Top all-time · #360
Nelson Elhage
Personal blog · blog.nelhage.comsystemsprogrammingsecurity
Nelson Elhage writes Made of Bugs, a personal blog at blog.nelhage.com about systems, programming and security. Since 2010, 147 different Hacker News readers have linked it 211 times, most often “Computers Can Be Understood”. It is still writing: the last post was on 2026-03-23, and you can follow it by feed.
Rarely recommended · 4 of 40 sampled comments recommend it?
Why HN links it
Commenters cite this blog as a source on unsafe unpickling, Postgres and MySQL operations, the CPython tail-call interpreter, and testing. Few comments judge the writing directly.
- Recommended for · 4 comments
- One commenter calls a writeup good, another finds a follow-up more interesting, and another commends a page.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Nelson Elhage's blog. I write about software and software engineering.
Most-linked posts?
- Computers Can Be Understood15 people · 19 mentions · first linked 2020-02-16
- Reflections on Software Performance10 people · 11 mentions · first linked 2020-02-03
- Regular Expression Search with Suffix Arrays7 people · 7 mentions · first linked 2015-02-10
- Some opinionated thoughts on SQL databases6 people · 7 mentions · first linked 2021-03-30
- Performance of the Python 3.14 tail-call interpreter6 people · 6 mentions · first linked 2025-03-09
- Systems that defy detailed understanding5 people · 6 mentions · first linked 2020-02-24
- What MongoDB got right5 people · 5 mentions · first linked 2015-11-10
- How I Write Tests5 people · 5 mentions · first linked 2016-12-29
- Graceful Behavior at Capacity5 people · 5 mentions · first linked 2023-08-07
- A Cursed Bug(2022)5 people · 5 mentions · first linked 2022-02-23
What Hacker News says?
Marshalling bugs in other languages and frameworks: - Java: WebSphere, WebLogic, JBoss, Jenkins : http://foxglovesecurity.com/2015/11/06/what-do-weblogic-webs... . Admittedly most of these are through sidechannels and nothing as obvious as sessions, but it's the same mistake. - Python: https://blog.nelhage.com/2011/03/exploiting-pickle/ . Unpickling got at least Cisco Web Security Appliances: http://tools.cisco.com/…
Comment linking /2011/03/exploiting-pickle/
on “Instagram's Million Dollar Bug”Submitted Performance of the Python 3.14 tail-call interpreter as a story · 607 points
HN discussion"Efficiency trades off against resiliency" https://blog.nelhage.com/post/efficiency-vs-resiliency/
Comment linking /post/efficiency-vs-resiliency/
on “Too much efficiency makes everything worse (2022)”Submitted Stripe's Monorepo Developer Environment as a story · 393 points
HN discussionA common metric for how much actual content has changed is the Jaccard Index. Even for large numbers of datasets that are too large to fit in memory it can be approximated with various forms of MinHash algorithms. Some write up here: https://blog.nelhage.com/post/fuzzy-dedup/ https://en.wikipedia.org/wiki/Jaccard_index
Comment linking /post/fuzzy-dedup/
on “Archivists work to save disappearing data.gov datasets”Submitted How I Write Tests as a story · 349 points
HN discussionGood to know! Thanks for confirming. Yes, I would guess that the tail call interpreter explains part of the difference between 3.13 and 3.14. Previously the overall improvement to the interpreter has been measured at 1-5%, or even 10-15% depending on the compiler version you are using: https://blog.nelhage.com/post/cpython-tail-call/ If your benchmark setup is easy to re-run, it would be awesome to see numbers that…
Comment linking /post/cpython-tail-call/
on “Python 3.14 is here. How fast is it?”Submitted Systems that defy detailed understanding as a story · 278 points
HN discussion> Counter-argument: coming up with your own, carefully considered solutions to every technical challenge is absurdly time-consuming. You should really understand the problem you're trying to solve. Once you understand the problem, evaluating a solution is not so hard. And implementing a solution without understanding it is negligence that will bite you in prod sooner or later. https://blog.nelhage.com/post/computers…
Comment linking /post/computers-can-be-understood/
on “Most tech content is bullshit”Submitted Finding near-duplicates with Jaccard similarity and MinHash as a story · 247 points
