Top all-time · #369
You’ve Been Haacked
Personal blog · haacked.comprogrammingcareer
You’ve Been Haacked is a personal blog at haacked.com about programming and career. Since 2007, 147 different Hacker News readers have linked it 183 times, most often “I Knew How to Validate an Email Address Until I Read the RFC”. It is still writing: the last post was on 2026-07-20, and you can follow it by feed.
Rarely recommended · 3 of 40 sampled comments recommend it?
Why HN links it
HN readers link Phil Haack's blog mainly for his posts on email address validation, the honeypot CAPTCHA, JSON hijacking, and arguing well, plus his GitHub Flow aliases and tree-me script.
- Recommended for · 3 comments
- Commenters call 'Argue well by losing' the post that changed how they argue, call the GitHub Flow aliases a nice set they rely on, and list the blog among great
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
You’ve been Haacked is a blog about Technology, Software, Management, and Open Source. It’s full of good stuff.
Most-linked posts?
- I Knew How to Validate an Email Address Until I Read the RFC7 people · 7 mentions · first linked 2016-02-10
- I Knew How to Validate an Email Address Until I Read the RFC (2007)5 people · 6 mentions · first linked 2020-06-11
- Honeypot Captcha5 people · 5 mentions · first linked 2007-09-11
- JSON Hijacking - vulnerability in some GET situations5 people · 5 mentions · first linked 2009-06-26
- Anatomy of a Subtle JSON Vulnerability5 people · 5 mentions · first linked 2008-11-21
- I Knew How To Validate An Email Address Until I Read The RFC3 people · 3 mentions · first linked 2007-08-22
- Honeypot Captcha (2007)3 people · 3 mentions · first linked 2014-06-18
- The Siren Song of Backwards Compatibility (2014)2 people · 4 mentions · first linked 2020-11-18
- Tree-me: Because Git worktrees shouldn't be a chore2 people · 3 mentions · first linked 2025-11-23
- Phil Haack quit Microsoft for GitHub2 people · 2 mentions · first linked 2011-12-07
What Hacker News says?
The discussion about valid email addresses reminded me of this article: https://haacked.com/archive/2007/08/21/i-knew-how-to-validat... For any programmer that's ever tried to validate email addresses it's an eye opener.
Comment linking /archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx/
on “You can bypass YouTube ads by adding a dot after the domain”Submitted Phil Haack quit Microsoft for GitHub as a story · 181 points
HN discussion> JSON that's in the form {data: [...hundred megs of lines]} is annoying for various parsers. One reason this became common was a simple protection against json hijacking: https://haacked.com/archive/2009/06/25/json-hijacking.aspx/
Comment linking /archive/2009/06/25/json-hijacking.aspx/
on “A love letter to the CSV format”Submitted Argue well by losing as a story · 117 points
HN discussionNot sure about life-changing as such, but I often think of "Argue well by losing" by Phil Haack [1] when I think about how I and others go about arguing, online or in person. It really helps me to step back and be objective about discussions I get involved in. [1] http://haacked.com/archive/2013/10/21/argue-well-by-losing.a...
Comment linking /archive/2013/10/21/argue-well-by-losing.aspx/
on “Ask HN: What's the most life-changing blog post you've ever read?”Submitted The Turkish İ Problem and Why You Should Care (2012) as a story · 112 points
HN discussionPhil Haack has a nice set of aliases that I've grown reliant on: https://haacked.com/archive/2014/07/28/github-flow-aliases/
Comment linking /archive/2014/07/28/github-flow-aliases/
on “Show HN: I made a tool that made me faster at Git”Submitted Voting is a Sham Mathematically Speaking as a story · 95 points
HN discussion"Ruby is a "me too" on those fronts, and not a particularly novel one." Of course . No one, especially not Matz, ever claimed Ruby was novel. Why should I care whether a language feature is new when I have features to ship? What you seem to be dogmatically, blindly ignoring is that Ruby's peculiar amalgamation of existing techniques, borrowed from (standing on the shoulders of) Smalltalk, Perl, Python, certain aspec…
Comment linking /archive/2007/05/24/ruby-like-syntax-in-c-3.0.aspx
on “RubyMotion - Ruby for iOS”Submitted GitHub Flow Like a Pro with These 13 Git Aliases as a story · 80 points
HN discussionNo. "Source available" is not the same as "open source". https://haacked.com/archive/2006/07/26/CodeAvailableVsOpenSo...
