5 ms·

It's also sad that Bun is written in Zig, which has not had a proper review of the stdlib since it's not v1 yet, where Andrew has already stated publicly that Z

by junon 3y ago

It's also sad that Bun is written in Zig, which has not had a proper review of the stdlib since it's not v1 yet, where Andrew has already stated publicly that Zig should not be used in production until v1 due to security vulnerabilities in the standard lib. But here we are.

trashburger 3y ago
What security vulnerabilities, exactly?
- intelVISA 3y ago
  Many :(
- brabel 3y ago
  I've never heard Andrew say you shouldn't use Zig in production because of "security vulnerabilities", but simply because Zig is quite immature (expect bugs including segfaults in perfectly "good" code) and changing constantly, not something anyone should want in a production setting.
  - wredue 3y ago
    Honestly. In a world in which JavaScript is the number one language, I’m walking back on the idea that “instability means no good for production”. 10 years ago, I thought for sure that JavaScript devs were eventually going to get sick of breaking and deprecating changes, but they’re still going strong with picking frameworks that just don’t give a shit, switching to new breaking tool chains, etc. It seems that there are A LOT of developers willing to put up with a whole lot more than I am.
- junon 3y ago
  The one I found a while back was a DOS in UTF-8 decoding. I believe it's since been fixed but things like that given that the standard library hasn't been audited. Andrew will definitely have that happen at some point but I'd not put anything Zig into production right now, personally.
ojosilva 3y ago
Bun is currently below v1.0, so not declared production-ready either. But I'm not sure Bun should go to 1.0 without Zig going to 1.0 too. And Zig 1.0 is a distant target, which is a normal timeline for a programming language.
- bitblender 3y ago
  Bun is apparently targeting September 7th for a 1.0 release. I also have concerns about delivering a stable api using a language that doesn't have one yet.
  - ojosilva 3y ago
    Tbh I've had the same issue delivering my own 1.x software with 0.x dependencies and my argument has always been that it's my problem, not the client's, so "do not worry". Being realistic, no sw offers any guarantees and Zig's 1.0 stability is more of a "contract" than a "guarantee".
kristoff_it 3y ago
> Andrew has already stated publicly that Zig should not be used in production until v1 due to security vulnerabilities in the standard lib. Andrew has made the claim a couple years ago that Zig should not be used in production yet. The part about security is not at all part of anything he ever claimed, and is in fact only something that you went crazy about on your own. See: https://news.ycombinator.com/item?id=34669045 https://news.ycombinator.com/item?id=34669045 While I can understand holding real hard onto your opinion, please don't put words in people's mouths, especially when the person in question does not share your position on the matter at all.
- junon 3y ago
  [flagged]
  - flipgimble 3y ago
    As an outside observer without any connection to any of these project I'd recommend that you step back from posting strongly held negative opinions and reflect on your biases and assumptions here. It sounds like you are unreasonably disgruntled against zig and derailing tangentially related threads, then claiming unwarranted victimhood. We are talking about two projects (zig and bun), likely years before 1.0, and you complain they're not perfect, or improving on your timeline. Projects improve security and quality by increasing adoption and thus human resources available for auditing and fixes. You seem to be advocating against adoption, or presuming current users are uninformed about the project's status. My hobbyist-level interactions with the zig community indicated nothing by calm professionalism and enthusiasm for quality software.
    - matt_kantor 3y ago
      > We are talking about two projects (zig and bun), likely years before 1.0 This is tangential to your main point, but the post we're commenting on says this: > Bun 1.0 is coming on September 7th!
    - gardenhedge 3y ago
Jarred 3y ago
Bun uses Zig’s standard library carefully. We read the code for the parts we use (and sometimes change it locally). We also rely on mature C/C++ libraries like picohttpparser, BoringSSL, c-ares (along with the C std lib). We use lots of code from WebKit, and are starting to use more of their security features like segregated heaps
dang 3y ago
I have no idea what's driving this but it's a repeated pattern on HN and we need it to stop. No more of this, please. https://news.ycombinator.com/item?id=34675866 https://news.ycombinator.com/item?id=34675866 (Feb 2023) https://news.ycombinator.com/item?id=34675665 https://news.ycombinator.com/item?id=34675665 (Feb 2023) https://news.ycombinator.com/item?id=34669045 https://news.ycombinator.com/item?id=34669045 (Feb 2023) https://news.ycombinator.com/item?id=34439732 https://news.ycombinator.com/item?id=34439732 (Jan 2023) https://news.ycombinator.com/item?id=34138064 https://news.ycombinator.com/item?id=34138064 (Dec 2022) We detached this subthread from https://news.ycombinator.com/item?id=37246288 https://news.ycombinator.com/item?id=37246288.

