Top all-time · #474
Alex Gaynor
Personal blog · alexgaynor.netprogrammingsecurity
Alex Gaynor's personal blog at alexgaynor.net covers programming and security. Since 2010, 121 different Hacker News readers have linked it 189 times, most often “What science can tell us about C and C++'s security (2020)”. It is still writing: the last post was on 2026-09-07, and you can follow it by feed.
Sometimes recommended · 7 of 40 sampled comments recommend it?
Why HN links it
HN readers link Alex Gaynor's posts on memory safety, C and Rust vulnerabilities, and fuzzing, cited as evidence in debates and recommended as intros.
- Recommended for · 7 comments
- Called a good short read, a highly recommended intro, better than a project's own write-up, and essentially right.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Hi, I'm Alex. I'm a software resilience engineer. I care about building systems that work. I've worked for the government, in the private sector, and on open source. I'm based in Washington, DC.
Most-linked posts?
- What science can tell us about C and C++'s security (2020)17 people · 23 mentions · first linked 2020-05-27
- Modern C++ Won't Save Us12 people · 14 mentions · first linked 2019-04-21
- Postel's Law and the Three Ring Circus4 people · 4 mentions · first linked 2025-03-25
- Introduction to Memory Unsafety for VPS of Engineering4 people · 4 mentions · first linked 2019-08-12
- So you want to serialize some DER?4 people · 4 mentions · first linked 2025-06-20
- I Hope Twitter Goes Away3 people · 4 mentions · first linked 2014-10-30
- Challenges to Funding Open Source3 people · 3 mentions · first linked 2025-01-14
- My experience with the computer language shootout3 people · 3 mentions · first linked 2011-04-03
- The State of the News and TLS3 people · 3 mentions · first linked 2014-11-12
- /2014/jan/03/pypi-download-statistics/3 people · 3 mentions · first linked 2015-03-16
What Hacker News says?
Do either of these impress you? https://alexgaynor.net/2025/jun/20/serialize-some-der/ - using Claude Code to compose and have a PR accepted into llvm that implements a compiler optimization (more of my notes here: https://simonwillison.net/2025/Jun/30/llvm/ ) https://lucumr.pocoo.org/2025/6/21/my-first-ai-library/ - Claude Code for writing and shipping a full open source library that handles sloppy (hah) invalid XM…
Comment linking /2025/jun/20/serialize-some-der/
on “The new skill in AI is not prompting, it's context engineering”Submitted About Python 3 as a story · 564 points
HN discussionMany organizations have independently converged on memory safety being responsible for roughly 70% of vulnerabilities. So yes, still relevant and still a problem for users. https://alexgaynor.net/2020/may/27/science-on-memory-unsafet...
Comment linking /2020/may/27/science-on-memory-unsafety-and-security/
on “Why I rewrote my Rust keyboard firmware in Zig: consistency, mastery, and fun”Submitted I Hope Twitter Goes Away as a story · 395 points
HN discussionAgreed about the inability to write C, but the part about C++ is simply not true. I don't know about "better" in the general sense, but for the specific use case of the Linux kernel, Linus has identified some entirely reasonable objections (though aggressively worded) to C++: https://lkml.org/lkml/2004/1/20/20 - the whole C++ exception handling thing is fundamentally broken. It's _especially_ broken for kernels. - a…
Comment linking /2019/apr/21/modern-c++-wont-save-us/
on “Linux Rust Support”Submitted Modern C++ Won't Save Us as a story · 326 points
HN discussionSee the first paragraph here: https://alexgaynor.net/2026/sep/07/is-it-correct/ If your definition of "works" includes "doesn't have vulnerabilities", you're going to need to do more than just poke at it and add tests.
Comment linking /2026/sep/07/is-it-correct/
on “Ask HN: How to deal with shipping AI-written code you don't understand?”Submitted So you want to write a fast Python? as a story · 262 points
HN discussion"I would also like to point out that it's not a meaningful feature as templates still cannot be written in isolation by designers without a lot of previous agreed upon structure." True. I don't know of any framework that's truly nailed developer-designer interaction, though. Good, short read: http://alexgaynor.net/2010/mar/29/designer-developer-relatio...
