Top all-time · #1279
Sonar Blog
Company blog · sonarsource.com/blogprogrammingsecurity
Sonar Blog is the company blog at sonarsource.com, writing about programming and security. Since 2012, 56 different Hacker News readers have linked it 78 times, most often “Cognitive Complexity – a new way of measuring understandability (2023) [pdf]”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (23) to say how often HN recommends it.?
Why HN links it
HN readers link Sonar's blog and docs as references on code complexity (Cognitive Complexity), static analysis, and security issues such as the TeamCity exploit and mXSS. Job posts also appear.
Summarised by Claude from a sample of 23 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Enforce consistent quality gates across every pull request and pipeline, from IDE to CI/CD, with automated code review for bugs and security issues.
Most-linked posts?
- Cognitive Complexity – a new way of measuring understandability (2023) [pdf]12 people · 13 mentions · first linked 2018-08-21
- Code Vulnerabilities Put Proton Mails at Risk4 people · 4 mentions · first linked 2023-09-06
- Vulnerable Regular Expressions in JavaScript3 people · 3 mentions · first linked 2023-10-04
- mXSS: Mutation Cross-Site Scripting Explainer3 people · 3 mentions · first linked 2024-10-10
- Encoding Differentials: Why Charset Matters3 people · 3 mentions · first linked 2024-07-17
- /resources/cognitive-complexity/2 people · 3 mentions · first linked 2024-01-16
- Source Code at Risk: Critical Code Vulnerability in CI/CD Platform TeamCity2 people · 2 mentions · first linked 2023-09-28
- The State of (AI) Code Developer Survey2 people · 2 mentions · first linked 2026-01-08
- Union, intersection, difference, and more are coming to JavaScript Sets2 people · 2 mentions · first linked 2024-02-16
What Hacker News says?
This is one of the benefits of Cognitive Complexity: https://www.sonarsource.com/docs/CognitiveComplexity.pdf >Switches >A `switch` and all its cases combined incurs a single structural increment. >Under Cyclomatic Complexity, a switch is treated as an analog to an `if-else if` chain. That is, each `case` in the `switch` causes an increment because it causes a branch in the mathematical model of the control flow. >B…
Comment linking /docs/CognitiveComplexity.pdf
on “-2000 Lines of Code”Submitted Union, intersection, difference, and more are coming to JavaScript Sets as a story · 115 points
HN discussionReally? I would love a link to the research then. So far the only[] thing I've found was Weyuker's 9 Properties from measurement theory, and that did not seem particularly compelling. Now, I get that linear/affine types and dependent types (and theorem provers, etc) can be used to prove that you're following the spec. But this doesn't prove that the code is easily comprehended by the people interacting with it. Code…
Comment linking /resources/cognitive-complexity/
on “How a software glitch at the UK Post Office ruined lives”Submitted Cognitive Complexity – a new way of measuring understandability (2023) [pdf] as a story · 3 points
HN discussionOkay, I love Eclipse (technically). It's just a dog, most of the time and tries to be everything at once. Still, it _is_ a great project. Maven: I .. never got that one. I guess the parts that make sense to me are covered by nuget. But I might be totally ignorant here. CheckStyle -> StyleCop ? Jenkins supports .Net Tomcat makes no sense in this list for me. IIS? Jetty: See above? Maybe the ASP.Net dev server, depend…
Comment linking /products/plugins/languages/c-sharp/
on “A close look at how Oracle installs deceptive software with Java updates”Submitted Sonar to Acquire Tidelift to Reduce Risk from Open Source Software as a story · 3 points
HN discussionSonarSource | Onsite: Bochum (DE), Geneva (CH), Annecy (FR) | Remote: EU-friendly timezones | Full-time | https://sonarsource.com Security Scientist - Static Analysis¹ Security Scientist - Machine Learning² Vulnerability Researcher³ SonarSource builds world-class products (SonarQube, SonarCloud, SonarLint) for Code Security and Code Quality, with over 15k customers and 300k instances of our Community Edition. Our Se…
Comment linking /company/jobs/vulnerability-research
on “Ask HN: Who is hiring? (January 2022)”Submitted Encoding Differentials: Why Charset Matters as a story · 3 points
HN discussionI've been using SonarLint[0] for a while for this, as it not only finds code smells, but also if i do things in a weird way, like doing for(i=0;i>array.length-1;i++) {console.log(arrray[i]} instead of just doing for(const element of array). [0]: https://www.sonarsource.com/products/sonarlint/
Comment linking /products/sonarlint/
on “AI found a bug in my code”Submitted Encoding Differentials: Why Charset Matters as a story · 3 points
HN discussionCool. I've noticed that general program complexity seems to be a topic that everyone acknowledges, but nobody tries to frame objectively. Except for a few people at the fringes. I'm not sure that I understand and/or agree with this link. However, I've written and talked about this topic in the past and the response that I've gotten is usually some variation of, "Cool, but I'm not sure that I get it." It feels kind o…
Comment linking /docs/CognitiveComplexity.pdf
on “I hate almost all software (2011)”Submitted __dirname is back in Node.js with ES modules as a story · 3 points
HN discussionSonarSource | Onsite: Bochum (DE), Geneva (CH), Annecy (FR) | Remote: EU-friendly timezones | Full-time | https://sonarsource.com Security Scientist - Static Analysis¹ Security Scientist - Machine Learning² Vulnerability Researcher³ SonarSource builds world-class products (SonarQube, SonarCloud, SonarLint) for Code Security and Code Quality, with over 15k customers and 300k instances of our Community Edition. Our Se…
Comment linking /company/jobs/vulnerability-research
on “Ask HN: Who is hiring? (February 2022)”Submitted Union, intersection, difference, and more are coming to JavaScript Sets as a story · 3 points
HN discussionI liked the way Red Hat thanked important contributors to open source prior to their IPO better https://www.sonarsource.com/blog/the-red-hat-ipo-experiment-...
