6 ms·

Clarification added later: One of my key interests at the moment is finding ways to run untrusted code from users (or generated by LLMs) in a robust sandbox fro

• simonw 11mo ago
  Down to -4. Is this generic LLM-dislike, or a reaction to perceived over-self-promotion, or something else? No matter how much you hate LLM stuff I think it's useful to know that there's a working proof of concept of this library compiled to WASM and working as a Python library. I didn't plan to share this on HN but then MicroQuickJS showed up on the homepage so I figured people might find it useful. (If I hadn't disclosed I'd used Claude for this I imagine I wouldn't have had any down-votes here.)
  • colesantiago 11mo ago
    It is because you keep over promoting AI almost every day of the week in the HN comments. In this particular case AI has nothing to do with Fabrice Bellard. We can have something different on HN like what Fabrice Bellard is up to. You can continue AI posting as normal in the coming days.
    • simonw 11mo ago
      Forget about the AI bit. Do you think it's interesting that MicroQuickJS can be used from Python via FFI or as a compiled module, and can also be compiled to WebAssembly and called from Node.js and Deno and from Pyodide running in a browser? ... and that it provides a useful sandbox in that you can robustly limit both the memory and time allowed, including limiting expensive regular expression evaluation? I included the AI bit because it would have been dishonest not to disclose how I used AI to figure this all out.
      • eichin 11mo ago
        Usually I watch your stuff very closely (and positively) because you're pushing the edges of how LLMs can be useful for code (and are a lot more honest/forthwright than most enthusiasts about it Going Horribly Wrong and how much work you need to do to keep on top of it.) This one... looks like a crossbar of random things that don't seem like things anyone would actually want to do? Mentioning the sandboxing bit in the first post would have helped a lot, or anything that said why that particular modes are interesting.
        • simonw 11mo ago
          Yeah, I failed completely to explain the context here. I'm currently on a multi-year side-quest to find safe ways to execute untrusted user-provided code in my Python and web applications. As such, I pay very close attention to any new language or library that looks like it might be able to provide a robust sandbox. MicroQuickJS instantly struck me as a strong candidate for that, and initial protoyping has backed that up. None of that was clear from my original comment.
          • Imustaskforhelp 11mo ago
            I had been in a similar boat and here are some softwares that I recommend or would discuss with you https://github.com/libriscv/libriscv https://github.com/libriscv/libriscv (I talked with the author of this project, amazing author fwsgonzo is amazing) and they told me that this has the least latency out of any sandbox at only minor consequence of performance that they know of Btw for sandboxing, kvm itself feels good too and I had discussed it with them in their discord server when they had mentioned that they were working on a minimal kvm server which has since been open sourced (https://github.com/varnish/tinykvm https://github.com/varnish/tinykvm) Honestly Simon, Deno hosting/the way deno works is another good interesting tidbit for sandboxing. I wish something like deno's sandboxing capabilities came to python perhaps since python fans can appreciate it. I will try to look more into your github repository too once I get more free.
          • claar 11mo ago
            Ah, reading this comment makes your original post 10x more interesting. I guess this is "start with why" in action. :)
  • halfmatthalfcat 11mo ago
    I downvoted because I'm tired of people regurgitating how they've done this or that with whatever LLM of the week on seemingly every technical post. If you care that much, write a blog post and post that, we don't need low effort LLM show and tell all day everyday.
    • simonw 11mo ago
      Here you go: https://simonwillison.net/2025/Dec/23/microquickjs/ https://simonwillison.net/2025/Dec/23/microquickjs/
      • halfmatthalfcat 11mo ago
        No I mean post it as an HN post and if anybody cares to see it, they'll upvote that and comment in there. That, instead of pigging backing on other posts to get visibility.
        • simonw 11mo ago
          I genuinely don't think it's interesting enough to warrant a top level post. It's interesting enough to be in a comment though!
          • yeasku 11mo ago
            And people think is not interesting enoug and downvote you.
      • lioeters 11mo ago
        I love it, I find the note interesting, educational, and adds to the discussion in context. Guess you're bound to get a few haters when you share your work in public, but I for one appreciate all your posts, comments, articles, open-source projects.
  • petercooper 11mo ago
    Your tireless experimenting (and especially documenting) is valuable and I love to see all of it. The avant garde nature of your recent work will draw the occasional flurry of disdain from more jaded types, but I doubt many HN regulars would think you had anything but good intentions! Guess I am basically just saying.. keep it up.
  • claar 11mo ago
    I think many subscribe to this philosophy: https://distantprovince.by/posts/its-rude-to-show-ai-output-to-people/ https://distantprovince.by/posts/its-rude-to-show-ai-output-... Your github research/ links are an interesting case of this. On one hand, late AI adopters may appreciate your example prompts and outputs. But it feels like trivially reproducible noise to expert LLM users, especially if they are unaware of your reputation for substantive work. The HN AI pushback then drowns out your true message in favor of squashing perceived AI fluff.
