James Fisher
jameshfisher.com · Personal blog · on HN since 2017
James Fisher writes about programming, security, and tech culture, including phishing methods, SSH certificate authorities, and cryptography history.
What HN saysCommenters list him among blogs they check regularly and praise his 'I hate telephones' post and Gmail dots scam write-up.
62HN people shared it
27linked it in comments
67stories submitted
4.3Kstory points
1 year agolast shared
2017people per year2026
Most-shared posts
- 1My Parents Are Flat Earthers6 people · 187 points · first shared 2019 · 207 comments on HN
- 2The dots do matter: how to scam a Gmail user5 people · 1.0K points · first shared 2018 · 506 comments on HN
- 3Syntax highlighters are wrong (2014)5 people · 276 points · first shared 2019 · 170 comments on HN
- 4I hate telephones4 people · 554 points · first shared 2017 · 431 comments on HN
- 5The Hacker Hype Cycle4 people · 11 points · first shared 2019 · discussion on HN
- 6How to create an ssh certificate authority4 people · first shared 2020
- 7The inception bar: a new phishing method3 people · 1.0K points · first shared 2019 · 230 comments on HN
- 8Project C-43: the lost origins of asymmetric crypto3 people · 5 points · first shared 2019 · discussion on HN
- 9The Dots Do Matter: How to Scam a Gmail User3 people · 2 points · first shared 2018 · 1 comments on HN
- 10Homepage3 people · first shared 2019
- 11The sorry state of OpenSSL usability (2017)2 people · 239 points · first shared 2017 · 79 comments on HN
- 12Shape typing in Python2 people · 133 points · first shared 2024 · 75 comments on HN
- 13Smear phishing: how to scam an Android user2 people · 14 points · first shared 2020 · 2 comments on HN
- 14Why can’t I set the font size of a visited link?2 people · 6 points · first shared 2019 · discussion on HN
- 15Tell the LLM the Business Context2 people · 4 points · first shared 2024 · discussion on HN
What HN people wrote when they linked it
0xdeadb00f · 2019-09-29
I don't know about "best". But here's some I always check in on:
Jessie Frazelle: https://blog.jessfraz.com/
Joshua Stein: https://jcs.org/
Jim Fisher: https://jameshfisher.com/
(I just noticed they all have first names starting with 'J', weird coincidence, right?).
wildrhythms · 2023-10-02
I agree and I frequently come back to read this great anti-telephone manifesto titled 'I hate telephones' by Jim Fisher. You might enjoy it: https://jameshfisher.com/2017/11/08/i-hate-telephones/
lagrange77 · 2022-07-16
> [1]: https://tigyog.app/ [2]: https://jameshfisher.com/
I like your style!
jamesfisher · 2022-07-16
Everyday Data Science is the first course on TigYog [1], a platform I'm building. Most courses are video-based, but TigYog courses are more like books. The only addition is multiple-choice buttons with responses. This lets you simulate the tight feedback loop you’d have with a private tutor.
Andrew's writing shows off what you can make with this medium. It's a bit like blogging. Try it out and let me know how it goes! (Currently it’s a WYSIWYG editor, though I’m also working on a Markdown+git interface. Let me know if you’re interested.)
- Jim Fisher [2]
P.S.: Thanks to one user reporting an Apple Pay UI glitch. I'm on it! In the meantime, ordinary Stripe card payment should work.
[1]: https://tigyog.app/
[2]: https://jameshfisher.com/
SketchySeaBeast · 2019-02-06
Yeah, the other link(1) is more interesting. That's still not exactly a world shattering level of fraud though. Unless they subscribe to the 4k package, then we're getting unreasonable.
1) https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-g…
hackyhacky · 2025-01-11
Of course it isn't really BASIC compatibility mode. In reality, it's an lesser-known array initialization syntax. It's explained here: https://jameshfisher.com/2016/12/25/c-array-literal-explicit-indexes/
In short, you can initialize an array like this, by specifying each element in order:
int foo[] = {10,20,30}; // initialize elements 0, 1, and 2 However, you can also initialize specific array elements:
int foo[] = {[50] 10, [51] 20, [52] 30}; // initialize elements 50, 51, 52 "BASIC compatibility" mode uses the above syntax.
wonger_ · 2024-12-12
Reminds me of this experience of someone from the UK: https://jameshfisher.com/2017/05/19/granddad-died-today/
"Terminal dehydration is a way to skirt the Suicide Act, because we can claim that withholding water is just like withholding treatment. Ramping up painkillers and sedatives is a way to skirt the Suicide Act, because we can claim that the medication helps the patient cope with their death, rather than inducing their death."
matheusmoreira · 2024-04-25
> the expectation you can immediately and synchronously interrupt any person and demand their full attention
Needs to end as soon as possible. Calling on the phone is one of the most rude things someone can possibly do.
https://jameshfisher.com/2017/11/08/i-hate-telephones/
sovietswag · 2023-09-13
Good reference for that: https://jameshfisher.com/2016/11/27/c-k-and-r/
This was also used to implement variadic functions like printf before varargs, see https://retrocomputing.stackexchange.com/a/20517
sametmax · 2023-04-30
It's a more and more popular opinion:
- Why not tell people to "simply" use pyenv, poetry or anaconda (https://bitecode.substack.com/p/why-not-tell-people-to-simply-use)
- Don’t use the word ‘simply’ (https://jameshfisher.com/2017/02/22/dont-use-simply/)
- Stop using ‘simply’ in tech instructions (https://www.parkersoftware.com/blog/stop-using-simply-in-tech-instruct…
- Don’t say “simply” in your documentation (https://www.knowledgeowl.com/blog/posts/dont-say-simply-jim-fisher/)
And I agree strongly. It can be so discouraging to fail at something you should "simply" do.