HN discussionSpecifically about UTF-8 in Postgres: "PostgreSQL collation is a massive footgun" https://gist.github.com/rraval/ef4e4bdc63e68fe3e83c9f98f56af... Postgres defaults to the system's collation for UTF-8, which caught me by surprise. Now I'm stuck with a production DB where text prefix queries, which should be a perfect use of a btree, are a full table scan. Probably gonna have to take some maintenance downtime to fix t…
Comment linking /post/some-opinionated-sql-takes/
on “In MySQL, use “utf8mb4” instead of “utf8” (2016)”Submitted Disable transparent hugepages as a story · 178 points
HN discussion"Some opinionated thoughts on SQL databases" (2021): https://blog.nelhage.com/post/some-opinionated-sql-takes/ There are many factors to take into account, but this article focuses on the "operating reliably in production" factor and says that MySQL has fewer surprises: As for Postgres, I have enormous respect for it and its engineering and capabilities, but, for me, it’s just too damn operationally scary. In my exp…
Comment linking /post/some-opinionated-sql-takes/
on “Leaving MySQL”Submitted Confessions of a programmer: I hate code review (2010) as a story · 176 points
HN discussioni think doing releases, deployments, and rollbacks is trickier in a monorepo. with multiple services/repos, each team can handle their own release cycles, on-call rotation, and only deal with the bits, tests, and failures they wrote. you lose some CPU/RAM/IO efficiency, but you gain autonomy and resilience, and faster time to resolution. https://blog.nelhage.com/post/efficiency-vs-resiliency/ e.g. at Grafana we're w…
Comment linking /post/efficiency-vs-resiliency/
on “In Defense of Simple Architectures (2022)”Submitted Three kinds of memory leaks as a story · 176 points
HN discussionA more pragmatic view in that article: https://blog.nelhage.com/post/some-opinionated-sql-takes/
Comment linking /post/some-opinionated-sql-takes/
on “Against SQL”Submitted Transformers for software engineers as a story · 175 points
HN discussionAnother recent Postgres-complaint post from one of the best engineers I've worked with: https://blog.nelhage.com/post/some-opinionated-sql-takes/ Quoting his conclusion: > As for Postgres, I have enormous respect for it and its engineering and capabilities, but, for me, it’s just too damn operationally scary. In my experience it’s much worse than MySQL for operational footguns and performance cliffs, where using it…
Comment linking /post/some-opinionated-sql-takes/
on “Things I hate about PostgreSQL (2020)”Submitted Computers Can Be Understood as a story · 170 points
HN discussionhttps://blog.nelhage.com/2015/08/indices-point-between-eleme...
Comment linking /2015/08/indices-point-between-elements/
on “Why do arrays start at 0?”Submitted Tracking down a memory leak in Ruby's EventMachine as a story · 158 points
HN discussionthis whole thread reminds me of the blog where someone used AWS Lambda as a pseudo-distcc to compile LLVM in 90s: https://blog.nelhage.com/post/building-llvm-in-90s/
Comment linking /post/building-llvm-in-90s/
on “Fuchsia Workstation”Submitted Reflections on Software Performance as a story · 154 points
HN discussionIn posts talking about how someone made something fast, I see the same idea repeat time after time: it has linear time complexity, has great cache locality, and saturates all available processors. It's annoying to me how much time I had to spend outside of school before I realized that this is the real recipe for fast code. In particular, even code that is nominally O(n^2) by standard measures is still a dis -econom…
Comment linking /post/reflections-on-performance/
on “Why Is Esbuild Fast?”Submitted Dear Twitter: Stop screwing over your developers as a story · 152 points
HN discussionI've recently launched HypoFuzz - https://hypofuzz.com/ - which solves this by running it on a different server. You run the tests briefly in CI to check for regressions, and then leave them running permanently on a fuzz server to search for new bugs. Nelson Elhage has a good writeup of this approach at https://blog.nelhage.com/post/two-kinds-of-testing/
Comment linking /post/two-kinds-of-testing/
on “Go: Fuzzing Is Beta Ready”Submitted What MongoDB got right as a story · 144 points
HN discussionThis is nice work, but anyone wanting to try it for themselves should be warned that you shouldn't unpickle data received from an untrusted source. https://blog.nelhage.com/2011/03/exploiting-pickle/
Comment linking /2011/03/exploiting-pickle/
on “Lane Following Autopilot with Keras and Tensorflow”Submitted Indices Point Between Elements as a story · 133 points
HN discussion
