<story><title>The Future of Markdown</title><url>http://www.codinghorror.com/blog/2012/10/the-future-of-markdown.html</url></story><parent_chain><item><author>blasdel</author><text>John Gruber&apos;s original Markdown.pl is one of the worst small programs I have ever read, completely riddled with outright bugs and misfeatures that continually bite its users in the ass. It&apos;s awful even by the already low standards of hand-written many-pass regex-based spaghetti-parsers.&lt;p&gt;Nobody should be using the original script, and unfortunately many of the other implementations out there are direct transliterations that replicate all of its absurd errors, like where if you mention the MD5 hash of another token in the document, the hash will be replaced with the token, because it uses that as an inline escaping mechanism! Reddit got hit with a XSS virus that got through their filters because of it: &lt;a href=&quot;http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-us.html&quot; rel=&quot;nofollow&quot;&gt;http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-...&lt;/a&gt;&lt;p&gt;See the changelog for what started as a PHP transliteration and turned into a rewrite that squashed 125 (!) unacknowledged bugs: &lt;a href=&quot;http://michelf.com/projects/php-markdown/&quot; rel=&quot;nofollow&quot;&gt;http://michelf.com/projects/php-markdown/&lt;/a&gt;&lt;p&gt;The worst part is that he outright refuses to either disclaim or fix his implementation, and so far he&apos;s repudiated everyone else&apos;s attempts to do so. He&apos;s a terrible programmer and a worse maintainer, he really still thinks the documentation on his site is comprehensive and canonical. As much as Jeff Atwood leaps at every chance to play the fool, there&apos;s no way his directorship can be anything but an improvement.</text></item></parent_chain><comment><author>dandelany</author><text>I&apos;m so tired of this mentality that says basically, if you release something for free on the internet, you are obligated to maintain and support it for the rest of your life. Gruber created this program, for free. You are under no obligation to use it. Don&apos;t like it? Here&apos;s your money back. It may be true that the code is shit. If you think so, don&apos;t use it.&lt;p&gt;Like other responders, I worry that this mentality causes fewer coders to release their projects, for fear of backlash like this post. Think about it: Your feelings toward Gruber are incredibly negative and hostile, and in fact, you would have better feelings toward him if he had kept Markdown to himself and never released it at all. Does that seem fair to you? If the ill will generated by people like yourself outweighs the good will generated by those who appreciate the code I release, or if I fear that it might, what motivation do I have to release my code?</text></comment>
<story><title>The Future of Markdown</title><url>http://www.codinghorror.com/blog/2012/10/the-future-of-markdown.html</url></story><parent_chain><item><author>blasdel</author><text>John Gruber&apos;s original Markdown.pl is one of the worst small programs I have ever read, completely riddled with outright bugs and misfeatures that continually bite its users in the ass. It&apos;s awful even by the already low standards of hand-written many-pass regex-based spaghetti-parsers.&lt;p&gt;Nobody should be using the original script, and unfortunately many of the other implementations out there are direct transliterations that replicate all of its absurd errors, like where if you mention the MD5 hash of another token in the document, the hash will be replaced with the token, because it uses that as an inline escaping mechanism! Reddit got hit with a XSS virus that got through their filters because of it: &lt;a href=&quot;http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-us.html&quot; rel=&quot;nofollow&quot;&gt;http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-...&lt;/a&gt;&lt;p&gt;See the changelog for what started as a PHP transliteration and turned into a rewrite that squashed 125 (!) unacknowledged bugs: &lt;a href=&quot;http://michelf.com/projects/php-markdown/&quot; rel=&quot;nofollow&quot;&gt;http://michelf.com/projects/php-markdown/&lt;/a&gt;&lt;p&gt;The worst part is that he outright refuses to either disclaim or fix his implementation, and so far he&apos;s repudiated everyone else&apos;s attempts to do so. He&apos;s a terrible programmer and a worse maintainer, he really still thinks the documentation on his site is comprehensive and canonical. As much as Jeff Atwood leaps at every chance to play the fool, there&apos;s no way his directorship can be anything but an improvement.</text></item></parent_chain><comment><author>tptacek</author><text>What an embarrassing post to be occupying the top of this thread. Blaming Markdown.pl for security flaws? I suppose the memory corruption bugs in the &quot;optimized&quot; C Markdown parsers are somehow his fault too?&lt;p&gt;He wrote a text-to-HTML parser with a particularly elegant little language design and got on with his life, which involves writing more than keeping up with bug reports in Perl scripts. Get over yourself; comments like this make us all look bad.</text></comment>