But to be fair to the technical writer, it's easy to write it without noticing, even after proof reading. This should be automatized by writing tools.
radiator · 2023-03-22
It does not look so painful. I have found this guide helpful [https://jameshfisher.com/2018/03/16/how-to-create-an-ssh-certificate-a…
kodah · 2022-10-04
> Ever wondered why facebook.com is fast no matter where you are? They provide app-level tooling to make this superpower available to everyone.
They're doing that in the app? GeoDNS has been around for quite some time: https://en.wikipedia.org/wiki/GeoDNS or more thoroughly explained: https://jameshfisher.com/2017/02/08/how-does-geodns-work/
jeroenhd · 2022-08-31
I find this quick introduction to be quite helpful if you want to learn the basics: https://jameshfisher.com/2018/03/16/how-to-create-an-ssh-certificate-a…
If you don't know about them, you can probably answer "no" in this poll :)
dsego · 2022-08-05
This is actually my beef with almost all cool looking syntax color themes for sublime, they make comments fade into the background. And imho it should be the opposite, comments should jump out at you.
https://www.benkuhn.net/syntax/
https://jameshfisher.com/2014/05/11/your-syntax-highlighter-is-wrong/
beermonster · 2021-09-15
Not everyone knows that you can use MFA with SSH. I’ve successfully used Google authenticator via PAM[1] and YubiKey[2].
You can also setup SSH certificate authorities instead of using self-signed ones [3]
[1] https://wiki.archlinux.org/title/Google_Authenticator
[2] https://developers.yubico.com/SSH/
[3] https://jameshfisher.com/2018/03/16/how-to-create-an-ssh-certificate-a…
machinerychorus · 2021-06-18
Sounds like it could be the scam where they put in your email address and hope that you pay the bill for them:
https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-g…
ghastmaster · 2020-08-28
This is indeed the case. I have checked it myself. The link below shows how this can be used maliciously.
https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-g…
I do not know if this has been mitigated.
gruez · 2020-08-27
>Maybe there should be?
How do you prevent a website from faking the address bar? The only reason that you can trust address bars right now is that the website can't draw outside the content frame. There's already attacks on mobile[1] involving fake address bars because the address bar can be hidden, allowing the site to draw a fake address bar in its place. The only secure way to do it would be to opening another window (like when you try to use sign in with google), but that still has the issue that lots of legacy sites won't use this security feature, so users will still happily enter in their credit card numbers.
[1] https://jameshfisher.com/2019/04/27/the-inception-bar-a-new-phishing-m…
brian_herman · 2020-08-08
Seems like a SSH cert authority would be better.
https://jameshfisher.com/2018/03/16/how-to-create-an-ssh-certificate-a…
https://github.com/cloudtools/ssh-cert-authority
franciscop · 2019-11-29
I totally agree, made a while ago a snippet for Atom with syntax highlighting based on a similar article [1] that will make comments bright pink (meta-tweet with the code in effect):
https://twitter.com/FPresencia/status/1133733608785473536
For copy/paste (in Atom -> Stylesheet...):
.syntax--comment,
.syntax--punctuation.syntax--definition.syntax--comment,
.syntax--comment .syntax--markup.syntax--link {
color: rgba(255, 51, 255, 0.8);
}
.syntax--comment.syntax--block,
.syntax--comment.syntax--line {
background: rgba(255, 51, 255, 0.1);
}
[1] https://jameshfisher.com/2014/05/11/your-syntax-highlighter-is-wrong/
czr · 2019-11-29
for those interested, there's a longer discussion of this idea at https://jameshfisher.com/2014/05/11/your-syntax-highlighter-is-wrong/ (2014)
gog · 2019-11-03
Have a look at https://jameshfisher.com/2017/08/04/golang-dns-server/
DNS is actually pretty simple if you don't want to implement DNSSEC.
monocasa · 2019-07-10
On Linux, a full asm program with syscalls isn't too bad.
Here's one example:
https://jameshfisher.com/2018/03/10/linux-assembly-hello-world/
pvorb · 2019-01-30
I just watched the talk "don't say 'simply'" the other day [1]. You're right, "simply" is wrong here.
[1]: https://jameshfisher.com/2018/09/13/dont-say-simply-writethedocs-pragu…
willsewell · 2018-01-31
Somewhat off topic, but the idea to show the examples as diffs against the prior one was based on this block post: https://jameshfisher.com/2017/11/23/diff-views.
I would be interested to hear people's thoughts on the effectiveness. I like how it is clear what is important in each example, but there is perhaps too much noise and it's a shame the regular syntax highlighting does not work.
pizza234 · 2020-03-23
I think treating flat earth theory as a rational argument to debunk is appealing, but ultimately unproductive.
There was an interesting article some time ago: https://jameshfisher.com/2019/01/20/my-parents-are-flat-earthers, which casted the human perspective on the problem: at the root, believing a conspiracy theory gives self-importance to the believer, and it's, in a way, "fun".
Considering this perspective, this phenomenon belongs to the class of problems whose easy angle of attack is the technical (rational, in this case), and the difficult one is the human.
I'd argue that if one thinks that a flat earther is metaphorically a brick wall, and consequently a fool, opposing technical arguments against it is equally as foolish. It's actually the other side of the coin: yelling arguments to a wall is the mirrored human problem, in my opinion.
In conclusion, I think it would be more productive to think more about why this belief is appealing to people (and why it's spreading), rather than proving it's false.