Comment linking /2010/mar/29/designer-developer-relations/
on “I'm a designer who learned Django and launched her first webapp in 6 weeks”Submitted Modern C++ Won't Save Us (2019) as a story · 189 points
HN discussionNo, they're not. People talk about LLM-generated code the same way they talk about any code they're responsible for producing; it's not in fact the norm for any discussion about code here to include links to the code. But if you're looking for success stories with code, they're easy to find. https://alexgaynor.net/2025/jun/20/serialize-some-der/
Comment linking /2025/jun/20/serialize-some-der/
on “Grok 4 Launch [video]”Submitted Why software ends up complex as a story · 188 points
HN discussionI wrote a post in response to Costolo stepping down. Since the trendy thing is to post punditry about Twitter, I couldn't help but chime in. "On Twitter" - http://blog.higg.im/2015/06/12/on-twitter/ ---------- Also, you can make up your own mind about this: http://www.vox.com/2015/6/11/8761731/twitter-trouble-faceboo... http://lowercasecapital.com/2015/06/03/what-twitter-can-be-2... https://medium.com/@michaeledward…
Comment linking /2014/oct/30/i-hope-twitter-goes-away/
on “Twitter’s CEO Dick Costolo Is Stepping Down”Submitted PyPy is the Future of Python as a story · 172 points
HN discussionRust has a few interlocking behaviors that provide its memory safety, a few of the most important are: - The borrow checker enforces mutable XOR shared references. - The compiler does not allow use of local variables before they're assigned to, requires structs to be completely initialized, etc.. - All the builtin datastructures perform bounds checks - The compiler disallows deferencing raw pointers except in unsafe…
Comment linking /2019/apr/21/modern-c++-wont-save-us/
on “Memory safe ‘curl’ for a more secure internet”Submitted Buffers on the Edge: Python and Rust as a story · 170 points
HN discussionYou will find race condition bugs. You will not find memory corruption vulnerabilities. Go look. The argument is not about whether languages admit vulnerabilities --- all of them do. The argument is about whether they admit the vulnerabilities that motivate the term of art "memory safety". Go does not, at least not in any non-contrived scenario not involving "unsafe" or FFI. As for definitions, I like what Alex wrot…
Comment linking /2023/oct/02/defining-the-memory-safety-problem/
on “Writing secure Go code”Submitted Django and Python 3 as a story · 110 points
HN discussionA good example of the borrow-checker against data that is 100% not on the stack is crossbeam-epoch: https://docs.rs/crossbeam/0.5.0/crossbeam/epoch/struct.Guard... Crossbeam uses "epoch-based memory reclamation," a strategy for maintaining an object shared across threads without either locks or a global garbage collector. The tl;dr of the strategy is that there's a concept of "epochs," and if you update an object, y…
Comment linking /2019/apr/21/modern-c++-wont-save-us/
on “Linux kernel drivers in Rust might become an option in the future”Submitted Notes on fuzzing ImageMagick and GraphicsMagick as a story · 98 points
HN discussionTurns out, it is: https://alexgaynor.net/2019/apr/21/modern-c++-wont-save-us/
Comment linking /2019/apr/21/modern-c++-wont-save-us/
on “Rust Language Cheat Sheet”Submitted My experience with the computer language shootout as a story · 95 points
HN discussionIt launched yesterday :-) https://alexgaynor.net/2016/jan/20/announcing-letsencrypt-aw... is some tooling I wrote for use on AWS.
Comment linking /2016/jan/20/announcing-letsencrypt-aws/
on “AWS Certificate Manager: Deploy SSL/TLS-Based Apps on AWS”Submitted Chrome and Windows Exploit: Security Beyond Bug Fixes as a story · 94 points
HN discussionHighly recommend Alex Gaynor's intro to memory unsafety https://alexgaynor.net/2019/aug/12/introduction-to-memory-un...
Comment linking /2019/aug/12/introduction-to-memory-unsafety-for-vps-of-engineering/
on “More Memory Safety for Let's Encrypt: Deploying ntpd-rs”Submitted CSVs: The Good, the Bad, and the Ugly as a story · 89 points
HN discussionThere's a wrapper for CPython to get it to implement the tracing code, afl-python[1]. Alex Gaynor did a basic intro to it a few days ago which is a better write-up that the project itself has! Of course, this doesn't work so well with mixed C/Python code. [1]: https://bitbucket.org/jwilk/python-afl [2]: https://alexgaynor.net/2015/apr/13/introduction-to-fuzzing-i...
Comment linking /2015/apr/13/introduction-to-fuzzing-in-python-with-afl/
on “Finding bugs in SQLite, the easy way”Submitted So you want to serialize some DER? as a story · 76 points
HN discussionhttps://alexgaynor.net/2019/aug/12/introduction-to-memory-un...
Comment linking /2019/aug/12/introduction-to-memory-unsafety-for-vps-of-engineering/
on “Prusti: Static Analyzer for Rust”- di · 2019-11-08
Submitted On Safety Critical Software as a story · 71 points
HN discussion
