工具与资源github.com
淘气字符串：容易引发用户输入问题的字符串清单
Naughty Strings: A list of strings likely to cause issues as user-input data
2015 — 2020，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这是一个 GitHub 仓库，收录了大量容易让程序出问题的用户输入字符串，如特殊字符、emoji、SQL 注入片段、系统命令等，供开发者用于测试输入处理逻辑。它多次登上 Hacker News 首页，是软件测试领域的知名资源。
为什么经久不衰：用户输入的边界情况永远存在，这份清单是现成的测试素材，多年来被开发者反复引用，今天做输入校验和测试时依然实用。
HN 评论精选
作者自述：项目本质简单，但意外地广受欢迎
仓库作者：抱歉 BLNS 更新不多。虽然它有 1.23 万 star，但本质上就是一个基于好点子的 .txt 文件，没什么可改进的（我甚至因为它的热度太离谱，把维护经历从简历里删掉了）。
minimaxir查看英文原文
Creator/Maintainer of the repo here. I apologize for the lack of updates to the BLNS. (since I'm free today and this is on the HN front page, I'll do a cleanup pass). Even though it's a GitHub repository with 12.3k stars, there's not much to say or improve on what is effectively a .txt file based around a good idea (I recently removed mentions of my maintainership of the BLNS from my resume for that reason, despite its crazy popularity).
真实案例：姓氏 Echo 被系统误当 shell 命令拦截
建议加入常见的 Unix shell 命令。我之前工作时有位客户姓 Echo，结果无法完成购买——信用卡处理系统把他的名字当命令拦截了。
chiph查看英文原文
You might want to include common unix shell commands. At a previous job we had a customer with the last name of Echo who wasn't able to make a purchase. Turns out our credit card processor blocked them.
冷知识：mocha: 协议与 Yahoo 的防钓鱼趣闻
今天学到：mocha: 是 Netscape Navigator 用来执行 URL 的自定义协议（相当于 javascript:），Yahoo Mail 曾把它替换成 espresso 来防钓鱼。
bsimpson查看英文原文
TIL: `mocha:` was a custom schema that Netscape Navigator used to eval URLs (equivalent to `javascript:`), and Yahoo! Mail would replace it with 'espresso' to attempt to thwart phishing attempts: https://www.obscure.org/javascript/archives/msg01369.html https://www.cnet.com/news/yahoo-mail-puts-words-in-your-mouth/
建议用队列+监控进程的架构应对恶意输入导致的崩溃
某些字符串会让 iOS 信息应用崩溃，这很丢人。处理不可信数据的应用应该从队列读取数据，由第二个进程监控，出问题的数据可被移除，主进程崩溃后可重启，而不至于让手机系统看起来彻底坏了。
stcredzero查看英文原文
There's this recurring problem with certain strings which crash the Messages app in iOS, leaving a big hole in functionality and making iOS look pretty bad. I've pointed out that this is inexcusable for any language where you have exception handling. The standard reply to that on HN is to point out that you want the process to die once it's gone into undefined behavior, then downvote me. This puts me in mind of interviews, where I point out to the candidate that their update routine would go into an infinite loop if there was a 2 node cycle in their data. So then they give me an if statement that detects only the 2 node loop. I've even then asked what would happen if there was a 3 node loop, and gotten a 2nd if statement for that as well. Apps which might crash due to processing untrusted data should be reading that data from a queue. Then a 2nd process can monitor the 1st process, taking problematic data off the queue if necessary. This way the 1st process can die, but be restarted, and your smartphone OS doesn't have to look completely broken due to a primary function just dying, requiring the user to reboot. I hope someone tells me Apple has already done this. It's been something approaching a decade, at this point.
历次讨论
同类还值得读
直接在浏览器中启动 Linux 内核
Boot a linux kernel right inside your browser.
Fabrice Bellard 的 JSLinux 页面，用 JavaScript 在浏览器里启动一个 Linux 内核，并提供一个可交互的终端环境。
工具与资源上首页 5 次 · 2011–2025bellard.orgHacker News 未公开功能与行为清单（2018）
A List of Hacker News's Undocumented Features and Behaviors (2018)
数据科学家 Max Woolf 整理的 Hacker News 未公开功能与行为清单，涵盖投票机制、排名算法、账号惩罚等社区运作细节。
工具与资源上首页 5 次 · 2019–2025github.comMapSCII：在终端中用盲文和 ASCII 渲染地图
MapSCII – Braille and ASCII map renderer for the console
MapSCII 是一个在命令行终端里渲染地图的开源工具，用盲文字符和 ASCII 字符把地理数据画成可交互浏览的字符地图。
工具与资源上首页 5 次 · 2017–2025github.com顶尖大学的免费在线课程
Free Online Courses from Top Universities
Open Culture 整理的一份免费在线课程合集，汇集了全球顶尖大学（如 MIT、斯坦福、耶鲁等）向公众开放的网络课程资源，涵盖音频、视频等多种形式。
工具与资源上首页 5 次 · 2010–2022openculture.com探索不到 1 美元的各类微控制器
Exploring different microcontrollers less than $1
Jay Carlson 对单价 1 美元以下的数十款微控制器（涵盖 8 位 AVR/PIC、16 位 MSP430、32 位 ARM、ESP8266 等）所做的系统横向评测：逐一…
工具与资源上首页 4 次 · 2017–2022jaycarlson.net