This brings back memories back in the days I mess around Resource Hacker for Win32 EXEs.
I miss those days where you can tweak all kinds of software GUI by your self. Change icons, menus, shortcut keys, etc.
Node.js needs a virtual file system
231–240 of 275 posts
Re: Node.js needs a virtual file system
#232Earlier quoted context omitted.
Wow, I thought you were exaggerating, but no: https://github.com/oven-sh/bun/issues?q=is%3Aissue%20state%3... Open 80, closed 492.
That's basically just Zig, right? Re-invented C but only fixed the syntax, not the problems.
it’s hard to be convinced that zig is an acceptable idea for security critical runtime for web applications.
Re: Node.js needs a virtual file system
#233Earlier quoted context omitted.
If there's a "the original" the LLM is copying then there's a problem. If there isn't, then (b) works fine, the code is taken from the LLM with no preexisting license. And it would be very strange if a mix of (a) and (b) is a problem; almost any (b) code will need some (a) code to adapt it.
> the code is taken from the LLM with no preexisting license That's not good enough to comply with (b). The code must be specifically covered by an open-source license, it's not enough for it to just not have a license.
There's a difference between "no license, all rights reserved" and "no license, public domain". Up until recently, you could assume that not having a license meant the former. But treating the latter as the same would just be silly.
As far as I'm concerned, public domain counts as "an appropriate open source license".
Re: Node.js needs a virtual file system
#234Earlier quoted context omitted.
> the code is taken from the LLM with no preexisting license That's not good enough to comply with (b). The code must be specifically covered by an open-source license, it's not enough for it to just not have a license.
There's a difference between "no license, all rights reserved" and "no license, public domain". Up until recently, you could assume that not having a license meant the former. But treating the latter as the same would just be silly. As far as I'm concerned, public domain counts as "an appropriate open source license".
> As far as I'm concerned, public domain counts as "an appropriate open source license".
For material whose author is known and has explicitly placed it in the public domain, sure. For code that fell off the back of a truck, not so much.
Re: Node.js needs a virtual file system
#235Earlier quoted context omitted.
My mistake 19k lines. At 2 mins per line that’s (19000*2)/60/7=90 7-hour days to review it all, are you sure it was all read? I mean they couldn’t be bothered to write it, so what are the chances they read it all? For someone’s website or one business maybe the risk is worth it, for a widely used software project that many others build on it is horrifying to see that much plausible code generated by an LLM.
> I mean they couldn’t be bothered to write it, so what are the chances they read it all? What kind of logic is this?
It’s much harder to read code carefully than to write it. Particularly code generated by LLMs which is mostly correct but then sometimes awful.
Re: Node.js needs a virtual file system
#236Earlier quoted context omitted.
My mistake 19k lines. At 2 mins per line that’s (19000*2)/60/7=90 7-hour days to review it all, are you sure it was all read? I mean they couldn’t be bothered to write it, so what are the chances they read it all? For someone’s website or one business maybe the risk is worth it, for a widely used software project that many others build on it is horrifying to see that much plausible code generated by an LLM.
When you review code, do you spend 2 minutes per line? That seems like a huge exaggeration of effort required
Depends - if it is from a human I find I can trust it a lot more. If it is large blobs from LLMs I find it takes more effort. But it was just a guess at an average to give an estimate of the effort required. I’d hope they spent more than 2 mins on some more complex bits.
Are you genuinely confident in a framework project that lands 19kloc generated PRs in one go? I’d worry about hidden security footguns if nothing else and a lot of people use this for their apps. Thankfully I don't use it, but if I did I'd find this really troubling.
It also has security implications - if this is normalised in node.js it would be very easy to slip in deniable exploits into large prs. It is IMO almost impossible to properly review a PR that big for security and correctness.
Re: Node.js needs a virtual file system
#237yarn pnp is currently broken on Node v25.7+; - https://github.com/yarnpkg/berry/issues/7065 - https://github.com/nodejs/node/issues/62012 This is because yarn patches fs in order to introduce virtual file path resolution of modules in the yarn cache (which are zips), which is quite brittle and was broken by a seemingly unrelated change in 25.7. The discussion in issue 62012 is notable - it was suggested yarn just wai…
Strong rec to choose PNPM over yarn. I just posted this in a peer comment: https://news.ycombinator.com/item?id=47415173 Not spamming, not affiliated, just trying to help others avoid so much needless suffering.
For many years I was using yarn with 0 issue on massive monorepos, and every year I'd hear people hyping pnpm, I'd try and switch, run into multiple bugs often open issues in pnpm itself, yes even without their link strategy, then give up and wait. After about 3 years of this I gave up and never tried again.
Re: Node.js needs a virtual file system
#238Earlier quoted context omitted.
When you review code, do you spend 2 minutes per line? That seems like a huge exaggeration of effort required
I probably review about 1k LoC worth of PRs / day from my coworkers. It certainly doesn't take me 33 hours (!!) to do so, so I must be one of those rockstar 10x superhero ninja engineers I keep hearing about.
Are your coworkers producing the code using LLMs? And what level of trust do you place in them?
Re: Node.js needs a virtual file system
#239Earlier quoted context omitted.
That's basically just Zig, right? Re-invented C but only fixed the syntax, not the problems.
it’s hard to be convinced that zig is an acceptable idea for security critical runtime for web applications.
And as I understand it, most (if not all) of these segfaults were in casual use, not when someone is trying to attack it..
Re: Node.js needs a virtual file system
#240Earlier quoted context omitted.
That seems exclusive of LLMs, as the user didn't create the contribution, the LLM did.
It's exclusive of code where you wrote 0% of it. "in part" is a trivial bar to clear.
I guess as a very strict reading where you take the output and insert a newline somewhere...but that sounds against the intent