The origins of XXX as FIXME | Hacker News Reader

The origins of XXX as FIXME

snellman.net

195 pointspanic86 comments

Personally, I can't stand XXX as a comment prefix. It is semantically null as far as I am concerned. Just looking through the comments here shows several different possible meanings: FIXME, HACK, TODO. But I've seen it alongside all of FIXME, HACK, NOTE, TODO, BUG, ATTN, as a complete separate and distinct type of comment prefix.

Is it an actionable indicator or a explanatory indicator? What is its relative priority or importance among the others?

At least with all the other prefixes I listed it is dead clear what is actionable and what is explanatory. Better still there is an obvious priority albeit slightly ambiguous. Is TODO a higher priority than FIXME? But that can be addressed in a section of the README if necessary.

The other problem is allowing XXX in the code base allows for a catchall cop-out. Instead of giving the comment some semantic meaning just use XXX and let somebody else figure it out. That somebody could even be you in a few years. In one particular code base that had a few other prefixes the XXX were by far the dominate prefix, presumable because of a catchall cop-out slippery slope.

In any case, I think XXX should be dropped in favor of prefixes with some semantic meaning.

I use XXX to mean note/attention.

I do so because "NOTE" on it's own does not "scream loudly enough" to me when I read it, and as for "ATTN" I associate that with the writing on a letter when you want to send it to a specific person in an organization.

Here are a couple of examples from my own code:

https://github.com/eriknstr/TEMPer2-getdegs/blob/cfde4306623...

    // XXX: Feels a bit stupid to check user_set_iterations each iteration.

https://github.com/eriknstr/klondike/blob/d33accd6965d8d2476...

    // XXX: https://bugs.chromium.org/p/chromium/issues/detail?id=615638

https://github.com/eriknstr/interweb/blob/6c2985f8d8a9d63d08...

    #
    # Domain and records to update with the current WAN address of the router
    #
    # XXX: First record must expose origin server's IP address.
    #      This is by design because I need to be able to
    #      log onto my machine remotely using SSH
    #      so having a DNS name for the IP of the host
    #      makes more sense than not having it.
    #
    #      If this is not acceptable to you, then this script
    #      is not suitable for your use-case.
    #

I do the same with XXX. There is no sense of urgency but still acts as a placeholder that stands out. I use it to record a thought:

   // XXX: There must be a cleaner way to implement this

or call on someone (most likely myself) to replace with a NOTE clarifying why an out of place snippet of code is needed or verify it came be removed completely

    // XXX: Is this check still relevant?

Maybe YYY as in, "Why, why, why did you implement it in this way?!"

Faces stiff competition from the more standard WTF

YOY is sometimes appropriate.

YOLO for "I have no idea how or why this works (it might not even work for all cases)"

That's more for a Do Not Fix label: http://catb.org/jargon/html/magic-story.html

FIXME and TODO are my preferred greppable comment prefixes. One denotes a problem, one denotes a lacuna.

And I'd agree: XXX deserves to be dropped due to lack of semantics.

Most of my comments while I'm developing aren't FIXMEs or TODOs - sometimes just state, sometimes just tracing, ...

Trying to figure out semantics for all those scenarios seems like a waste of brain cells - I'll stick to XXX since it is both grep-able and easy to see.

I'm a big believer in Developer autonomy - so I hope everybody can do whatever works for them.

I use XXX as a temporary thing to grep for in my working copy of the code, representing a note to myself while I'm working on a feature; explicitly distinct from TODO / FIXME which I might commit to the repository with a more coherent comment for other people to read

I do the same, as do others on my team. If we see an XXX in code-review, then we know someone commited something they didn't mean to.

IMHO it didn't mean anything, just like when you're logging to console a lot and you want to quickly mark/separate something quickly, you're maybe adding bunch of '======', similarly XXX is just a quick mark to go back - so it's easy to find it - and sort something out there.

I think it was used more in days when we didn't have meta-comments - comments that ide is smart about now (FIXME is highlighted, indexed etc).