    • simonw 11mo ago
      Yeah, I agree that it's rude to show AI output to people... in most cases (and 100% if you don't disclose it.) My simonw/research GitHub repo is deliberately separate from everything else I do because it's entirely AI-generated. I wrote about that here: https://simonwillison.net/2025/Nov/6/async-code-research/#this-is-total-slop-of-course https://simonwillison.net/2025/Nov/6/async-code-research/#th... This particular case is a very solid use-case for that approach though. There are a ton of important questions to answer: can it run in WebAssembly? What's the difference to regular JavaScript? Is it safe to use as a sandbox against attacks like the regex thing? Those questions can be answered by having Claude Code crunch along, produce and execute a couple of dozen files of code and report back on the results. I think the knee-jerk reaction pushing back against this is understandable. I'd encourage people not to miss out on the substance.
      • lossolo 11mo ago
        And again you're linking to your site. Maybe try pasting the few relevant sentences instead of constantly pushing your content in almost every comment. That's what people find annoying. Maybe link to other people's stuff more, or just write what you think here on HN. If someone wants to read your blog, they will, they know it exists, and some people even submit your new articles here. There's no need to do what you're doing. Every day you're irritating more people with this behavior, and eventually the substance won't matter to them anymore, so you're acting against your own interests. Unless you want people to develop the same kind of ad blindness mechanism, where they automatically skip anything that looks like self promotion. Some people will just see a comment by simonw and do the same. A lot of people have told you this in many threads, but it seems you still don’t get it.
  • SeanAnderson 11mo ago
    I didn't downvote you. You're one of "the AI guys" to me on HN. The content of your post is fine, too, but, even if it was sketch, I'd've given you the benefit of the doubt.
  • garganzol 11mo ago
    Thank you for sharing. A lot of HN people got cut by AI in one way or another, so they seem to have personal beefs with AI. I am talking about not only job shortages but also general humbling of the bloated egos.
    • foobarchu 11mo ago
      > I am talking about not only job shortages but also general humbling of the bloated egos. I'm gonna give you the benefit for the doubt here. Most of us do not dislike genAI because we were fired or "humbled". Most of us dislike it because a) the terrible environmental impacts, b) the terrible economic impacts, and c) the general non-production-readiness of results once you get past common, well-solved problems Your stated understanding comes off a little bit like "they just don't like it because they're jealous".
    • wartywhoa23 11mo ago
      I'm constanly encountering this "bloated ego" argument every time the narrative is being steered away to prevent monetary losses for AI companies. Especially so when it concerns AI theft of human music and visual art. "Those pompous artists, who do they think they are? We'll rob them of their egos". The problem is that these ego-accusations don't quite come from egoless entities.
      • garganzol 11mo ago
        It is not about artists per ce, it is about manipulative entities. For any manipulation to succeed, one has to create a fog, disorientation, muddy waters. AI brings clarity. This results in a lot of pain for those who tried to hijack the game in one way or another. From the psychological point of view, AI is a mirror of one's personality. Depending on who you are, you see different reflections: someone sees a threat, others see the enlightenment.
        • wartywhoa23 11mo ago
          AI brings clarity. Do you mean that kind of clarity when no audio/video evidence is a proof of anything anymore? > This results in a lot of pain for those who tried to hijack the game in one way or another. I'm not quite sure if any artists, designers, musicians and programmers whose work was used to train AI without their consent tried to manipulate anyone or hijack anything. Care to elaborate?
  • alex_suzuki 11mo ago
    I think the people interacting with this post are just more likely to appreciate the raw craftsmanship and talent of an individual like Bellard, and coincidentally might be more critical of the machinery that in their perception devalues it. I count myself among them, but didn’t downvote, as I generally think your content is of high quality.
  • TheTaytay 11mo ago
    I was hoping you experimented with this! I am right there with you, hoping for an easier wasm sandbox for LLMs. (Keep posting please. Downvotes due to mentioning LLMs will be perceived as a quaint historic artifact in the not so distant future…)
    • wartywhoa23 11mo ago
      On the contrary, it's pretty possible that LLMs themselves will be perceied as a quaint historic artefact and join the ranks of mechanical turks, zeppelins, segways, google glasses and blockchains.
      • TeodorDyakov 11mo ago
        That is extremely unlikely.
      • johnfn 11mo ago
        If you can operationalize this I’ll happily take a bet against this, and offer you great odds.
  • yeasku 11mo ago
    Because it adds nothing to the conversation. Im
    • johnfn 11mo ago
      How does executing MicroQuickJS from Python not have anything to do with MicroQuickJS?
  • dangoodmanUT 11mo ago
    I appreciated it. I have no idea why someone would downvote it other than spite
  • johnfn 11mo ago
    I appreciate all your work and I did not downvote you. One suggestion, though, is that the README looks very AI generated, which makes the project feel low effort, like you just said “hey Claude do a security analysis of this package”. I don’t think this is actually what you did, but it’s hard to know. It’s also very difficult to identify the highlights. Just a few handwritten sentences would be better.
