Hooks

A program consists of many processing steps that run in a fixed sequence. Sometimes you want to insert something of your own at one of these points. A hook is exactly such a prepared entry point. You place your own instruction there, and the program calls it automatically as soon as it passes that point. The English term means exactly that: a hook, as you hang your own code into the flow of a foreign program. Importantly, you don’t need to modify the foreign program to do this.

Why hooks make software extensible

Large programs are rarely written by a single team. A browser, an online shop, or a word processor is meant to be extensible from the outside. Without hooks, anyone wanting to add something would have to cut open the original code. That’s risky, because all changes would be lost with the next update. Hooks solve this problem elegantly: the manufacturers define at which points foreign code is allowed to attach.

This gives rise to entire extension ecosystems. An ad blocker in a browser attaches to the moment a website is loaded. A billing module in a shop system attaches to the moment an order is submitted. Neither extension knows the rest of the code, nor does it need to.

There is, however, a downside. Anyone who attaches to a central point can cause a lot of damage there. A slow hook slows down the entire program, a faulty one crashes it. Malware also uses this technique to secretly read keyboard input. That’s why modern operating systems strictly restrict who is allowed to attach where.

From event to attached code

Technically, this works through registration. The main program maintains a list of events, such as “file was saved” or “user clicked”. An extension registers its own function there, i.e. a small named section of code. When the event occurs, the program works through its list and calls all registered functions. Afterwards, it continues with its actual task.

Some hooks are only allowed to observe, others are allowed to intervene. A pure observer, for example, writes a line to the log. An intervening hook can modify data along the way or abort the process entirely. In a shop system, this allows an order with an invalid address to be stopped before it is saved.

A related term is the application programming interface, or API for short. With an API, I actively call the foreign program when I need something. With a hook, it’s the other way around: the foreign program calls me as soon as something happens. Experts sometimes call this the Hollywood principle, after the phrase “Don’t call us, we’ll call you.”

Hooks in AI tools, websites, and everyday devices

In AI development, hooks are everyday tools. When training a model, i.e. during the learning phase, you want to monitor progress. You attach a hook that records the current error rate after each learning step. Other hooks save intermediate states or abort the process if nothing improves anymore. Safety filters that intercept problematic responses also sit at such entry points.

On the web, you encounter what are known as webhooks. In this case, a service calls an address over the internet that you have previously specified. Payment services use this method to notify the shop of every incoming payment. Hooks are also popular in content management systems for websites, where extensions work almost exclusively through them.

In the news, the term usually comes up in two contexts. Either it’s about platforms offering developers new hooks, thereby enabling more extensions. Or it’s about security vulnerabilities where attackers have illicitly attached themselves to system processes. A common misconception, by the way, is to think of hooks as something hidden. Most of the time, they are cleanly documented and explicitly intended for use.