Novadays I'd use it in the code that really needs to be fixed because it smells. I wouldn't get offended when team member would say - don't use XXX, use FIXME or TODO only - because XXX'es shouldn't leak to commits anyway.

That's my opinion/gut feeling.

the point is that it's all of the above, and when doing housekeeping, can be referenced in a single grep/search.

it condenses the efficiency of action.

always be lazy.

At my company we tend to use "NOTE:" just to be aware of something, "XXX:" when something's functional, but has room for improvement, "TODO:" when functionality's missing, and "FIXME:" when it's plain broken.

In that context the XXX's are kinda nice to have... we can mark there's something to work on; but only search for TODO/FIXME when looking for things that will actually impact currently needed operations.

Symbolic tags

grep -r '\bXXX\b' corporate_code_base

Versus semantic tags

grep -r '\b(FIXME|TODO|NOTE)\b' corporate_code_base

And that is before you discover two new semantic tags in a single bug fixing dive.

Premature categorisation is a fundamental error, which will have repercussions down the track.

Is \b a new thing to grep? I think you'll need egrep anyway for the alternation pipe symbol. And I'm surprised \b works too.

Rather than \b you can just use -w (whole word option).

If those fail, then traditionally grep used \< and \> to mark beginning and end of word respectively.

Clearly, we need to use header files to define our semantic comments as types with inheritance.

Interestingly, I've seen XXX used as the attention marker before a semantic prefix (and on its own when there isn't really one), i.e. as a sort of 'NB:' - so

    # XXX FIXME - blows up if $x is negative

    # XXX HACK - don't even ask

etc. etc. and then XXX on its own to mean "if you're skimming this code you really should read this comment but it doesn't fit a specific semantic category very well"

I use it as a bookmark. It's a lot easier to type than FIXME or HACK. Like when I have to jump to the top to copy paste a block of code; type 'XXX' at current spot, jump elsewhere and do whatever, then Ctrl-S and 'XXX'.

I'm sure someone will point out that there are proper bookmarking commands in their favorite environment but I like not having to remember those, and this works in pretty much any editor/IDE.

  In any case, I think XXX should be dropped in favor of prefixes with some semantic meaning.

I use XXX when there's no obvious tag. Some things require attention or consideration at some indeterminate point in the future, but aren't bugs or hacks, and might not necessarily even need to be changed. They're just... a big fat question mark that you or somebody else might want to circle back around to.

Every programmer knows that naming things can be a tremendous tarpit. The only thing more tedious than choosing the best name for something is choosing a subtly misleading name which subsequently leads you or someone else on a wild good chase or possibly to fixing things (and accidentally breaking things) that never really needed to be fixed as long as the situation didn't change.

XXX is just the right convention precisely because it's so nebulous. NOTE doesn't work because something marked XXX isn't just locally descriptive, it's also a global marker that deserves to standout. WARNING doesn't work because that signals danger and hints that you may have done something suspect. But XXX doesn't necessarily mean code is suspect, it can be that it _might_ be suspect or that it _might_ be unnecessarily complex. ATTN is maybe the closest fit, but 1) isn't sufficiently loud and 2) lost out to XXX anyhow as a convention.

IME XXX is usually either 1) something that deserves reconsideration, and here's why ..., or 2) I'm too busy writing correct code to worry about the best description here, but here's a marker and possibly a sketch of a description for your future benefit.

Other than NOTE, I use XXX far more often than BUG or TODO. Committing a BUG comment is, I think, just poor discipline. If you know there's a bug, fix it or disable it.[1] I rarely use TODO inside code, but rather usually only in header files. That is, I use TODO to mark planned extension points. Inside implementation code I personally find TODO to be not much better than BUG, though reasonable people can certainly disagree on that point.

[1] I understand that sometimes neither fixing nor disabling is a realistic short-term option, especially in the corporate world. That doesn't make it any more excusable, though, especially if its your bug. And if you can actually get the BUG comment committed upstream one must wonder exactly how difficult it would have been to get an actual fix or mitigation upstream.