by junon 3y ago

trashburger 3y ago

What security vulnerabilities, exactly?

intelVISA 3y ago
Many :(
brabel 3y ago
I've never heard Andrew say you shouldn't use Zig in production because of "security vulnerabilities", but simply because Zig is quite immature (expect bugs including segfaults in perfectly "good" code) and changing constantly, not something anyone should want in a production setting.
- wredue 3y ago
  Honestly. In a world in which JavaScript is the number one language, I’m walking back on the idea that “instability means no good for production”. 10 years ago, I thought for sure that JavaScript devs were eventually going to get sick of breaking and deprecating changes, but they’re still going strong with picking frameworks that just don’t give a shit, switching to new breaking tool chains, etc. It seems that there are A LOT of developers willing to put up with a whole lot more than I am.
junon 3y ago
The one I found a while back was a DOS in UTF-8 decoding. I believe it's since been fixed but things like that given that the standard library hasn't been audited. Andrew will definitely have that happen at some point but I'd not put anything Zig into production right now, personally.

ojosilva 3y ago

Bun is currently below v1.0, so not declared production-ready either. But I'm not sure Bun should go to 1.0 without Zig going to 1.0 too. And Zig 1.0 is a distant target, which is a normal timeline for a programming language.

bitblender 3y ago
Bun is apparently targeting September 7th for a 1.0 release. I also have concerns about delivering a stable api using a language that doesn't have one yet.
- ojosilva 3y ago
  Tbh I've had the same issue delivering my own 1.x software with 0.x dependencies and my argument has always been that it's my problem, not the client's, so "do not worry". Being realistic, no sw offers any guarantees and Zig's 1.0 stability is more of a "contract" than a "guarantee".

kristoff_it 3y ago

> Andrew has already stated publicly that Zig should not be used in production until v1 due to security vulnerabilities in the standard lib. Andrew has made the claim a couple years ago that Zig should not be used in production yet. The part about security is not at all part of anything he ever claimed, and is in fact only something that you went crazy about on your own. See: https://news.ycombinator.com/item?id=34669045 https://news.ycombinator.com/item?id=34669045 While I can understand holding real hard onto your opinion, please don't put words in people's mouths, especially when the person in question does not share your position on the matter at all.

junon 3y ago
[flagged]
- flipgimble 3y ago
  As an outside observer without any connection to any of these project I'd recommend that you step back from posting strongly held negative opinions and reflect on your biases and assumptions here. It sounds like you are unreasonably disgruntled against zig and derailing tangentially related threads, then claiming unwarranted victimhood. We are talking about two projects (zig and bun), likely years before 1.0, and you complain they're not perfect, or improving on your timeline. Projects improve security and quality by increasing adoption and thus human resources available for auditing and fixes. You seem to be advocating against adoption, or presuming current users are uninformed about the project's status. My hobbyist-level interactions with the zig community indicated nothing by calm professionalism and enthusiasm for quality software.
  - matt_kantor 3y ago
    > We are talking about two projects (zig and bun), likely years before 1.0 This is tangential to your main point, but the post we're commenting on says this: > Bun 1.0 is coming on September 7th!
  - gardenhedge 3y ago

Jarred 3y ago

Bun uses Zig’s standard library carefully. We read the code for the parts we use (and sometimes change it locally). We also rely on mature C/C++ libraries like picohttpparser, BoringSSL, c-ares (along with the C std lib). We use lots of code from WebKit, and are starting to use more of their security features like segregated heaps

dang 3y ago

I have no idea what's driving this but it's a repeated pattern on HN and we need it to stop. No more of this, please. https://news.ycombinator.com/item?id=34675866 https://news.ycombinator.com/item?id=34675866 (Feb 2023) https://news.ycombinator.com/item?id=34675665 https://news.ycombinator.com/item?id=34675665 (Feb 2023) https://news.ycombinator.com/item?id=34669045 https://news.ycombinator.com/item?id=34669045 (Feb 2023) https://news.ycombinator.com/item?id=34439732 https://news.ycombinator.com/item?id=34439732 (Jan 2023) https://news.ycombinator.com/item?id=34138064 https://news.ycombinator.com/item?id=34138064 (Dec 2022) We detached this subthread from https://news.ycombinator.com/item?id=37246288 https://news.ycombinator.com/item?id=37246288.