Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

github.com

Post reply on HN
Print view View original

291–300 of 366 posts

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#291

Post by umanghere »

mort96 wrote: post #288
ok_dad wrote: post #286

Earlier quoted context omitted.

What’s the downside? Go does library versioning very well, IMO, but I like to hear other opinions.

The core issue is philosophical. Whether you happen to have public infrastructure which provides a web front-end for your git repository, and what exact server that web front-end happens to be hosted on, ought to be completely incidental to compiling source code. But since you ask, Go is the best example of how this can go terribly wrong in practice, IMO. Here are just a few scattered pain points I've encountered: *…

I completely encourage you to write this as a blog post, you’ve articulated all of the concerns I had with Go’s package management wonderfully.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#293

Post by sheept »

mort96 wrote: post #281
kibibu wrote: post #278

Earlier quoted context omitted.

What attracted you to Bun over Deno?

I'm not the person you asked, but for me, it's the package identifiers. Demo puts URLs to web infrastructure in source files, like Go. In my opinion, this is a huge mistake. There should be a mapping from logical package identifier to web infrastructure, and this mapping should happen outside of the source files. I believe in this very strongly.

Deno supports import maps, which are the mapping outside of the source files.

But yes, URL imports have a variety of other issues (duplicated dependencies, no resource integrity), though Deno solved them in later versions (npm registry support, lock files).

The only benefit of Deno is its permissions system, which has been great for safely letting agents write and run scripts on my file system.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#294

Post by quectophoton »

mort96 wrote: post #288
ok_dad wrote: post #286

Earlier quoted context omitted.

What’s the downside? Go does library versioning very well, IMO, but I like to hear other opinions.

The core issue is philosophical. Whether you happen to have public infrastructure which provides a web front-end for your git repository, and what exact server that web front-end happens to be hosted on, ought to be completely incidental to compiling source code. But since you ask, Go is the best example of how this can go terribly wrong in practice, IMO. Here are just a few scattered pain points I've encountered: *…

Don't forget:

* No relative imports.

* The `require` directives from the `go.mod` files of your dependencies are always ignored.

Those two combined, mean that there's no easy way to fork a dependency. It's doable, but some of the maintenance overhead could have been avoided.

We don't even get a `go mod tidy` flag that lets us say, "yes, I understand the risks, just copy any `replace` directives that you find in my dependencies". With a flag like that, even if the `replace` directive is still copied everywhere, at least it's automatically copied during a routine `go mod tidy` invocation.

They already have `// indirect` comments, so those could have a `// indirect, replaced by X` comment or something like that.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#295

Post by kibibu »

mort96 wrote: post #281
kibibu wrote: post #278

Earlier quoted context omitted.

What attracted you to Bun over Deno?

I'm not the person you asked, but for me, it's the package identifiers. Demo puts URLs to web infrastructure in source files, like Go. In my opinion, this is a huge mistake. There should be a mapping from logical package identifier to web infrastructure, and this mapping should happen outside of the source files. I believe in this very strongly.

This hasn't been entirely correct since late 2024

https://deno.com/blog/your-new-js-package-manager

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#296

Post by Jnr »

theamk wrote: post #271
gpm wrote: post #77

This issue is misleading. The issue isn't the existence of undefined behavior that miri would catch. The issue is exposing an API that allows undefined behavior from safe code - which miri only catches if you go write the test that proves it. This isn't an all together unreasonable thing to happen during an initial port of code from an unsafe language. You can, and the bun team seems to be, go around later and make s…

Once project reaches 1.0 for the first time, a lot of people expect that "main" branch is now working all the time. That's what the whole "CI/CD" is about after all - every commit should work. If you are making a full rewrite and have non-working, in-progress code, you use a branch. This way you can still have the working "main", in case there is a security fix needed or something.

It depends on how you set it up, but main doesn't have to be the stable release branch. From what I have seen, in most public projects it is the staging area for the next release. If you have to go back to previous releases you have tags.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#297

Post by nicce »

gorjusborg wrote: post #229

Here's the thing: I was first interested in Bun because it was written in Zig. I was interested in Zig because I respected Andrew Kelley's decision-making, and his taste matched my own. I got really excited about Bun for many reasons after that, but they essentially came down to a similar root: the decisions were ones that I respected and would probably have made myself if I had thought of them. I was a little concer…

Bun is really interesting project, but the amount of segmentation faults in issues was too concerning for serious production usage. I guess this is one direction to fix it, but let’s see.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#298

Post by jwilliams »

mohsen1 wrote: post #67

I was a little shocked that they could get it fully working in a week to be honest. My side project is a very similar ambition ( https://tsz.dev ) but I am in no way claiming success. i keep adding more and more tests to ensure things works. Even after all of TypeScript's own tests pass I am finding bugs which I was totally expecting. The bar for matching tsc's behavior is really _really_ high. see: https://github.co…

tsz looks impressive. Congrats!

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#299

Post by mort96 »

kibibu wrote: post #295
mort96 wrote: post #281

Earlier quoted context omitted.

I'm not the person you asked, but for me, it's the package identifiers. Demo puts URLs to web infrastructure in source files, like Go. In my opinion, this is a huge mistake. There should be a mapping from logical package identifier to web infrastructure, and this mapping should happen outside of the source files. I believe in this very strongly.

This hasn't been entirely correct since late 2024 https://deno.com/blog/your-new-js-package-manager

Thanks, this is a good correction. I haven't looked seriously at Deno since way before late 2024. The "URLs as package identifiers" issue is what initially attracted me to Bun over Deno, but it may not be relevant anymore.
Post reply on HN