Instead of XXX I just write YOLO. I've only done that a couple times.

I'm pretty sure that use of 'xxx' predates computers as a stand-in for "some stuff". Like a Kleene star before regex existed.

To me it seems uninteresting, and perhaps even misleading, to try and find the 'first use of xxx' on computers.

I started using "XXX TODO" in college 20 years ago and I don't remember ever seeing it anywhere, it was a natural thing to do. I occasionally had "todo" in comments and code I wanted to fix very soon, and adding the 'XXX' was the easiest thing to add to make it searchable with no false positives. For whatever reason it seemed like an obvious thing to do. It's possible I picked it up somewhere, but I wasn't reading much code, there was nowhere near the access to public repos then that there is now. I'm pretty sure I invented it independently along with many other people.

> Why he chose to switch to the rather inconvenient XXX from ### is unclear.

I don't understand this comment... XXX is easier to type than ###. Caps lock works for X's and not for #'s. Even when using the shift key, X is a shorter throw than #.

XXX is also easy to recognize visually in printed text. It stands out well and through convention it has become clearly recognizable as such a placeholder.

I first saw as a it in drafts of memos and reports when such items were circulated on paper through cubby holes. This was Long before I saw it applied to source code - say '73-75 time frame.

The inconvenient part of XXX are the false positives when searching.

I don't buy the independent discovery idea (despite also thinking at one point that XXX was just my personal convention). When you pick up something through osmosis, you don't remember the exact source where you learn from. If this really was something that programmers just do naturally rather than learn, the programmers of the '60s and '70s would have been doing it too, and there should be some traces of it in the record. But at least I can't find those traces.

> I don't buy the independent discovery idea

That's fair -- and like I said it could have happened. If I did pick it up, I'd be willing to bet it came from print sources and not computer sources. Using Xs as a placeholder is absolutely commonplace. But I remember sitting at my computer and searching for TODO, and then trying a few things before settling on XXX TODO. I tried "TODO TODO" and "(asterisk)(asterisk)TODO(asterisk)(asterisk)" and stuff like that... XXX TODO was simpler to type and easier to see.

What I don't really buy is that this is a "discovery" at all. This doesn't seem worthy of attribution as a thing, not as a meme or as something that stands out as particularly useful or particularly widespread either. There are a bunch of conventions for TODO comments, and XXX isn't everywhere by any stretch.

The kind of thing that I know I picked up elsewhere is 0xDEADBEEF, and that's the kind of thing that feels more worthy of investigation & attribution to me.

I'm actually pretty convinced of multiple independent 'discovery'. The available annotated historical record we get to look at is tiny and drawing conclusions from it seems almost as problematic as doing the same from personal memory.

I didn't read much existing codebases and started doing it myself. I probably stuck with it because vim does visual highlighting of TODO/XXX/FIXME/etc., but I definitely picked it as a searchable "I'm not going to reuse this string of characters" marker.

> The inconvenient part of XXX are the false positives when searching.

Would you mind elaborating what kind of source code contains numerous triplets of the uppercase character "X" and why?

I have never seen such code other than produced by extremely inexperienced programmers/students with no imagination to naming symbols and ending up with "x", "xx", "xxx" variable names; even those cases will most likely not be all uppercase.

There's several good examples early in the article. Mostly, they end up in comments, where they're used as templates (e.g. "a social security number is of the form XXX-XX-XXXX").

mkstemp - http://man7.org/linux/man-pages/man3/mkstemp.3.html

When defining fields in COBOL, you use a series of 'X' or '9' to denote the field type (alpha or numeric) and the length.

I remember using asterisks for this instead of XXX or ###.

> Why he chose to switch to the rather inconvenient XXX from ### is unclear.

then why didn't Bill Joy replace his ### comments with XXX in that commit? Now he has to search for both ### and XXX. That suggests he might have been using ### and XXX as warning comments, not grep breadcrumbs.

I learned XXX as a placeholder for FIXME from a scientist who learned to write physics papers in the 1980s. I believe he learned it from someone trained in the early 70s. It flows well in text: "The measurement performed by XXX in 1985 observed the same effect, but at the XXX-confidence level."