Comment linking /archive/2006/07/26/CodeAvailableVsOpenSourceVsFreeSoftware.aspx/
on “Don’t sign a CLA”Submitted The future of .NET as a story · 54 points
HN discussionI agree. I think this method is a great idea and is much more foolproof: "You could also use Honeypot Captcha approach: you can create a honeypot form field that should be left blank and then use CSS to hide it from human users, but not bots. When the form is submitted, you check to make sure the value of that form field is blank." http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx
Comment linking /archive/2007/09/11/honeypot-captcha.aspx
on “Techniques To Simplify Sign-Ups and Log-Ins”Submitted ASP.NET MVC Now Accepting Pull Requests as a story · 52 points
HN discussion> Devices "suited for idiots and people too lazy to read the manual" have, in the past decade, driven massive growths in computing, made it more accessible to more people, changed the landscape of the entire world, and even fueled a few revolutions The touch devices I assume you're referring to are intuitive because as a human you're naturally good at using your hands to make things move around. Push a button and it…
Comment linking /archive/2008/11/06/usability-vs-discoverability.aspx
on “Glass”Submitted ASP.NET MVC 4 Roadmap as a story · 49 points
HN discussionEvery programmer on my team has gotten this link about email address validation. "I Knew How To Validate An Email Address Until I Read The RFC" https://haacked.com/archive/2007/08/21/i-knew-how-to-validat...
Comment linking /archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx/
on “Falsehoods programmers believe about email”Submitted Lessons from a Startup Pivot as a story · 39 points
HN discussionYup, this is also known as the Honeypot Captcha technique: http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx
Comment linking /archive/2007/09/11/honeypot-captcha.aspx
on “Worst CAPTCHA Ever”Submitted ASP.NET MVC 1.0 Released as a story · 34 points
HN discussionReturning just an array from a json-endpoint that may contain sensitive data is a vulnerability: http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-js... (edit: may be mitigated in newer browsers)
Comment linking /archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx/
on “Microsoft REST API Guidelines”Submitted Honeypot Captcha (2007) as a story · 33 points
HN discussionIf the attacker knows the structure of the reply, `__defineSetter__` can be used to extract the JSON content as well. From [0]: <script type="text/javascript"> Object.prototype.__defineSetter__('Id', function(obj){alert(obj);}); </script> <script src="http://example.com/Home/AdminBalances">/*Boom*/</script> [0]: http://haacked.com/archive/2009/06/25/json-hijacking.aspx/
Comment linking /archive/2009/06/25/json-hijacking.aspx/
on “Why does Google prepend while(1); to their JSON responses?”Submitted Should Remote Compensation Be Tied to Location? as a story · 18 points
HN discussion- Daniel Lemire: https://lemire.me/blog/ - Andrew Lock: https://andrewlock.net/ - Steve Gordon: https://www.stevejgordon.co.uk/ - Scott Helme: https://scotthelme.co.uk/ - Phil Haack: http://haacked.com/
Comment linking /
on “Ask HN: Great Blogs by Programmers”Submitted Is It Too Late To Change JSON? as a story · 18 points
HN discussionThese are all valid email addresses! * "Abc\@def"@example.com * "Fred Bloggs"@example.com * "Joe\\Blow"@example.com * "Abc@def"@example.com * customer/department=shipping@example.com * $A12345@example.com * !def!xyz%abc@example.com * _somename@example.com http://haacked.com/archive/2007/08/21/i-knew-how-to-validate...
Comment linking /archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx/
on “Regex 101”Submitted Platform limitations hurt .NET as a story · 13 points
HN discussionYet those tools are full of bugs as well as culturally blind and prudish assumptions. Hint: try signing up with the address null@null.com - https://blog.jgc.org/2010/06/your-last-name-contains-invalid... - https://haacked.com/archive/2007/08/21/i-knew-how-to-validat... - https://fosdem.org/2018/schedule/event/email_address_quiz/
Comment linking /archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx/
on “Complexities of e-mail validation logic”Submitted JSON Hijacking - vulnerability in some GET situations as a story · 9 points
HN discussion
