Understanding Foobar

Open any programming tutorial and within a page someone will define a function called foo, pass it a variable called bar, and return baz. Nobody explains it. You're just expected to know these are words that mean nothing, which is exactly what they're for.

They're called metasyntactic variables: placeholder names used when the real name doesn't matter, so the reader focuses on the structure, not the label. They also have a surprisingly long history.

Where "foo" came from

It's two separate streams that met at MIT.

"Foo" shows up in the 1930s in Bill Holman's comic strip Smokey Stover, about an absurdist firefighter. The word was scattered through the panels as a nonsense gag, and the strip's catchphrase was "where there's foo, there's fire." Holman said he'd seen it on the bottom of a jade figurine in San Francisco's Chinatown, where it supposedly meant good luck. It became a popular nonsense word in the 1930s and '40s. Allied pilots in the Second World War called unexplained lights in the sky "foo fighters," which is where the band got its name.

"FUBAR" is Second World War military slang, an acronym for "fouled up beyond all recognition," with a stronger word than "fouled" in the original. It sat alongside SNAFU in the long tradition of soldiers describing the army accurately.

The two collided in the 1950s and '60s at MIT's Tech Model Railroad Club, the student group that gave the world much of early hacker vocabulary, from "hack" itself to "foo" as a filler word. As the club's members moved to the AI Lab and its computers, foo and bar came with them. "Foobar" is either a spelling of FUBAR or a joining of the two placeholder words, depending on whom you ask, and it's probably both.

It's official, too, in a way. RFC 3092, "Etymology of 'Foo'," was published by the IETF on April 1, 2001. It's an April Fools' RFC, but it's a real one, and it counts more than two hundred earlier RFCs that use "foo."

The full sequence

Most people stop at three. The traditional list goes much further:

foo, bar, baz, qux, quux, corge, grault, garply, waldo, fred, plugh, xyzzy, thud

A few have their own stories. xyzzy is the magic word from Colossal Cave Adventure, the 1976 text game, and it still does something in a surprising number of programs if you type it. plugh comes from the same game. waldo and fred have no deep meaning at all, which is the point.

Other languages have their own:

  • Python uses spam and eggs, after the Monty Python sketch the language is named for.
  • Japanese programmers use hoge, fuga and piyo.
  • French programmers often use toto, titi and tata.
  • Italian uses pippo, pluto and paperino, the Italian names for Goofy, Pluto and Donald Duck.

How to use them well

Placeholders are useful because they tell the reader "this name doesn't matter." That's also how they go wrong.

  • Use them for structure, not meaning. In a five-line example about how loops work, for x in foo is fine. In a forty-line example, for invoice in unpaid_invoices teaches more, because the reader can follow the logic.
  • Keep the order. If you use more than one, foo, then bar, then baz. Readers who know the convention will follow it without thinking.
  • Don't ship them. A variable called foo in production code is a bug report waiting to happen. So is a log message that says "bar".

Placeholders that are actually reserved

Here's the practical part that a lot of documentation gets wrong. When your example needs a real-looking domain, email or IP address, don't make one up. Made-up names often belong to someone, and a reader who pastes your example will send traffic, or email, to a real stranger. Use the ones reserved for exactly this:

  • Domains: example.com, example.net and example.org are reserved for documentation by RFC 2606, and .test, .example, .invalid and .localhost are reserved top-level domains.
  • IPv4: 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24, reserved for documentation by RFC 5737.
  • IPv6: 2001:db8::/32, reserved by RFC 3849.
  • Email: user@example.com. Nobody's inbox.
  • Phone numbers: in North America, 555-0100 through 555-0199.

So the shell example should read:

ssh admin@host.example.com
ping -c 3 192.0.2.10
dig AAAA www.example.org

The same goes for internal examples. Don't paste a real hostname from your own infrastructure into a public blog post or repository, even as a placeholder. Attackers read documentation too.

Why it's worth knowing

It's a small thing. But it's one of the threads that runs straight from a 1930s comic strip, through a model railroad club and the first hackers, into every programming language and every Linux tutorial written today. Every time someone types foo, they're using the hacker culture's oldest inside joke, and now you know where it came from.