I solve the XXX-as-stand-in-for-foo degeneracy by adding priorities to my XXXs: XXXRC, XXXMA, XXXMI, for release-critical, major, and minor bugs.

A simple grep | wc shell script allowed rudimentary but extremely flexible bug-tracking when I was writing up my thesis.

For journalists, the placeholder typically taught is "TK" for fact-checking later, as in "The youngest president was TK years old."

Why "TK"?

Stands for "to come" https://en.m.wikipedia.org/wiki/To_come_(publishing)

Theory is that TK was a less common letter combination than TC.

(The agony of using 'TC' when you code in tcl, use tcpip, or are working with terminal control code)

In case anyone is curious, like I was:

  $ grep -i tc /usr/share/dict/words | wc -l
      1055
  $ grep -i tk /usr/share/dict/words | wc -l
        40

I've always interpreted XXX to be the same as HACK rather than FIXME, as per Java's coding standards:

"Use XXX in a comment to flag something that is bogus but works. Use FIXME to flag something that is bogus and broken."

I hadn't heard this before, I found a doc here - is there something more recent? http://www.oracle.com/technetwork/java/javase/documentation/...

Not that I know of, that's where I found the exact quote I used...

Yeah, that's the way I've been using it too:

FIXME - something is there, but it doesn't work

TODO - something that needs to be there but isn't yet

XXX - something is there and works, but should be cleaned up.

Ditto, to me XXX is a near synonym of HACK.

But they have slightly different connotations. I'd use HACK for something that works, and is maybe even elegant, but potentially fragile due to a lack of generality. XXX on the other hand is something that works, but is inelegant or violates good design principles - basically a "clean this up if you get a chance" marker.

Personal anecdote: I use "XXX" as a marker for "you must clean this up before committing/publishing", similar to "DO NOT PUBLISH" in a CMS. The reason I do this is because it visually stands out well when scanning through the output of `git add -p`.

When used in that form it satisfies all the author's concerns, as it's just a marker to myself that presumably needs no other context (as I usually mark and resolve within a few hours).

Ive always treated XXX like a sentinel that should be grepped for before committing code. Its really just temporary garbage that shouldnt pollute the repo. The fact that my editor highlights XXX by default is the reason I keep using it.

I'm using it like that too. Another reason is that typing /XXX is faster than /FIXME.

This is also what i do (although only as of a few weeks ago!). I've added the check into my standard Git pre-commit hook:

https://bitbucket.org/twic/devtools/src/762878a5f3d9c83ffa2a...

I hate XXX as a placeholder for FIXME or TODO. There is no indication about its importance or meaning:

  XXX temporary variable

Doesn't tell me, "hey, you should replace this temporary variable". If it did have a better comment, then it would be better, but still doesn't literally say FIXME!

I use TODO for things that are potential performance, memory utilization, or design issues.

FIXME I reserve for things that really should or must be fixed prior to a release. These include security issues, rare bugs, or improperly handled exceptions.

Most editors now have plugins that also match on TODO and FIXME which draws your attention to them in the code.

Cant find the source now, but I read a theory that the origin of XXX is due to old movies and cartoons that shows poison in a flask with the "XXX" label, and it was used in programming to mark "poisonous code".

I have used XXX (and ZZZ) in my own code because they are the only tokens that satisfy these 3 things.

1. It stands out clearly visually in the code.

2. It is not normally a keyword, variable or string in my code.

3. I can type it quickly and comfortably using only my left hand and two fingers, while my right hand controls the cursor to navigate (or is moving to the keyboard after cursor navigation).

I usually start typing it during the interval as my right hand begins moving left over the keyboard to prepare to type the comment that will follow.

I suspect XXX and ZZZZ are not simply conventions that are picked up by exposure to other people's code, I think they represent a local maximum of convenience for these three criteria.

Try typing any other token (e.g. TODO) and see if it satisfies these criteria as well as XXX or ZZZ.

