工具与资源github.com
C 语言简单动态字符串库（SDS）
Simple Dynamic Strings library for C
2014 — 2025，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这是 Redis 作者 antirez 开源的 C 语言简单动态字符串（SDS）库，从 Redis 中独立出来并补充了完善文档。它以 O(1) 获取长度、二进制安全、减少内存重分配等特性，成为 C 字符串处理的经典替代方案。
为什么经久不衰：它多年反复登上 HN 首页，代码简洁、文档出色，是学习 C 语言 API 设计和内存管理的活教材，至今仍被广泛使用。
HN 评论精选
称赞该库的 README 是文档写作的典范
我觉得这个库很棒，但想顺带提一句：这个仓库的 README 太出色了。开头就列出优缺点？很棒。覆盖所有主要用例的代码示例？很棒。快速介绍内部实现？太棒了！两行说明如何在项目中使用？很棒。我忍不住想吐槽大家多么不重视文档——程序员似乎把'花半小时摸索一个库怎么用'当成理所当然的事。
dmunoz查看英文原文
I think the library is great, and don't have a whole lot to say about it, but wanted to mention one tangentially related thing: The README on this repo is awesome. Opening up with advantages and disadvantages? Awesome. Plenty of code examples covering all of the major use cases? Awesome. Quick overview of the internals? AWESOME! Quick two line note about how to use the library in your project? Awesome. I'm tempted to rant about how I wish documentation was taken more seriously, and that programmers seem to make it a point of pride that spending the first half hour with a library figuring out how to actually use it is just something we have to deal with as programmers, but I won't do so aside from this single sentence.
指出 SDS 在处理不可信输入时存在溢出风险，并批评其他字符串库的安全声明
混合有符号和无符号运算、算术前不做溢出检查、还把运算结果用作内存写入的索引或起点——我的直觉是，任何用这个库处理不可信输入的应用都可能被利用。当然，它从没宣传过自己是安全的 :-) 这反而少见，因为许多'更好的字符串'库都声称比传统字符串处理更安全（然后自己做得也不对）。举个例子：BString 声称用有符号整数代替 size_t 并检查结果是否为负来防溢出攻击，但有符号整数溢出在 C 中是未定义行为，不保证回绕。
clarry查看英文原文
Mixing signed and unsigned arithmetic operands. Not doing trivial overflow checking before arithmetic. Using results from said arithmetic as indices or starting points for memory writes. My gut says that any application using this library to process untrusted input is exploitable. Of course, it was never advertised as being secure :-) Which is unusual, as many "better strings" libraries make claims about the security of the traditional way of string handling (and then go on to do it wrong). Edit: To give a concrete example, someone here recommended BString just a few days ago. That library has a "security statement" in which it claims to prevent overflow type attacks by using signed integers instead of size_t, and then checking whether the result is negative after arithmetic. But signed overflow is undefined behavior in C, and these are not guaranteed to wrap around. And yes such things have been exploited. I don't know how likely or easy bstring is to "own" but in any case it's doinnit wrong. And yes I checked the code, it does what it claims to do..
作者 antirez 说明库的来源和主要改动
我从 Redis 的 sds.c fork 出来，因为它在这个项目里多年都很好用，我想在其他场景也会有价值。相比 Redis 的 sds.c 在 API 层面有一些改动，不过大部分工作花在了写文档上。
antirez查看英文原文
I forked sds.c from Redis given that it was very useful for the project for years, so I guess it may be useful in other contexts as well. There are a few changes at API level compared to the Redis sds.c file, however most of the work went into documenting it.
提出用 sizeof *sh 替代重复类型名的代码改进建议
谢谢你的贡献。代码我读得不多，但一个小建议：把 struct sdshdr *sh = (void*)(s-(sizeof(struct sdshdr))); 改成 (void*)(s-sizeof *sh)，因为整个思路就是左侧指针指向的类型决定要减去的大小，最好把类型'锁定'到指针上，而不是重复写类型名。
unwind查看英文原文
Nice, thanks for contributing (even more). I haven't read much of the code at all, but a minor suggestion would be to change: struct sdshdr *sh = (void*)(s-(sizeof(struct sdshdr))); to struct sdshdr *sh = (void*)(s-sizeof *sh); since the entire idea is that the pointer on the left-hand side is to the type whose size should be subtracted, I think it's better not to repeat the type but to "lock it" to the pointer instead. This also (of course) means we can drop the parenthesis with sizeof, since those are only needed when its argument is a type name.
历次讨论
同类还值得读
直接在浏览器中启动 Linux 内核
Boot a linux kernel right inside your browser.
Fabrice Bellard 的 JSLinux 页面，用 JavaScript 在浏览器里启动一个 Linux 内核，并提供一个可交互的终端环境。
工具与资源上首页 5 次 · 2011–2025bellard.orgHacker News 未公开功能与行为清单（2018）
A List of Hacker News's Undocumented Features and Behaviors (2018)
数据科学家 Max Woolf 整理的 Hacker News 未公开功能与行为清单，涵盖投票机制、排名算法、账号惩罚等社区运作细节。
工具与资源上首页 5 次 · 2019–2025github.comMapSCII：在终端中用盲文和 ASCII 渲染地图
MapSCII – Braille and ASCII map renderer for the console
MapSCII 是一个在命令行终端里渲染地图的开源工具，用盲文字符和 ASCII 字符把地理数据画成可交互浏览的字符地图。
工具与资源上首页 5 次 · 2017–2025github.com顶尖大学的免费在线课程
Free Online Courses from Top Universities
Open Culture 整理的一份免费在线课程合集，汇集了全球顶尖大学（如 MIT、斯坦福、耶鲁等）向公众开放的网络课程资源，涵盖音频、视频等多种形式。
工具与资源上首页 5 次 · 2010–2022openculture.com淘气字符串：容易引发用户输入问题的字符串清单
Naughty Strings: A list of strings likely to cause issues as user-input data
一个 GitHub 仓库，收录了大量容易让程序出问题的用户输入字符串，如特殊字符、emoji、SQL 注入片段、系统命令等，供开发者用于测试输入处理逻辑。
工具与资源上首页 4 次 · 2015–2020github.com