6 ms·
Electrobun 2.0 will be decoupled from Bun due to the Rust rewrite
https://xcancel.com/YoavCodes/status/2058064720553222567 https://xcancel.com/YoavCodes/status/2058064720553222567
- consumer451 5mo agoI have to say, this whole saga is extremely interesting. Not just from a popcorn-enjoyer's point of view, but as a bit of a bell weather for 2026 software dev.
- fallenscope 5mo ago[dead]
- christophilus 5mo agoTime will tell. I predict this is just the same 20 year pattern of: people on the internet are irate about $latest_thing, and everyone will move on to some other hot topic.
- deleted 5mo ago[deleted]
- consumer451 5mo agoFor some reason, when thinking about this, the visual of all the scientists at CERN camping out for the results of the Higgs Boson experiment jumped into my mind. This is not as big an experiment as that. But, for software dev, it feels very significant.
- jakobnissen 5mo agoBut surely, whether or not the Internet mob moves on has no bearing on what actual lessons to learn from this saga. Will the vibe rewrite turn out to be a disaster or are LLMs already capable of writing human level code at this scale? That question is interesting no matter the level of attention this gets.
- stephbook 5mo agoI'm believe projects that pin old versions or maintain their own shoddy fork will be left behind. Deprecation is fine.
- versecafe 5mo agomaintaining a fork on the zig version works short term but does open some questions about longterm stability/approach and if features should be cut to make maintenance easier; ie Bun.Image, fetch("", {grpc: true}), Bun.redis since it never got finished, etc
- Npovview 5mo agoThe same thing happened when MS acquired Github. So much outrage and so little action of moving to Gitlab.
- ibejoeb 5mo agoPeople are going to be using a lot less software if the selection criteria include not being no agents.
- skeeter2020 5mo agoThis is a very uncharitable interpretation of the twitter post: "It’s a combination of anthropic’s stance of not doing human reviews or any kind of rational roll out and stabilization." They mention nothing about agents being used, rather focus on humans in the review cycle and some sort of gated roll-out process. Why we would bin these practices in the name of a faster release cycle is an important question & debate.
- ibejoeb 5mo agoI kind of agree, but it goes both ways. Has Jarred said that there was no review? I know that he stated that rust bun passes tests. Now, I don't know the amount or quantity of coverage, but as a thought experiment, let's assume they are good. What does that count for?
- deleted 5mo ago[deleted]
- riffraff 5mo agoI think most people believe it unlikely that one million line of codes can be reviewed in one week, and the fact that tests pass does not imply good code. I have no idea whether the new or old code is/was good, just pointing out what seems like a plausible thought process for people who object to this rewrite.
- zoogeny 5mo agoI think it is interesting, using your framing, to consider why people may or may not believe that one million lines of code could be reviewed. I mean, until very recently, the idea that one million lines of code could be written (rather than mechanically translated) in a month was unbelievable. It is clearly the case that times have changed since the tools have been updated. So if we challenge one assumption, why not also challenge the other? Bun presumably will have access to Mythos, which is purportedly reviewing million line code-bases (Mozilla, etc.) and uncovering real value for the devs of those projects. I find it hard to deny extrapolating these trends to this Bun rewrite.
- Cpoll 5mo agoTrivia: The term is "bellwether," i.e. a wether (castrated sheep) wearing a bell, used to guide the flock.
- consumer451 5mo agoI kept checking the thread for responses and finally realized it, but too late to edit. I will probably wake up in a few days from a nightmare about this misspelling on HN. Happens all the time, no joke. I think that in my mind, it was always some sort of weather related bell, like you ring it, when the weather changes. Hopefully the sheep reference will help me remember.
- eichin 5mo agoI'd suggest reading the Connie Willis novel by that name - no idea if it will actually help, it's just really good writing :-)
- satvikpendem 5mo agoYou might be interested in https://hnreplies.com/ https://hnreplies.com/ to automatically get an email for HN replies
- Hnrobert42 5mo agoI have ADHD. I am super sensitive to noise. When other people let their phones ding incessantly, it drives me crazy. I went hiking in Albania recently. I saw many sheep grazing in the mountains. I wondered about the sheep chosen to wear the bell. Like, was it the same sheep every day? Did the chosen sheep think, "Fuck me this thing is annoying"?
- hoppp 5mo agoI don't think it has any choice so it probably accepted fate. I think its the same sheep but no clue if they rotate.