In older windows NT code — within the OS itself, not applications — doubling was common, so comments would have BUGBUG, HACKHACK, CHECKCHECK or similar. IIRC these were globally cleaned up in the Longhorn (vista) timeframe

Maybe this was part of Cutler Normal Form, but it's been over 10 years, so my memory is hazy

Like "Built on Windows NT Technology" which expands to "Built on Windows New Technology Technology." I believe this appears during the install of XP.

I'm with the author on XXX being a crappy thing to grep for, too many false positives. When I got to Sun and was hacking the kernel, I settled on LMXXX, that was fairly unique. Haven't looked in a while, but there used to still be some in the Solaris UFS code (not exactly proud of that).

tl;dr: use your initials plus xxx and you can find 'em.

Google's coding style guide calls for TODO comments to include the author's username, like `TODO(username)`, for future blame attribution:

https://google.github.io/styleguide/cppguide.html#TODO_Comme...

Internally this is now discouraged; preferred is TODO(b/12345678), where b/ is the shortcut for our internal bugtracking system.

Probably a silly question, but what's the "obvious reason" for using XXXYYY in this paragraph?

"Some DEC code seems to have gone really overboard with this, with single source files having half a dozen different XXXYYY identifiers. (Sorry, had to use YYY as the placeholder there for obvious reasons)."

Perhaps XXX001, XXX002, XXX003 and so on?

By my reading, that parenthetical comment is implying that the author initially considered "XXX" as a placeholder for the letters coming after a literal "XXX" in the DEC source code, but couldn't use "XXX" as a placeholder because it's also being used literally as the prefix, so "XXXXXX" would not demonstrate what the author was trying to communicate (that the DEC code in question had many instances of the letters "XXX" followed by three other letters).

The standard placeholder would be to use "XXX" instead of "YYY" but "XXXXXX" is semantically ambiguous in this context.

My own habits leave me wondering if the use of C-s as a search command in text editors is related to the semantic consolidation that Snellman sees of 'XXX' as a 'FIXME' synonym.

In a lengthy file where I will repeatedly need to jump back to a particular spot, I tend to leave a 'xxx' comment in that place until I'm done.

I believe I ended up doing so largely because `xxx` is unlikely to appear anywhere else, and thus, with a habit of pressing C-s as a left-handed chord, it becomes efficient to hit `x` three times and then C-s through instances as needed.

Any place where such a reference marker was left in the code would indicate that the code editor knew he needed to return to that point, making it likely that a verifiable but non-fatal flaw could be found in the code there, reinforcing the association with a 'FIXME' semantic.

FWIW, I use XXX, and I've never come across an instance where XXX was anything but a FIXME/TODO. It doesn't show up in any project I've worked on, in the ways the author exhibited. e.g. IP addresses usually use lowercase xxx, if they use letters at all. I see a lot of network-related code, and XXX is just not a thing I see, outside of comments.

But, really, I don't have strong opinions. My editor can highlight anything I want to use for this purpose, and I think they're all (XXX, FIXME, TODO) pretty universally recognized as meaning "This code is kinda ugly, and we ought to do something about it." which is maybe enough granularity in the code itself when we already have ticket trackers, source control, unit tests, etc.

From my experience and use XXX is not FIXME. XXX means something requires attention but does not necessarily imply it being broken. For instance an important line could be marked at that. Often it does imply that something should be refactored however.

I wonder how old the author is. I "knew" the XXX convention was from CSRG, and Bill Joy would have been my first guess. I expect most people who worked with Unix in the '70s or early '80s would have guessed the same. I read a lot of Bell Labs Unix source, never saw XXX, and immediately noticed it when I got my first BSD tapes, especially in areas where Joy had worked. (BSD 4.1c, I think.)

In another 30 years, this would be interesting archaeology, since hackers of that generation will all be dead. But today, it's just "ask somebody over 60 if they remember."

Over 50 will do. I also "knew".

If we want our kids to grow up as good coders, we need to remove all the XXX content from our codebases.