Comment linking /blog/the-red-hat-ipo-experiment-to-pay-maintainers-25-years-later/
on “Rob Pike Goes Nuclear over GenAI”Submitted Vulnerable Regular Expressions in JavaScript as a story · 3 points
HN discussionInstead of trying to dedicate time specifically to refactor try to clean up classes as you come across them when fixing bugs or adding features. Whenever I open a file, I try and take a quick glance to see if there's anything that could use refactoring before working on the actual issue (if it's either a particularly large file or one that hasn't been touched in years I'll check Sonar[1]). [1] http://www.sonarsource…
Comment linking /
on “What most young programmers need to learn”Submitted Cognitive Complexity (2017) [pdf] as a story · 3 points
HN discussionHey People from SonarSource: https://www.sonarsource.com/company/history/ please file a lawsuit against Facebook. It looks like it is necessary to prevent them to use these confusing names.
Comment linking /company/history/
on “Open-sourcing Sonar, a new extensible debugging tool”Submitted State of Code Developer Survey report [pdf] as a story · 2 points
HN discussion> Are there any examples where the first approach (sanitize to string and set inner html) is actually dangerous? The article links to [0], which has some examples of instances in which HTML parsing is context-sensitive. The exact same string being put into a <div> might be totally fine, while putting it inside a <style> results in XSS. [0]: https://www.sonarsource.com/blog/mxss-the-vulnerability-hidi...
Comment linking /blog/mxss-the-vulnerability-hiding-in-your-code/
on “Why the Sanitizer API is just `setHTML()`”Submitted The Coding Personalities of Leading LLMs as a story · 2 points
HN discussionThey had a link in their post [0]: it seems like most of the examples are with HTML elements with wacky contextual parsing semantics such as <svg> or <noscript>. Their recommendation for server-side sanitization is "don't, lol", and they don't offer much advice regarding it. Personally, my recommendation in most cases would be "maintain a strict list of common elements/attributes to allow in the serialized form, and…
Comment linking /blog/mxss-the-vulnerability-hiding-in-your-code/
on “Why the Sanitizer API is just `setHTML()`”Submitted Sanitize Client-Side: Why Server-Side HTML Sanitization Is Doomed to Fail as a story · 2 points
HN discussionSee also Cognitive Complexity: https://www.sonarsource.com/resources/cognitive-complexity/
Comment linking /resources/cognitive-complexity/
on “Cyclomatic complexity”Submitted Unpatched Vulnerabilities in Gogs as a story · 2 points
HN discussionProbably not. Although, you can immediately follow that up with asking whether this makes any sense in any programming language. From the wikipedia link: https://en.wikipedia.org/wiki/Cyclomatic_complexity#Correlat... Correlation between CC and defects isn't always present and in fact lines of code might be a better metric. I assert that there is no current objective metric where you can plug in source code and get…
Comment linking /resources/cognitive-complexity/
on “Cyclomatic complexity”Submitted PfSense Security: Sensing Code Vulnerabilities with SonarCloud as a story · 2 points
HN discussionHow does it compare to using Sonar with the JavaScript plugin? (not in a Sonar vs Code Climate way, but specifically for JS) http://www.sonarsource.com/products/plugins/languages/javasc...
Comment linking /products/plugins/languages/javascript/
on “Show HN: Code Climate for JavaScript”Submitted Code Vulnerabilities Put Proton Mails at Risk as a story · 2 points
HN discussion
