Skip to content
HomeVideosBooksBlogs
AllTop postsTopics
Podcasts
HistoryListsWatch laterLiked videosFollowing

The videos, books, blogs and podcasts Hacker News keeps recommending, all in one place.

VideosBooksBlogsPodcastsAboutPrivacySettings

Data from Hacker News, HackerTube, HackerBooks, HackerBlogs and Open Library. Credits · Not affiliated with Y Combinator.

HomeVideosBooksBlogsPodcasts
Ctrl K
    C

    Charles Miller

    fishbowl.pastiche.org · Personal blog · on HN since 2007

    Charles Miller, a software engineer, writes about web security, programming practice, and how engineers argue and work.

    Visit blogRSSHN submissions
    SecurityProgrammingWeb Development
    What HN says

    HN users point to his persistent login cookie best-practice post as a reference when implementing logins, and also link his other essays.

    Stats for nerds
    61HN people shared it
    52linked in comments
    600story points
    May 2026last shared
    2008people per year2026

    Top posts on HN

    1. 1
      The Two Things about Computer Programming
      1 person · 138 points · first shared 2010 · 90 comments on HN
    2. 2
      The Java Deserialization Bug
      2 people · 80 points · first shared 2015 · 29 comments on HN
    3. 3
      What web developers thought of in the noughties as being MVC doesn't scale
      1 person · 80 points · first shared 2014 · 77 comments on HN
    4. 4
      Understanding Engineers
      6 people · 65 points · first shared 2007 · 9 comments on HN
    5. 5
      The String Memory Gotcha (2005)
      1 person · 45 points · first shared 2010 · 11 comments on HN
    6. 6
      Hi, I'm a Mac… Beep, beep
      1 person · 45 points · first shared 2008 · 14 comments on HN
    7. 7
      Persistent Login Cookie Best Practice
      6 people · 27 points · first shared 2010 · 28 comments on HN
    8. 8
      The Death of Blogging
      1 person · 13 points · first shared 2015 · Discussion on HN
    9. 9
      The Only Flowchart You'll Ever Need
      1 person · 10 points · first shared 2007 · 2 comments on HN
    10. 10
      Simplicity isn't simple
      3 people · 8 points · first shared 2015 · Discussion on HN

    What HN people wrote when they linked it

    • e12eFeb 2016

      The sibling comment alludes to parsing calendar events (possibly .ical files). In general you need it for any kind of (de)serialization -- and as the recent java deserialization bug[1] (along with similar bugs in python, ruby) illustrates -- even in a mature language, "common practice" might not be "best practice" (everyone should've known that the various uses of blind deserialization was a bad idea -- but that doesn't really matter after the fact -- lots of high-profile libraries were completely broken). So "just use a library" might not be possible.

      Any time you take native objects/data and persist them, or marshal them, you need a parser -- or a parser library. That might mean reading some CSV, parsing some XML, reading some YAML, JSON or what-not.

      Then there's configuration that does more than set some variables, like for Nginx, Apache (web server), etc.

      One might want to have a short-hand for defining templates -- either for general meta-programming, or just to generate a layout-language (eg: html, css). If you're doing markdown (or markdown-like) processing, you might want to have some assurances that that's all that code can do -- generate html. Or you might want do meta-programming on some higher level, like generating interfaces for some java-beans based on a CSV structure. For more on meta-programming in Java, I recommend (the now slightly dated: http://www.amazon.com/Program-Generators-Java-Craig-Cleaveland/dp/0130258784 ). It's a shame he didn't name it as he…

    • mechanical_fishJan 2008

      Permit me to ramble for a bit.

      There is no idea so great that a one-sentence description, made by a stranger, will cause me to send an email asking for more. There are too many scammers, cranks, and clueless people in the world. There are too many people who have no idea how hard it is to complete a successful project. There are too many people who are looking for something for nothing.

      Of course, you folks are strangers, and yet you got me to give you some design advice -- twice! But you did quite a bit of work for this "free" advice -- you had to build an entire prototype site and post a link to it. That is the kind of presentation -- a working, criticizable prototype -- that might get people interested in joining a random project. It's a lot more than one sentence.

      Read this essay:

      http://fishbowl.pastiche.org/2005/05/08/finding_discord_in_harmony

      and this more recent one, that cites it:

      http://www.codinghorror.com/blog/archives/001017.html

      Other than providing working code -- or extensive mockups, or a detailed written proposal, or a compelling story -- the easiest way to get me interested in a collaboration is to get me interested in you. I don't care if you plan to cure cancer -- I want to know who you are, first. That takes time, and it takes words.

      So, if people are going to meet and start collaborations on your site, you need to give them lots of room to converse, to get to know each other. You need to give them long comment threads and rambling discussions.…

    • thaumaturgyJul 2008

      I initally intended to read 100 random Reddit threads, counting posts containing blockquotes with those not, and counting total inflammatory posts in either case.

      I've done four now and I'm getting really antsy.

      I'd love to come up with an algorithm to automate this, but discerning a troll post from an inflammatory post from an informative post algorithmically is an Engineering-Very-Hard problem [http://fishbowl.pastiche.org/2007/07/17/understanding_engineers_feasibility].

      Anyway, of the four, so far the results have been surprising: Out of 457 total read comments, there were only 25 blockquotes. Of the 25 blockquotes, there were 5 that I (totally subjectively) considered "inflammatory", either because of a strong personal attack, or because of a deliberate misquote of the author ("FTFY"). I only counted 15 inflammatory posts not containing a blockquote -- clearly, I wasn't counting comments that were just lame, tired repetitions of a meme, lacking content, etc.

      Because the sample set's so small, there isn't enough information for statistical significance one way or the other. However, in [http://www.reddit.com/info/6s09o/comments/], I did notice that there was a pattern where posts containing blockquotes in a thread tended to be longer, better written, more precise responses to the previous comment. The thread might devolve into a pedantic debate between two people, but it was still more of a discussion than many of the other threads that didn't contain blockquotes at…

    • boredguy8Apr 2010

      Neal Stephenson, "Diamond Age"

      "You know, when I was a young man, hypocrisy was deemed the worst of vices," Finkle-McGraw said. "It was all because of moral relativism. You see, in that sort of a climate, you are not allowed to criticise others--after all, if there is no absolute right and wrong, then what grounds is there for criticism?"

      ...

      "Now, this led to a good deal of general frustration, for people are naturally censorious and love nothing better than to criticise others' shortcomings. And so it was that they seized on hypocrisy and elevated it from a ubiquitous peccadillo into the monarch of all vices. For, you see, even if there is no right and wrong, you can find grounds to criticise another person by contrasting what he has espoused with what he has actually done. In this case, you are not making any judgment whatsoever as to the correctness of his views or the morality of his behaviour--you are merely pointing out that he has said one thing and done another. Virtually all political discourse in the days of my youth was devoted to the ferreting out of hypocrisy.

      ...

      "We take a somewhat different view of hypocrisy," Finkle-McGraw continued. "In the late-twentieth-century Weltanschauung, a hypocrite was someone who espoused high moral views as part of a planned campaign of deception--he never held these beliefs sincerely and routinely violated them in privacy. Of course, most hypocrites are not like that. Most of the time it's a spirit-is-willing,…

    • briancooleySep 2008

      Industry software "engineers" trained up in trade schools or worse, without any awareness that they are reimplementing solutions (poorly) to problems that were solved decades ago...and we get...horrible industrial monstrosities like Java

      Since Guy Steele coauthored both the Lambda Papers (late 1970's) and the first three editions of the Java specification, I don't think that you can successfully argue that awareness of anything solved by Lisp or Scheme was a problem in the development of Java.

      I always got the impression that the goal with Java was to make bad programmers better, not to create the ultimate language (e.g., see http://fishbowl.pastiche.org/2004/03/17/halfway_between_the_gutter_and_the_stars/)

      To use a golf analogy, consider cavity back irons. The average golfer, who struggles to hit it straight, will likely play a lot better with cavity backs. But a really good golfer won't be able to shape shots easily and will feel hamstrung without his blades.

    • danielstuddsApr 2013

      Finding the same thing with node.js, I got started OK with passport thanks to the examples for passport-local: https://github.com/jaredhanson/passport-local/tree/master/examples, especially express3-mongoose-multiple-files.

      Beyond that though, I've had to hack a fair bit to get "remember me" working (following the practices suggested http://stackoverflow.com/questions/549/the-definitive-guide-to-forms-based-website-authentication and http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice/) so not exactly straight-forward. (Aside: the remember me example for passport local might not be production ready, see http://stackoverflow.com/questions/16136712/is-an-authtoken-when-using-passport-persistent-session-safe).

      Also would love to hear what others are using!

    Related

    Coding Horrorblog.codinghorror.com2.1k people

    Farewell Stack Exchange

    Coding Horror
    Personal · last shared 2026
    Charles Bloomcbloomrants.blogspot.com65 people

    Did I ever mention that I fucking hate the fucking web

    Charles Bloom
    Personal · last shared 2026
    Dan Luudanluu.com1.2k people

    We only hire the trendiest

    Dan Luu
    Personal · last shared 2026
    Charles Petzoldcharlespetzold.com112 people

    “Code” 2nd Edition

    Charles Petzold
    Personal · last shared 2026
    Lambda the Ultimatelambda-the-ultimate.org615 people

    Simon Peyton Jones Elected into the Royal Society Fellowship

    Lambda the Ultimate
    Publication · last shared 2026
    Hillel Waynehillelwayne.com294 people

    1/0 = 0

    Hillel Wayne
    Personal · last shared 2026
    Marc Bevandblog.zorinaq.com91 people

    Windows NT Kernel Contributor Explains Why Performance is Behind Other OS

    Marc Bevand
    Personal · last shared 2026
    programming is terribleprogrammingisterrible.com124 people

    Write code that is easy to delete, not easy to extend

    programming is terrible
    Personal · last shared 2026