- giancarlostoro 5mo agoWhat's funnier to me is none of them seem to want to abandon npm which keeps getting exploited and hacked. NPM has been the source of just how many industry wide hacks? Three major ones, and a massive supply-chain industry wide campaign against npm. But yeah, bun is the real concern here. I think we need to smell the coffee and review npm and scrutinize it because it is getting dangerously out of hand.
- tankenmate 5mo agoFrom my perspective it is a synthesis of "It is difficult to get a man to understand something, when his salary depends upon his not understanding it." and "but npm is the source of all the shiny shiny!".
- TiredOfLife 5mo agoAlso Rubygems, Packagist, PyPi
- baggy_trough 5mo agoWhat's the worst hack to affect users of rubygems?
- pwdisswordfishs 5mo agoDHH, of course.
- ghusto 5mo agopip install pulls in what I've listed in my package list, plus their dependencies which are at most 2 levels deep. The dependency's dependencies are reviewable. npm install pulls in my dependencies plus god knows what else at god knows how many levels. 500MB of dependencies? The dependency's dependecies are not reviewable. I wish people would stop trying to compare NPM to PyPi and others. NPM is an unfixable disaster because of the entire mindset and ecosystem around JavaScript.
- 5mo ago
- MuffinFlavored 5mo agoI wonder how many "behind the curve/not super modern" corporations were using Bun or Deno to begin with. Part of me thinks it's a mild overreaction. It's not like people audit every line of kernel/driver/BIOS/EFI code before running Linux? As long as the tests pass and the performance doesn't regress and it's secure... why are people so mad that it was vibe coded? Is it because it was an irresponsible thing to do? Maybe? I don't know, I see both sides.
- dahs12 5mo agoIt isn't about users auditing Linux. The Bun developers don't audit "their own" (stolen) vibe code output. How would anyone know if it is secure?
- worble 5mo ago> It's not like people audit every line of kernel/driver/BIOS/EFI code before running Linux? That's basically Torvolds full time job?
- cookiengineer 5mo ago> That's basically Torvolds full time job? It's actually more like 50 devs, each of them specialized in their own field, with 20+ years programming experience. And even they make mistakes sometimes (see the recent TOCTOU exploit wave). What vibecoders never get: it's about stability of software. Nobody will rely on your vibecoded project if even you yourself don't give a damn about any API stability or API contracts. If you expect others to use vibecode assistants to use your software/library... then what was the reason in the first place to write it, if it's effectively not solving a problem? The whole points of dependencies and packages goes out of the window once the library maintainers start to use slopcoding practices.
- nicoburns 5mo ago> As long as the tests pass and the performance doesn't regress and it's secure... why are people so mad that it was vibe coded? Because the chances that they had a test suite that was actually comprehensive enough to guarantee correctness through this kind of refactor are approximately zero. Normally we combine tests with careful "correctness by construction" design work and code review because we know that tests aren't sufficient.
- zoogeny 5mo agoI think a more apt analogy (or cliche) is canary in the coalmine.
- ifwinterco 5mo agoExactly, I'm glad bun has done this because it will be fascinating to see how it plays out. I'm also glad I don't use bun
- hoppp 5mo agoMy bet is that Bun is going to die. They kill it with this rewrite bs.
- qsera 5mo agoI think it makes sense to stay away from large code bases built using LLMs until it is proven that it is possible to also maintain such code bases using LLMs or using reasonable human effort.
- Zakis1 5mo agoIt's alarming how people instantly jump to conclusions that Bun is now "AI slop". Bun has been almost entirely worked on by LLM's for ~6 months now, long before the Rust re-write (source: https://x.com/jarredsumner/status/2054525268296118363 https://x.com/jarredsumner/status/2054525268296118363). It already has been proven that LLM's can maintain such codebases.
- RiOuseR 5mo ago[dead]
- nicce 5mo ago> It already has been proven that LLM's can maintain such codebases. Is it? Seems like bugs in Claude Code are getting out of hands. That project has a bit more lifetime.
- sibeliuss 5mo agoIs it that, or is it just that every software developer, enterprise, dev and non-dev alike has their eyes on Claude Code as the most popular software project ever? Software in general has tons of bugs. People need to understand scale here, and what this looks like in practice. They're doing an incredible job given the circumstances.
- nicoburns 5mo ago> Claude Code as the most popular software project ever I don't think that's true? The likes of Chrome, Linux, curl, sqlite, etc, are much more widely used.