    • simonw 11mo ago
      The README is indeed AI generated, as is everything else in that simonw/research repository - it's my public demo of the asynchronous research process I use.
      • simonw 11mo ago
        (I'm going to add disclaimers to the top of every one of those posts, currently you have to navigate to the report homepage to find that out.) Update - added that here: https://github.com/simonw/research/pull/53 https://github.com/simonw/research/pull/53
  • jmull 11mo ago
    I don't know why people are downvoting your comment, but it could be considered a low-effort post: here's (a link to) something I prompted AI with, here's (a link to) what it produced (the whole repo). I would guess people don't know how you expect them to evaluate this, so it comes off as spamming us with a bunch of AI slop. (That C can be compiled to WASM or wrapped as a python library isn't really something that needs a proof-of-concept, so again it could be understood as an excuse to spam us with AI slop.)
  • deleted 11mo ago
    [deleted]
• MobiusHorizons 11mo ago
  What is the purpose of compiling this to web assembly? What web assembly runtimes are there where there is not already an easily accessible (substantially faster) js execution environment? I know wasmtime exists and is not tied to a js execution engine like basically every other web assembly implementation, but the uses of wasmtime are not restricted from dependencies like v8 or jsc. Usually web assembly is used for providing sandboxing something a js execution environment is already designed to provide, and is only used when the code that requires sandboxing is native code not javascript. It sounds like a good way to waste a lot of performance for some additional sandboxing, but I can't imagine why you would ever design a system that way if you could choose a different (already available and higher performance) sandbox.
  • simonw 11mo ago
    I want to build features - both client- and server-side - where users can provide JavaScript code that I then execute safely. Just having a WebAssembly engine available isn't enough for this - something has to take that user-provided string of JavaScript and execute it within a safe sandbox. Generally that means you need a JavaScript interpreter that has itself been compiled to WebAssembly. I've experimented with QuickJS itself for that in the past - demo here: https://tools.simonwillison.net/quickjs https://tools.simonwillison.net/quickjs - but MicroQuickJS may be interesting as a smaller alternative. If there's a better option than that I'd love to hear about it!
    • MobiusHorizons 11mo ago
      This is generally the purpose of JavaScript execution environments like v8 or jsc (or quickjs although I understand not trusting that as a sandbox to the same degree). They are specifically intended for executing untrusted scripts (eg web browsers). Web assembly’s sandboxing comes from js sandboxing, since it was originally a feature of the same programs for the same reasons. Wrapping one sandbox in another is what I’m surprised by.
      • simonw 11mo ago
        Running v8 itself as a sandbox is non-trivial, at least embedded in a Python or Node.js or similar application. The web is littered with libraries that half do that and then have a note in the README that says "do not rely on this as a secure sandbox".
• incognito124 11mo ago
  You should take a look at https://judge0.com/ https://judge0.com/
• sublimefire 11mo ago
  Look at how others implement quickjs and restrict its runtime for sensitive workloads [1], should be similar. But there are other ways, e.g. run the logic isolated within gvisor/firecracker/kata. [1] github.com/microsoft/CCF under src/js/core
• steren 11mo ago
  Check out this sample of using gVisor to spin up code sandboxes (potentially running on Cloud Run): https://github.com/GoogleCloudPlatform/cloud-run-sandbox https://github.com/GoogleCloudPlatform/cloud-run-sandbox
• miki123211 11mo ago
  Since you're here and this is likely to become professionally relevant for me pretty soon, what is the best way you know of for securely running Python inside Python? I was looking for something like Pyodide but runnable from Python, but that doesn't seem to exist quite yet. I can get a Python interpreter to run in wasmtime, but that doesn't have the Pyodide goodies like Micropip etc. Sadly, Pyodide itself seems fully married to JS, as it compiles to Emscripten and not WASI. I'm almost tempted to just go with a small binary embedding V8 and running Pyodide inside V8 isolates or something. (I know I can do this via Firecracker / GVisor / whatever, that is not the solution I'm looking for.)
• zellyn 11mo ago
  I’m horribly biased but I think it’s a combination of: (1) knee-jerk reaction to similar-looking but low-value comments, and (2) most people not having played around with LLM coding agents and messed around with their own agents enough to immediately jump to excitement at simple, safe sandboxing primitives for that purpose. And +1000 on linking to your own (or any other well-written) blog.
• strbean 11mo ago
  Curious if you have a specific use case for sandboxed JS that you would share?
  • simonw 11mo ago
    I want to build software features where users can configure some additional JavaScript to run in order to customize that software. One example: given this database table run this JavaScript function against every value in this column to calculate a value to be stored in another column. Or once a day fetch the JSON from this URL and transform it with this JavaScript and store it here.