181–188 of 188 posts
https://github.com/oven-sh/bun/issues/30921 > A CVE wasn’t announced for an HTTP Request Smuggling vulnerability Even before the acquisition of Anthropic, there had never been a single vulnerability report. https://github.com/oven-sh/bun/security Do not use this in production.
Earlier quoted context omitted.
Sounds about right. I think the response is a bit of an overreaction at this point, but an understandable and easily preventable one. It would have saved a lot of grief to have been more transparent and set clearer expectations: rather than yolo the experimental code into main, put it in a "v2" branch, publish an expected release timeline with 2.0.0 projected for ~Q4 2026 - Q1 2027, and announce a transition of 1.x t…
The other frustration is that the folks at Bun seem to entirely not get the problem they are creating for themselves. One of the responses to this announcement was Jarred asking: “What issue did you run into with the Rust rewrite? If there’s something specific I’ll fix” Dude, this is a comms problem, not a technical problem. Refusing to accept that makes the situation worse and I think it is completely believable if…
Besides, he doesn't mean he'll fix. He means "I'll let our AI vibe code a fix". We'd rather talk to the AI directly at this point, what exact value he adds?
Earlier quoted context omitted.
9 days just wasn't enough burn in. In an alternate reality, rust-bun ran in parallel for a least a month, if not three or six, before being merged.
Bun has always been about velocity over quality. Their whole point was "drop in node replacement" - instead of hitting that target they built an entire framework of tools, seemingly changing focus every month or two, and are now rewriting all that to a new language.
Points to a badly ever-shifting platform at the whims of vibes and people with more coding resources than strategic plans.
Earlier quoted context omitted.
Also Rubygems, Packagist, PyPi
pip install pulls in what I've listed in my package list, plus their dependencies which are at most 2 levels deep. The dependency's dependencies are reviewable. npm install pulls in my dependencies plus god knows what else at god knows how many levels. 500MB of dependencies? The dependency's dependecies are not reviewable. I wish people would stop trying to compare NPM to PyPi and others. NPM is an unfixable disaster…
I have to say, this whole saga is extremely interesting. Not just from a popcorn-enjoyer's point of view, but as a bit of a bell weather for 2026 software dev.
People are going to be using a lot less software if the selection criteria include not being no agents.
This makes a lot of sense. For example, we (and many others) depend heavily on numpy. It's been around for decades and heavily battle tested. If someone came out with a new version of numpy vibe-code rewritten in a week, with assurances that "all tests pass", do you think we would adopt it? Absolutely not. We would have no confidence that there aren't some latent bugs or that we can fully trust the results. It has no…
That's like saying "It took me a month to hand-make this cupboard. If someone made a cupboard in just one day using a machine, do you think I'd trust it?".
"thousands of people have bought, used and reviewed this hand-made cupboard over the past 10 years, so I can trust that it's good"
vs
"no one has used this cupboard that was made in one day, so I have no idea whether it's good or not"
call me back in a couple of years and we'll talk
I have to say, this whole saga is extremely interesting. Not just from a popcorn-enjoyer's point of view, but as a bit of a bell weather for 2026 software dev.
I wonder how many "behind the curve/not super modern" corporations were using Bun or Deno to begin with. Part of me thinks it's a mild overreaction. It's not like people audit every line of kernel/driver/BIOS/EFI code before running Linux? As long as the tests pass and the performance doesn't regress and it's secure... why are people so mad that it was vibe coded? Is it because it was an irresponsible thing to do? Ma…
> As long as the tests pass and the performance doesn't regress...
Agentic vibe coding is not an application of ACL2 theorem prover to anything. Agentic vibe coding is an opposite of it, it will make its way to pass the tests with any means necessary, be it patching the code, the tests, or expected results.
> it's secure