Phil Haack

This reminds of "Argue well by losing" [1]. The purpose of debate shouldn't be to win or lose, but to reach consensus. In addition, the ancients of the classical world regarded "Rhetoric" (ie the ability to debate) as being the highest form of intelligence. It required not only a deep understanding of the reasoning behind your own opinion but also an equally deep understanding of that of your collocutors. Ie, you should be able to argue in favour of his/her point as well as your own, and as well as he/she can. That takes wisdom and humility that most today seem to lack. [1] - https://haacked.com/archive/2013/10/21/argue-well-by-losing.aspx/

And let's not forget Phil Haack (http://haacked.com), who is now working at GitHub. He used to be the program manager at Microsoft for ASP.NET MVC, the first part of the ASP.NET framework to be released under an open source license.

I agree. I think this method is a great idea and is much more foolproof: "You could also use Honeypot Captcha approach: you can create a honeypot form field that should be left blank and then use CSS to hide it from human users, but not bots. When the form is submitted, you check to make sure the value of that form field is blank." http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx

There's two problems: 1. generating code in the problem area (email address validation) which is pretty much a classic 'things programmers believe about' domain - https://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email… 2. generating code in a programming idiom with which you are unfamiliar - which regex as a DSL is also a pretty classic example. I don't think most programmers are good at regex, I know I'm definitely in the 'now you have two problems' in the regex camp. So to summarize it generated code written in a way the programmer could not understand what it even claimed to be doing, using a technology that many programmers are not especially good at; and it generated code that did not handle the problem domain correctly, and the problem domain is one that most programmers don't actually know that well either. the more I think of this thing the more disastrous it seems.

Very exciting to finally see semver get some traction in one way or another! A very welcome decision and announcement, also supported by Haacked's post[1]. [1]: https://haacked.com/archive/2019/02/11/semver-collective/ I have been quite active around the semver repo for a few years after 2.0.0 was released initially and participated in a lot of significant discussions that, to this day, still remain unresolved without either affinity to them or a stated rejection. After many years of seeing the same questions and suggestions pop up with no progress in sight, I just slowly lost hope and once issue updates started piling in to close issues at the initiative of @jwdonahue (thanks, by the way) without advancing any discussion or subject, I just unsubscribed. I am really exited about the things that are to come and will gladly try to participate in discussions to the best of my abilities. Currently, there are quite a few things that SemVer needs to decide on (not necessarily implement), but imo the important points are: 1. How are versions selected? You mentioned this in the thread already, but this point is hugely lackluster about the current situation. See issue #205 for the biggest discussion to date and many cross-references. 1.1 Build metadata, especially in the context of version selectors, kind of "just exist". They serve mostly as a "catch all" for various things you might want to annotate a version, but there are no rules or use cases for them. 2. (Automatic)…

Not sure why this is getting voted up so much. The author came across a report of IE freezing/crashing, replicated it, and Microsoft fixed it. In the same security update (http://technet.microsoft.com/en-us/security/bulletin/ms13-037) there are 10 other vulnerabilities described in the same way. Why is this particular vulnerability noteworthy or interesting, other than the fact that someone stumbled across it and documented it before it ended up reported to Microsoft? In fact, CVE-2013-1297 from that same security update (which I didn't know existed until now) is far more interesting from a security perspective (http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1297). Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript, which allows remote attackers to perform cross-domain reading of JSON files via a crafted web site, aka "JSON Array Information Disclosure Vulnerability." Similar JSON information disclosure can be very serious for a web application. http://haacked.com/archive/2009/06/24/json-hijacking.aspx describes the general issue in some depth. The fact that it was possible to use vbscript as a way to read in cross-domain JavaScript is very important from a security perspective.

"Ruby is a "me too" on those fronts, and not a particularly novel one." Of course. No one, especially not Matz, ever claimed Ruby was novel. Why should I care whether a language feature is new when I have features to ship? What you seem to be dogmatically, blindly ignoring is that Ruby's peculiar amalgamation of existing techniques, borrowed from (standing on the shoulders of) Smalltalk, Perl, Python, certain aspects of Lisp and others, created an expressiveness with those idioms that invited widespread adoption that Smalltalk and Lisp in all their glory only ever dreamed of. Innovation was the least of Ruby's concerns, and it's irrelevant to the conversation at hand. Type-safety seems to be a big thing for you. This may seem to be an enormous advantage to you, and I wish you well. I personally think type safety is the most overrated language feature in CS history. In my crankier moments I'd say it's essentially a compile-time unit test and refactoring/code-browsing crutch for IDE-jockeys that don't test their code. In my less-cranky moments...I'll probably say the same thing. And that's after a decade and an half in Java and C#, not quite a decade in Ruby. To me, type safety imposes far more overhead than it's worth -- generics, abstract classes, interfaces, all irrelevant and basically built-in and implicit in dynamic environments like Ruby. But that's another digression. Suffice it to say, in my entire software career I've kept track of the sum total of bugs I've fixed…