- andai 5mo agoElectrobun repo: https://github.com/blackboardsh/electrobun https://github.com/blackboardsh/electrobun > Electrobun aims to be a complete solution-in-a-box for building, updating, and shipping ultra fast, tiny, and cross-platform desktop applications written in Typescript. Under the hood it uses bun to execute the main process and to bundle webview typescript, and has native bindings written in Objc, C++, and several core parts written in zig.
- throwatdem12311 5mo agoIt’s really only a matter of time until someone forks the Zig version of Bun. What a slap in the face to all the Zig developers that spent their time, effort and probably even some money contributing to it.
- u_fucking_dork 5mo ago[flagged]
- ramon156 5mo agoWhat a weird take. Might as well give up on anything you care about, as its only an "x"
- u_fucking_dork 5mo agoYou shouldn’t feel slapped in the face if someone chooses a programming language you don’t like. Full stop.
- onel 5mo agoThat's not what he's saying. It's not about the programming language. It's about people contributing, putting effort into the project and being passionate about it and then someone else throwing all off that away.
- u_fucking_dork 5mo agoThrowing all away by changing to a different programming language. None of it is thrown away, it’s just now in a new language. On top of that Bun is realistically a one man show with the vast majority of the code written by one dude. So the comment I replied to started from outrage and worked backwards to justify it without thinking too hard tbh. The implication that you shouldn’t be able to change the programming language of your own project is also weird. Personally I welcome things like Typescript being rewritten in Go
- 3as-123 5mo agoGreat, the author speaks out what everyone thinks but cannot say, either due to being invested in the hype or due to effectively having a gag order from their employers: https://xcancel.com/YoavCodes/status/2058170216408813583#m https://xcancel.com/YoavCodes/status/2058170216408813583#m The bun rewrite was Anthropic's Vietnam and the open source community needs to react and and build resistance.
- asdfsa32 5mo agoIn many a brand name company now tokenmaxxing is the name of the game; CryptoBase, FacePaper, AntiqueOptics, tinyflacid, they all use AI usage metrics as part of their perf review these days.
- mentalgear 5mo agoWhile I'm certainly sceptical of pure LLM (re)-written software, I would have to assume in the case of the cyberattack vector that Anthropic used their new Mythos model to adequately test against. Maybe someone has more info of them mentioning that.
- impulser_ 5mo agoJarred said this had nothing to do with Mythos or Anthropic.
- shimman 5mo agoThe concept of a "useful fool" is apt here.
- conartist6 5mo agoI have a very, very hard time believing that. Surely the acquisition left his wealth largely in the form of Anthropic stock, so his personal definition of success is "rep Anthropic so my stock goes up" and at that point he has succeeded. Me, I still have to be competent to succeed. I don't just get to declare that because I used AI the effort was a success, and I have 0 desire to work with those kinds of people.
- InsideOutSanta 5mo agoI wouldn't be surprised if the kinds of security issues LLMs tend to create are the exact types of security issues LLMs are bad ar detecting.
- skeeter2020 5mo agoso they are defending the LLM-generated code using another one of their LLMs, against attacks from yet other LLMs? So regardless of the outcome and impact on us, they win?
- bastawhiz 5mo ago> to adequately test against How does one determine what "adequate" looks like for a million lines of code? You can't fit a million lines of code in a 1M token context window unless every line of code is one token. So you're just sort of praying you spend enough time/money burning tokens to shake out all the stuff that's bad or wrong.
- bobajeff 5mo agoThis is my first time hearing about Electrobun it sounds like it could be a good alternative to electron. Their site mention CEF bundling as an option has anyone tried this?
- catgirlinspace 5mo agoi believe steam does it
- feverzsj 5mo agoI doubt any sane human will continue using Bun.
- chuckadams 5mo agoIn this industry, that leaves most of us.
- chuckadams 5mo agoI'm not joining the chorus condemning Bun for the vibe-rewrite, and I think it's fascinating whether it turns out to be a complete trainwreck or not. But FFS, it should have been a separate repo.
- tln 5mo agoWhat? Why? Git has branches...
- chuckadams 5mo agoRight, but it's my understanding that it was done as a PR that was merged to `main`. Sure, anyone could find the last Zig commit and branch off of that, so I guess it's all po-tay-to po-tah-to.
- punchmesan 5mo agoThey're two completely different codebases... even if they are 100% feature parity, it's 100% different code. They should absolutely be separate from each other, with different issues lists. Clean separation of two different codebases isn't a strange concept...
- wiseowise 5mo agoJudging by the comments, Bun as a company doesn’t give a single shit about community. The only reason it is in the same repo is tracking down issues, discussions, etc. Those would be hard to migrate.