I suspect that the reason for switching from ### to XXX is that grep ### requires quoting in the shell.

I like that theory!

For some reason, I use "zck" (my initials) for meta-comments in code, mainly instead of "TODO", but also for TODOs that aren't just code, as in (https://bitbucket.org/zck/zpresent.el/src/08ae558834c25ebca8...):

After a comment explaining some math:

    ;;Add one here so that we round away from zero. We want to have more whitespace on the left than the right side.

I then have a comment to think about if that makes sense to do:

    ;;zck is this what's wanted?

I haven't set up the rules for doing this explicitly, but have a pretty intuitive understanding as to when I should do this. In some ways, this is instead of using a real issue system -- which I also do, but not for everything.

I use my initials when I'm getting to grips with a new code base. It's not for committing, just as an aid when I'm jumping around following the code.

For me: XXX is for putting into log messages you want to grep for while debugging. They get commented or turned into useful log messages before committing/merging.

Edit: I have never used them for comments... Those either have TODO/FIXME or are (hopefuly) useful explanation of the high level task the code is trying to accomplish

When you make a mistake on a typewriter with no delete key and no white-out handy, you could back up to the beginning of the error and type "XXXXX" over everything and start anew on the following word or line.

Someone likely carried this forward as an indicator of a mistake (ie. "hacky") and then it stuck from there.

"See Page XX" was such a common typo in early D&D books, where someone forgot to update a page number reference, that there is a RPG blog called "See Page XX":

http://site.pelgranepress.com/seepagexx/

I personally use XXX all the time; but I tend to use it in places where perhaps ATTN or NOTE would be more explicit.

It may be simply an artifact of other code in the past; when I switched to vim ~10 years ago I noticed XXX was specifically highlighted along with FIXME and TODO and so I used it as a third option: here's something that doesn't need to be fixed, isn't really a todo, but you should read and understand.

Interestingly, I just did a quick check in vim to see which prefixes were highlighted and ATTN / HACK were not, but the usual suspects (BUG, FIXME, TODO, NOTE, XXX) were. I should probably use NOTE in most places that I currently use XXX...

I prefer to use an XXX comment to mark temporary code when debugging a specific issue. It's an easy reminder to myself that it should be removed when I'm done.

Interesting, I've never seen any XXX that was deliberately put into code and not just forgotten to be removed before a commit.

I'm equally likely to put asdf or www or aaa or yyy. Just to grep in debug output when doing println debugging.

Another reason why I put XXX, FIXME or TODO is to be able to rgrep later easier - I want to avoid any kind of subtext which may occur inside variable names etc. so XXX satisfies this.

I personally use NO_RELEASE and TODO, the former can't pass the release script (such as isLicensed=true), and both are brightly colored keywords in IntelliJ. Am I alone?

You are not alone. I've never even seen XXX used in the 20+ years I've been slinging code. TODO is by far the most common, FIXME once in a while. I like NO_RELEASE as a concept, but I haven't seen that.

Same here. 20+ years professional experience with a bunch of different companies, industries, languages, and locales. TODO/FIXME are the only ones I'd consider universal, and I have literally never seen anyone use XXX. I don't doubt that people use it or even that it's common, I'm just confused as to how I could've missed it. Maybe it's not as common as everyone here thinks? Or maybe it's common in corners of the industry that I haven't spent much time in (like web development). No idea.

Asked wnj about this (pointed him to the original post and this thread).

His response: 'XXX doesn’t mean TODO, it means “should be better, fix it later”'

I use

   ***TEMP***, 
   ***NEEDS WORK***, etc.

Those you can find with grep.

(HN needs less broken Markdown.)

I would never willingly use XXX in code, for one simple reason: it's an abbreviation for pornography. All other arguments against it (and I think they're good arguments) would be dwarfed by the brief but squicky feeling I've gotten whenever I've encountered one of these tags in a codebase.

I don't have any particular issue against other sequences of X's run together, but that particular one is off-limits as far as I'm concerned.

haha, yes!

Reply on news.ycombinator.com