Phil Haack has a neat script called tree-me[0] that takes a lot of the pain out of this in vanilla Git [0] https://haacked.com/archive/2025/11/21/tree-me/

A missing dot over the "i" in the Latin alphabet is not a mistake in Turkish. It's a different letter. https://haacked.com/archive/2012/07/05/turkish-i-problem-and-why-you-s…

> JSON that's in the form {data: [...hundred megs of lines]} is annoying for various parsers. One reason this became common was a simple protection against json hijacking: https://haacked.com/archive/2009/06/25/json-hijacking.aspx/

Every programmer on my team has gotten this link about email address validation. "I Knew How To Validate An Email Address Until I Read The RFC" https://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email…

- Daniel Lemire: https://lemire.me/blog/ - Andrew Lock: https://andrewlock.net/ - Steve Gordon: https://www.stevejgordon.co.uk/ - Scott Helme: https://scotthelme.co.uk/ - Phil Haack: http://haacked.com/

I like the idea that services should mimic the people organization that maintain them[0]. Obtuse rule - Don't build a service smaller than a team. Probably 2 teams. [0] http://haacked.com/archive/2013/05/13/applying-conways-law.aspx/

Yet those tools are full of bugs as well as culturally blind and prudish assumptions. Hint: try signing up with the address [email protected] - https://blog.jgc.org/2010/06/your-last-name-contains-invalid.html - https://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email… - https://fosdem.org/2018/schedule/event/email_address_quiz/

A lot of email validation rules fail to cover valid corner cases: https://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email… For that matter, future developments can be problematic: Does your validation rule allow for "@gmail.com"? It seems better to warn the user that it might be invalid, rather than completely blocking some users from signing up.

Yes! Today is a good day to reread Phil Haack’s 2014 essay on the lengths MS goes to for backwards compatibility: https://haacked.com/archive/2014/05/27/backwards-compatibility/ Edit: Haack heavily cites Raymond Chen from 2003: https://devblogs.microsoft.com/oldnewthing/20031015-00/?p=42163

It prevents the response from being evaluated as Javascript. In some older web browsers (like Firefox 2.0), this was required to prevent an attack where the Array constructor is overridden to capture arrays within a response. This no longer works on any modern browser, but a lot of web services still attempt to defend against it. https://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulner…

Here you go: https://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulner…

haack once wrote a nice article on this: https://haacked.com/archive/2009/07/14/law-of-demeter-dot-counting.asp…

I keep meaning to implement the GitHub PR-based comments that Phil Haack has been using. [0] I like the idea of PRs for comments and comments being static YAML files after they are posted. [0] https://haacked.com/archive/2018/06/24/comments-for-jekyll-blogs/

No. "Source available" is not the same as "open source". https://haacked.com/archive/2006/07/26/CodeAvailableVsOpenSourceVsFree…

Phil Haack has a nice set of aliases that I've grown reliant on: https://haacked.com/archive/2014/07/28/github-flow-aliases/

Not really, according to the spec the '+' can be interpreted as part of the email address. The approach gmail takes seems to have gained widespread adoption, but it's not mandated by the spec. Believe I saw this on HN recently: http://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-…

I've seen this called "Honeypot CAPTCHA"[0]. I'd say it's good for 90% of sites, up until the point where spammers or fraudsters start targeting you specifically. [0]: http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx/

One interesting question from http://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-… is “Fred Bloggs”@example.com actually a valid email address, given that the plain ascii double-quotes seem to have been converted to "fancy" ones by the blogging software?

yeah, the term I'd use is source available? anyway, I agree with the idea that "open source" is a dirty term, an attempt to subvert the free software movement. But that is a battle for another day. Someone else put it better than I could: > Likewise a Source Available is not necessarily Open Source, but Open Source is necessarily Source Available. https://haacked.com/archive/2006/07/26/CodeAvailableVsOpenSourceVsFree… (requires you to accept github cert because https is difficult for some reason) Blog github at https://github.com/Haacked/haacked.com

These are all valid email addresses! * "Abc\@def"@example.com * "Fred Bloggs"@example.com * "Joe\\Blow"@example.com * "Abc@def"@example.com * customer/[email protected] * [email protected] * !def!xyz%[email protected] * [email protected] http://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-…

Returning just an array from a json-endpoint that may contain sensitive data is a vulnerability: http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnera… (edit: may be mitigated in newer browsers)

Unfortunately, email format validation (similar to HTML email) is somewhat of a black art: http://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-… http://girders.org/blog/2013/01/31/dont-rfc-validate-email-addresses/ Of course one could always just go with RFC822 and this little regex: http://www.ex-parrot.com/pdw/Mail-RFC822-Address.html

Clickable: http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx/