Charlie Robbins
cirw.in · Personal blog · on HN since 2012
Charlie Robbins writes about developer tools, terminals, Ruby, Node, and Go, including bracketed paste mode and the CONL config format.
What HN saysHN commenters link his bracketed paste mode explainer for terminal paste attacks, and also cite his CONL config format and his MVC post.
34HN people shared it
17linked it in comments
32stories submitted
1.4Kstory points
12 months agolast shared
2012people per year2026
Most-shared posts
- 1Bracketed paste mode (2013)14 people · 56 points · first shared 2013 · 22 comments on HN
- 2MVC is dead, it's time to MOVE on3 people · 754 points · first shared 2012 · 222 comments on HN
- 3Node's Unicode Dragon3 people · 97 points · first shared 2013 · 63 comments on HN
- 4CONL: "Markdown" for your config files3 people · 95 points · first shared 2025 · 51 comments on HN
- 5Visualizing memory leaks in Ruby2 people · 45 points · first shared 2013 · 9 comments on HN
- 6Dotgpg: Easy-to-use storage for your production secrets (2014)2 people · 6 points · first shared 2014 · discussion on HN
- 7Tools for Go Modules2 people · 4 points · first shared 2024 · discussion on HN
- 8Dynamic scope for Ruby2 people · 4 points · first shared 2012 · discussion on HN
- 9MVC is dead, it's time to MOVE on (2012)1 people · 182 points · first shared 2013 · 168 comments on HN
- 10Show HN: pry-rescue — workflow-optimized debugging for ruby1 people · 69 points · first shared 2012 · 30 comments on HN
- 11Ampex - concise readable Ruby blocks1 people · 45 points · first shared 2012 · 17 comments on HN
- 12How to program like an explorer (with Pry).1 people · 25 points · first shared 2012 · 3 comments on HN
- 13A safer git checkout1 people · 13 points · first shared 2012 · 18 comments on HN
- 14Be proud of your git commit history1 people · 6 points · first shared 2012 · discussion on HN
- 15Avoiding hash-injection attacks in MongoDB1 people · 4 points · first shared 2014 · discussion on HN
What HN people wrote when they linked it
3eb7988a1663 · 2025-11-18
Could go the other way and only have strings a la CONL[0]. Which feels reasonable once I got over my initial shock. Your program is already going to enforce data types, why force that into the config language?
[0] https://cirw.in/blog/conl
sumosudo · 2024-04-05
Using this architecture with htmx is the future
https://cirw.in/blog/time-to-move-on
brendanfalk · 2021-04-09
Some interesting additional information about "bracketed paste mode": https://cirw.in/blog/bracketed-paste
piger · 2021-03-17
OP might want to consider bracketed paste mode: https://cirw.in/blog/bracketed-paste
ymrinquin · 2020-10-16
There's a terminal mechanism to avoid this kind of attack: Bracketed Paste Mode.
https://cirw.in/blog/bracketed-paste
JadeNB · 2020-08-07
> Aside: Is there a similar tool for macOS?
I don't know the state of Windows terminal emulators, but it seems strange to describe the problem without mentioning the term for the solution, which is 'bracketed paste'. This article discusses how bracketed-paste mode is signalled using ANSI escape sequences, which I guess can work in most macOS terminal emulators (although it's up to the shell to respond): https://cirw.in/blog/bracketed-paste . (I guess that Win+Ins is doing something similar on Windows?)
oefrha · 2020-07-09
Turn on bracketed paste mode everywhere. Doesn’t help with homograph attacks (e.g. an IDN homograph attack tricking you into downloading something from the wrong domain), but at least you’re totally safe until you press enter to execute.
https://cirw.in/blog/bracketed-paste
O_H_E · 2019-03-18
I am gonna leave this here.
https://cirw.in/blog/bracketed-paste
It is not that "I think" it is objectively more efficient and easier to read, yes this has been studied before.
I agree that going too narrow increases scrolling and it's annoying. (Widescreens are a stupid trend)
xiaq · 2017-07-21
Some terminal emulators / shells use some heuristics, but the most reliable way is to use a combination of a terminal emulator and shell that support bracketed paste mode. This article (https://cirw.in/blog/bracketed-paste) lists some terminal emulators that supports bracketed paste, and a zsh plugin that makes zsh handle bracketed paste in a safe manner.
As an alternative to zsh, Elvish (https://github.com/elves/elvish) supports bracketed paste out of the box. When you paste anything that includes a carriage return, Elvish will insert a literal return instead of executing it.
(Disclaimer: I am the author of Elvish.)
patrec · 2017-03-19
Does vim 8 still not have bracketed paste by default?
https://cirw.in/blog/bracketed-paste
pmoriarty · 2017-02-02
Quadruple-click smart selection should be doable with urxt's perl extension feature.
Selecting within a tmux pane: you got me on that one. I'm not aware of a terminal that does that, but again, it should be possible to do with urxvt's perl extension feature.
Regarding the "safer command line paste", Linux can do the same with bracketed paste mode.[1]
For splitting panes, I just use tmux, vim, or emacs.
[1] - https://cirw.in/blog/bracketed-paste
d0mine · 2017-01-27
There is safe-paste plugin for oh-my-zsh and you can enable the bracketed paste mode in Bash too by adding set enable-bracketed-paste on to your ~/.inputrc. https://cirw.in/blog/bracketed-paste
spion · 2016-10-13
Thanks, I edited the post to include some Ruby semantic richness for you to enjoy:
https://cirw.in/blog/constant-lookup.html
takluyver · 2016-05-24
This. I'd argue that the issue here is more with terminals and shells than web browsers: paste shouldn't immediately start executing something. The technology to not do so has been around for years - it's called bracketed paste: https://cirw.in/blog/bracketed-paste
phillmv · 2014-03-12
This is a side tangent but seeing graphviz being used here reminded me of this total boss ruby patch: http://cirw.in/blog/find-references
I had spent a week slowly isolating this brutal memory leak until being able to see the whole ObjectSpace illuminated my problem.
CarpaDorada · 2024-11-28
The issue is mostly with git itself, e.g. take a look at
git cat-file commit HEAD to see something like:
tree <tree-hash> parent <parent-hash> author <author-name> <author-email> <timestamp> committer <committer-name> <committer-email> <timestamp> gpgsig -----BEGIN PGP SIGNATURE----- <ascii-armored RFC9580 signature> -----END PGP SIGNATURE----- <commit message> You can view an example of the structure of this ascii-armored signature here <https://cirw.in/gpg-decoder/#-----BEGIN%20PGP%20SIGNATURE-----%0A%0AiF…
You can add a patch to git to support more signature types than just OpenPGP. You may then be able to move mountains and get GitHub/others to join in the validation. Finally, if you can find bugs/exploits in GnuPG, you should report them and you will definitely get credit and recognition for them. They are not trivial to find.
pdm55 · 2012-12-22
i like this http://cirw.in/blog/lspace