5 ms·
Still writing the blog post about this. Will share more details. For where this is coming from, skim the bugfixes in the Bun v1.3.14 and earlier release notes.
by Jarred 5mo ago
Still writing the blog post about this. Will share more details.
For where this is coming from, skim the bugfixes in the Bun v1.3.14 and earlier release notes. Rust won’t catch all of these - leaks from holding references too long and anything that re-enters across the JS boundary are still on us. But a large % of that list is use-after-free, double-free, and forgot-to-free-on-error-path, which become compile errors or automatic cleanup.
- eddiewithzato 5mo agoI can hope this will lead to little to no memory issues in using bun as a web server
- embedding-shape 5mo agoI'd be surprised if they could eliminate memory issues completely, especially considering the amount of `unsafe` the codebase seems to contain. git rev-parse HEAD && ag "unsafe" src | wc -l 19d8ade2c6c1f0eeae50bd9d7f2a4bf4a2551557 14865
- davidghowell 5mo agoThat's picking up all the "bunsafety" references in there :P
- embedding-shape 5mo agoWhen I read what you wrote, I was like "of course, duh, I'm stupid" but running `ag "unsafe" src | grep -i "bunsafety"` it doesn't seem to be the case actually, I see zero bunsafety mentions from it. However, `ag unsafe` does over-count anyways, just in a different way, matching stuff like SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION and _unsafe_ptr_do_not_use and others. Better command with same previous commit, `ag -w unsafe src | wc -l`, reports 13914 "unsafe" usages now, slightly better but pretty awful still.
- logicprog 5mo agoMy understanding is that that's because they were trying to do a structurally homologous port from Zig to Rust, precisely to keep their mental model and not change "too much" at once, and then they plan to refactor to make it safe Rust later.
- rpearl 5mo agoit's clear that as of the time of this merge, no human has read any appreciable fraction of current mainline bun, so it's not particularly clear how much of a "mental model" exists anymore.
- Narishma 5mo agoDoesn't that count anything that has 'unsafe' in it, not just the keyword?
- embedding-shape 5mo agoIt does, see the sibling comment made about an hour before yours, fixing that issue has marginal difference.
- e12e 5mo agoOn the other hand - now it should be possible to tackle some of those one by one?
- embedding-shape 5mo agoOh yes, I don't doubt they'd eventually be able to seriously reduce that number, probably to a handful of places. I don't doubt the strategy employed here, rewriting it keeping it similar, then slowly change it. I do still doubt they'd be able to completely eliminate memory issues in the end regardless.
- pulsartwin 5mo agoLooking forward to the blog post. Do you plan to run both the Zig and Rust binaries side-by-side across a wide range of real applications (potentially shadowing in production) to weed out bugs?
- aapoalas 5mo agoThey have a PR (~~closed by GitHub bot as AI slop, ironically~~ this was wrong info, it was apparently closed by Jarred himself as it missed a conversion or some 20 Zig files to Rust) to remove the Zig code. I guess the answer is "no".
- arm32 5mo agoThat's way too smart, safe and sensible.
- deleted 5mo ago[deleted]
- janice1999 5mo agoI'm curious how much this would cost a paying customer. Can you please give us an estimate?
- nzoschke 5mo agoGreat question and I'd love the answer. I bet the answer is industry changing even if the token cost is high. This work was impossibly expensive in terms of people hours and time before. Architectural planning, engineering alignment and politics, phased engineering that gets interrupted by changing priorities. That it's possible to do R&D, the port, and get 99.X test passing in less than 2 weeks is so much more efficient for the humans.
- calmoo 5mo agoWill this likely fix stability issues in the Bun Workers API? https://bun.com/docs/runtime/workers https://bun.com/docs/runtime/workers
- randypewick 5mo agoDid you (or will you) implement some kind of e2e (fuzzy?) testing comparing the two binaries? Do you have particular plans regarding the release of this (for ex to not break users workflows or things like that)?
- LucidLynx 5mo ago[flagged]
- embedding-shape 5mo agoComing on a bit strong no? Isn't it possible one could do an experiment almost two weeks ago, then by today the experiment concluded and now you've made a choice? Did you think "experiment" meant 100% this will be thrown away? Wouldn't make much sense to experiment with something you know you'll throw away, unless you have some specific reason for it.
- Klonoar 5mo agoYou don’t speak for most of us.
