person · 408 points · first shared 2025 · 269 comments on HN
    8. 8
      Guest WiFi using a QR code
      1 person · 408 points · first shared 2022 · 274 comments on HN
    9. 9
      One line you should add to every makefile
      1 person · 322 points · first shared 2015 · 96 comments on HN
    10. 10
      Cracking an old ZIP file to help open source the ANC's "Vula" secret crypto code
      3 people · 316 points · first shared 2024 · 37 comments on HN

    What HN people wrote when they linked it

    • jcrobertsOct 2010

      I mostly wanted to say I've enjoyed your blog in recent weeks, but only through your HN submissions (I'm not one to "follow" a blog).

      I know very little about monetizing web sites, so even I would not follow my own advice without having someone smarter than me look it over.

      Google AdSense is easily defeated/filtered, and technical users tend to be more inclined to use filtering. Similarly, users who do not employ technical means of filtering have generally adopted "mental filtering" of AdSense. In short, they ignore it since it is often misleading.

      Pushing your own book on Amazon doesn't hurt, but I sincerely doubt it will help very much.

      A working solution is potentially more work. You could use amazon affiliate links to * RELEVANT * books/products mentioned in your posts. For example, the following blog post mentions IDL:

      http://www.jgc.org/blog/2009/11/about-that-cru-hack.html

      It took a simple google search to find out there is a book on the topic sold through amazon.

      http://www.amazon.com/Introduction-Programming-IDL-Interactive-Language/dp/012088559X

      When your advertising is essentially part of your content, as well as complimentary to your content, it should be more effective (in theory). You are the one who knows your content best, so allowing others to decide what to advertise on your site is a dubious proposition. Unless advertising is effective in its goal of making money for you, then there's no point in having it on your site. If you have to do more work…

    • jlgbecomSep 2010

      There are a lot of lessons to be learned from Diaspora, beyond the (brilliant) points made about security.

      1. When media hype provides you with $200k, you're still best served by bringing people's expectations down to earth. There was no way they were going to be able to build anything approaching a Facebook killer in 3 months, and it would have been best if they would have made that clear in the beginning.

      2. There are a number of projects like Diaspora that have been working for years towards the same exact goal. The only way Diaspora could have succeeded where those have failed (or not-yet-succeeded), is if they had properly articulated where they would go right where others had gone wrong. If you can't do that, you probably don't have the perspective necessary to take on such a huge project.

      3. We all need to be less susceptible to the story of the "boy wonders" taking on the establishment. Between Diaspora and Haystack+, these should be sobering lessons about the dangers of hype and a good human-interest story when the result we need is stable, well-written code.

      + http://blog.jgc.org/2010/09/myth-of-boy-wizard.html

      4. Open source isn't magic. Rails isn't magic. Having a good idea and a whole lot of heart isn't magic. It's true that the software world isn't exactly a meritocracy, but at the same time, we need to recognize that you have to be able to build something generally usable, and if you can't, there's nothing that will save you except for harder work…

    • devmonkSep 2010

      We don't all get the time to setup beautiful open-source projects with beautiful tests and code.

      I have a number of projects I've started or contributed significantly to that anyone can peruse if they want, but I'm definitely not proud of the code in all of them.

      If you use this type of post ( http://blog.jgc.org/2010/09/weve-read-your-code.html ) as a wakeup call to make your code better, that's fine. But, would it make sense to remove open-source projects that aren't your best work, with the rationalization that few if any are using them and they are a bad reflection on your coding skills? If your code is bad and is misleading/doesn't work and provides no benefit to others, take it down or fix it. Otherwise, I say leave it alone, and feel free to leave it attached to your name.

      I've met more developers who were afraid (imo) to start or share anything open-source even though they certainly could have (because I was working with them, and I did, without any harm coming to me yet). As Frank Herbert once wrote, "Fear is the mind-killer." Don't let the fear of sharing overtake you.

    • OhMeadhbhAug 2025

      Looks like it's better now... I can get back into the dashboard for work and personal accounts. (And I double checked against https://jgc.org/ and https://www.amctheatres.com/ as random sites behind CloudFlare, and they seem to work.)

      I don't know if it's cause some support person saw John's request or if it was just a random thing that fixed itself. But if say... one third of the top 1000 web sites are behind CloudFlare and CloudFlare only has five-nines, that probably means tens of thousands of people are getting false positives every day.

      I understand wanting to defend against bad guys, but if there's no way to contact CloudFlare support because CloudFlare blocked you from contacting their support... Though... yeah... I was able to get in to the support portal on my mobile phone. There's got to be a better way.

      I'll likely be at IETF 124 if any CF folk want to spitball ideas about making the experience less bad.

    • glymorFeb 2010

      It's easy to be so strident.

      I agree freedom of information requests should always be respected (if nothing else it's the law). That doesn't mean it's useful on it's own.

      Unintelligible source code isn't much more useful than none. See CRU's own source code for example: http://www.jgc.org/blog/2009/11/about-that-cru-hack.html

      It's nice that some spend the time to clean up code and format data. But scientists progress on their career track by total number of papers; so they're being somewhat asked choose between the greater good and their own.

      Most research is publicly funded. If open access is important to you then write to your government representative and ask them to require it.

    • crntaylorOct 2012

      It's worth reading JGC's blog post about Ada Lovelace [1]. He argues that she shouldn't be famous for being "the first computer programmer" (in fact it's not clear that she ever really understood the difference engine/analytical engine at all).

      Instead, he says that she should be remembered for being the first person to realize that calculating machines weren't limited just to problems of arithmetic - that they might eventually be applied to music, art and other areas. Very prophetic!

      [1] http://blog.jgc.org/2011/09/lovelaces-leap.html

    Related

    Paul Grahampaulgraham.com5.1k people

    Do Things that Don't Scale

    Paul Graham
    Personal · last shared 2026
    jwzjwz.org880 people

    Watch a VC use my name to sell a con

    jwz
    Personal · last shared 2026
    Errata Securityblog.erratasec.com357 people

    Extracting the SuperFish certificate

    Errata Security
    Personal · last shared 2025
    Graham Cluleygrahamcluley.com151 people

    49% of workers, forced to change passwords, reuse same one with minor change

    Graham Cluley
    Personal · last shared 2025
    Major Haydenmajor.io46 people

    A New Future for Icanhazip

    Major Hayden
    Personal · last shared 2026
    Unlimited Noveltyunlimitednovelty.com42 people

    Node.js has jumped the shark

    Unlimited Novelty
    Personal · last shared 2023
    Cloudflare Blogblog.cloudflare.com2.9k people

    We Stood Up to a Patent Troll and Won

    Cloudflare Blog
    Company · last shared 2026
    Graham Jenkinsdarkcoding.net44 people

    Facebook’s code quality problem (2015)

    Graham Jenkins
    Personal · last shared 2025