Magic strings are not to be uttered

[dreeves]

### Desiderata
- [ ] Have someone read a draft
- [ ] Keywords/tags
- [ ] Title image
- [ ] Link preview excerpt
- [ ] Publish
- [ ] Blog blurbs
- [ ] Waggledance
- [ ] Tweet
- [ ] Tip of the day
- [ ] Anki the URL?

A magic spell is an incantation that, just by being incanted, makes something happen in the physical world. You say "avada kedavra" and someone dies -- that sort of thing. Did you know that's a literal real thing in programming and it's called a magic string? We use them in Beeminderland occasionally. The source document from which this blog post was generated uses them. That means that I absolutely cannot tell you what those magic strings are in this blog post. If I did it would literally break the blog and you would not be reading these words. Sounds dangerous, you say? Kind of! But it's pretty ok with a couple ground rules:

1. Only pick a magic string that can never possibly be uttered accidentally.
2. Treat magic strings with some reverence and don't casually type them out if you don't mean to invoke them.

Like how in the Harry Potter universe people refer to "the killing curse" rather than actually utter "avada kedavra" in casual conversation.

(Is there any more to say than this? Greppable errors is slightly related. Also this was empirically highly non-obvious, so maybe it's worth blogging even if this short?)

Cognata

• 346

• 212

• 205

Verbata: don't accidentally invoke magic, dark magic, in-band signaling,

[narthur]

@dreeves Is this something like just adding a check to ensure [begin/end magic strings] aren't ever in final post output?

[dreeves]

No, but I might need a whole blog post to explain it and it might just be dumb.

Now you've got me thinking about that blog post. Brainstorming:

[moved to top-level; i guess this gissue is a blog post candidate now]

[dreeves]

Robert Perce:

the usage of "magic string" that i'm familiar with (a string constant that must simply be Known, for which the compiler can't help you) does not seem to line up with most of that description, so maybe i'm not sure about the thing you're talking about

DREEV: ah, fair. i'm talking about a subset of that where you count on the magic string's uniqueness. like having a special string to mark end-of-file and if you happened to use that string in a file then everything would break.

ah! i think you should work in the phrase "in-band signalling", then, and also mention famous failure cases:

• +++ATH0
• quotes in sql-injected user input
• EOT in user input

maybe something like "in many piece of media, wizards communicate spells by learning them backwards, or with the words shuffled around. That's how control characters must be talked about: I can tell you that 'the contents of my string are represented in ascii by bytes 98, 101, 101, 0, 109, 105, 111, 100', but I can't (in many languages) actually print that string out, because the NUL in the middle (another name for the-character-represented-in-ascii-by-byte-0) indicates end of string."

and a good opportunity to contrast with out of band signalling, e.g., "sql queries using ?" & the fact that in, e.g., C., if you get the value of EOF it's bigger than a byte so it's not possible to have an (ascii-encoded) file that attempts to contain an EOF.

[dreeves]

[narthur]

@dreeves I just took the DEV label off this issue, since it seems to be more of a blog post idea than anything at this point. Let me know if it should be re-added.