- tln 5mo agoIts not 100% different code though. Docs, build instructions, C++, Typescript... The issues should absolutely be kept. The rewrite was file by file translation so logic bugs would remain. It's valuable to ensure the memory bugs are in fact fixed. Starting the issues from nothing does not make any sense to me.
- avinassh 5mo agoTIL electrobun. How does it compare against electron?
- wartywhoa23 5mo agoThe diff is +bu.
- yoav 5mo agoBetter in every way
- krzyk 5mo agoThat name is quite near the infamous Electron, is it similar?
- pessimizer 5mo agoThis whole thing of shunning bun is a goofy protest against AI in general by a bunch of programmers about to transition from vastly overpaid to mostly unemployed, sometimes thinly disguised as quality concerns and piggybacking a little bit on the anti-"rewrite it in rust" train. Still, I can't help but entirely support it. I don't want hard dependencies on gigantic megacorps, or on any single provider who can go rogue. Should have always been able to switch between them, and any of them who made that difficult should have been the ones to be shunned. Completely dropping support for bun is equally bad imo, because now your choices are limited to Microsoft and deno, making deno close to a single point of failure. Although I have to wonder what would happen if Anthropic threw a couple of bucks at electrobun (lol, not really.)
- wiseowise 5mo ago> This whole thing of shunning bun is a goofy protest against AI in general by a bunch of programmers about to transition from vastly overpaid to mostly unemployed, sometimes thinly disguised as quality concerns and piggybacking a little bit on the anti-"rewrite it in rust" train. It is interesting how you find millions of people put on the street “goofy”, all while concentrating wealth in the hands of a couple of hyperscalers.
- insane_dreamer 5mo agoThis makes a lot of sense. For example, we (and many others) depend heavily on numpy. It's been around for decades and heavily battle tested. If someone came out with a new version of numpy vibe-code rewritten in a week, with assurances that "all tests pass", do you think we would adopt it? Absolutely not. We would have no confidence that there aren't some latent bugs or that we can fully trust the results. It has nothing to do with AI having rewritten it, it has to do with being battle tested over time. If a team of humans had rewritten it in a week, I wouldn't trust or use it either.
- sigmar 5mo ago>it has to do with being battle tested over time. If a team of humans had rewritten it in a week, I wouldn't trust or use it either. "it was made in a week" gets repeated a lot on HN, but the PR wasn't a release. They've been working on the rust rewrite for more than a month and it hasn't shipped.
- bastawhiz 5mo agoOne week to four weeks doesn't make it better.
- insane_dreamer 5mo ago> They've been working on the rust rewrite for more than a month and it hasn't shipped doesn't make any difference the point is, users haven't been using it for years, like the original there is absolutely no way that you can internally test all the use cases that users encounter, especially with such a large code base
- ksec 5mo agoAt this point I am wondering if anyone will be forking the Zig Bun to something else.
- deleted 5mo ago[deleted]
- Squarex 5mo agoThey should probably change the name then.
- ChrisArchitect 5mo agoRelated: yt-dlp - Bun support is now limited and deprecated https://news.ycombinator.com/item?id=48238789 https://news.ycombinator.com/item?id=48238789
- queenkjuul 5mo agoI feel like all the replies have totally missed that this Rust port has (reportedly) thousands and thousands of "unsafe" statements and no human review; I'm no rust dev but that doesn't make me very confident, and probably won't consider Bun for new projects either
- classicposter 5mo agohttps://github.com/oven-sh/bun/issues/30921 https://github.com/oven-sh/bun/issues/30921 > A CVE wasn’t announced for an HTTP Request Smuggling vulnerability Even before the acquisition of Anthropic, there had never been a single vulnerability report. https://github.com/oven-sh/bun/security https://github.com/oven-sh/bun/security Do not use this in production.
- deleted 5mo ago[deleted]
- torginus 5mo agoPersonally I am confused by this whole rewrite - the 'crown jewel' of Bun is Webkit, which is written in C++, which is 'unsafe'. This seems like Tauri 2.0 - wrap something in Rust and claim the memory safety issues are gone.
- nsonha 5mo agoThe author was pretty clear about his motivation on the language. It's to make it more sustainable for them to maintain bun (instead of directly making bun safer), but the former can and often will result in the latter.
- fathermarz 5mo agoI’m confused, isn’t this rewrite still unreleased as of today? Surely people understand that a simple, “do an audit for memory safety” will bring it up to par.