- dolmen 5mo agoDoes that mean that from now your coding agents working on the Bun codebase are themselves running on that rust-Bun runtime?
- fatata123 5mo ago[dead]
- tasuki 5mo agoYou, nine days ago[0]: > I work on Bun and this is my branch > This whole thread is an overreaction. 302 comments about code that does not work. We haven’t committed to rewriting. There’s a very high chance all this code gets thrown out completely. Maybe... it wasn't such an overreaction? [0]: https://news.ycombinator.com/item?id=48019226 https://news.ycombinator.com/item?id=48019226
- camdenreslink 5mo agoYea, what the heck.
- imenani 5mo agoThe author discussed this here four days ago https://news.ycombinator.com/item?id=48077663 https://news.ycombinator.com/item?id=48077663
- embedding-shape 5mo agoYou're not alone in voicing this, another (now dead) comment did it earlier too with a bit more of an emotional response (https://news.ycombinator.com/item?id=48134229 https://news.ycombinator.com/item?id=48134229). Still, do you folks never do something to see how you feel about something, then chose to go one way or another? I'm not sure why it's so hard to see that it was an overreaction at the time, because it was an experiment, then at one point it stopped being an experiment and now they've chosen to actually run with it? Is this not a common occurrence for other people? Personally I change my mind all the time, especially based on new evidence, which usually experiments like this surface, I'm not sure I understand the whole "You said X some days ago" outrage that seems to cause people's reaction here.
- tasuki 5mo agoYes sure it's ok to change your mind. But don't you think the people Jarred accused of "overreacting" in retrospect didn't?
- embedding-shape 5mo ago
- halifaxbeard 5mo agoAny plans to issue a CVE for this HTTP request smuggling attack vector fixed in the latest bun release? https://github.com/oven-sh/bun/issues/29732 https://github.com/oven-sh/bun/issues/29732
- classicposter 5mo agohttps://github.com/oven-sh/bun/security https://github.com/oven-sh/bun/security Surprisingly, they appear to have not disclosed any vulnerabilities whatsoever. It's likely there have been numerous vulnerabilities in the past, but they are all being ignored. https://x.com/DavidSherret/status/2031432509301428644 https://x.com/DavidSherret/status/2031432509301428644
- halifaxbeard 5mo agoThis is really poor form given that Anthropic is going around getting all kinds of public goodwill for finding CVEs in other people’s products.
- shimman 5mo agoYeah! Why would the company that stands to make themselves look better in front of an IPO do such a thing?! Next thing you're going to tell me was that this whole rewrite was another marketing ploy to help potentially turn themselves in multi-millionaires!
- dwattttt 5mo agoYes, it is helpful for a company to be very clear that in a choice between the safety and integrity of their customers, and profit, they are choosing profit.
- grayhatter 5mo agomaybe you should ask on the issue directly?
- underdeserver 5mo agoIs writing the blog post taking longer than the rewrite
- Jarred 5mo agoalmost
- cyanydeez 5mo agoSo a question you should answer: Couldn't you just train the super SOTA model on fixing those issues instead of porting it?
- andrepd 5mo ago> The codebase is otherwise largely the same. The same architecture, the same data structures. How can you possibly verify this, if a 1M line patch was written over 7 days? It's at best a hunch (vibes?), and at worst a lie.
- dlopes7 5mo agoI bet the blog post will make no mention of pressure from anthropic to do this and instead will celebrate the fact that “it passes all tests”, of course omitting how many tests were modified to forcibly pass
- awwaiid 5mo agoWas there pressure to do this, or freedom to do this? If I had an unlimited token budget I'd probably try all sorts of crazy things. Also you (one) can read the tests and see that they weren't modified to forcibly pass.
- giancarlostoro 5mo agoDo you have any proof Anthropic pushed for this? Because the author has been clear this was an experiment they wanted to test out on their own, only when it seemed to be in a working state did they consider, okay maybe this might work for us.
- shimman 5mo agoDoes it take a phd in psychoanalysis to not see that the company that has been marketing the fuck out of lame publicity stunts, to not take advantage of another publicity stunt? Good lord, no wonder the public hates tech workers.
- giancarlostoro 5mo agoI refuse to blindly hate something because someone tells me to with no evidence, if you want to hate me for that, so be it, that sounds like a personal problem.
- kenloef 5mo agoShow me the incentive and I'll show you the outcome.
- 5mo ago