Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oven: The Company Behind Bun

oven.sh

Post reply on HN
Print view View original

31–40 of 122 posts

Re: Oven: The Company Behind Bun

#31

Post by AaronFriel »

It's an incredible achievement, though I worry about the use of an unproven language (Zig) that lacks memory safety by design. JavaScript runtimes, especially those with JITs, have been plagued by vulnerabilities from memory safety, type confusion, and data races.

Node.js, despite being based on V8, is still susceptible independently of V8 and introduces its own vulnerabilities. It's not sufficient for the runtime to be secure, but the new facilities Bun provides must also be vetted.

Bun/Oven are new, and similar in position to Node. Here are the hard questions I'd ask if I were on a security team and asked to review adopting Bun:

1. Will Oven adopt a security policy for Bun? (https://github.com/oven-sh/bun/security)

2. What measures is Oven taking to proactively detect and mitigate vulnerabilities? (e.g.: fuzzing, audits, bug bounties)

3. Will Oven support Zig development to avoid an existential risk in upstream vulnerabilities?

Re: Oven: The Company Behind Bun

#33

Post by tails4e »

1shooner wrote: post #21
behnamoh wrote: post #8

I love these funny names. First time I introduced HomeBrew to my gf, she was all laughing at the funny terms: keg - Program binaries created from source bottle - Program binaries downloaded cellar - Directory where kegs / binaries are stored tap - git repository cask - macos native binary (not used in Linux)

Ok, but I'm not really looking to my package manager for entertainment. To me this jargon is just needlessly obtuse.

Yep, I found homebrew confusing exactly because of this 'bespoke' terminology.

Re: Oven: The Company Behind Bun

#34

Post by naikrovek »

AaronFriel wrote: post #31

It's an incredible achievement, though I worry about the use of an unproven language (Zig) that lacks memory safety by design. JavaScript runtimes, especially those with JITs, have been plagued by vulnerabilities from memory safety, type confusion, and data races. Node.js, despite being based on V8, is still susceptible independently of V8 and introduces its own vulnerabilities. It's not sufficient for the runtime to…

I am fairly confident that Zig does not lack memory safety by design; from what I understand, the language as a whole isn't even finished, and the memory safety design isn't like a GC'd language or like Rust, so people assume there isn't memory safety when in reality it is at least partially implemented.

Re: Oven: The Company Behind Bun

#35

Post by naikrovek »

gmassman wrote: post #24
1shooner wrote: post #21

Earlier quoted context omitted.

Ok, but I'm not really looking to my package manager for entertainment. To me this jargon is just needlessly obtuse.

I 100% agree. Cutesy names should end once the package name has been chosen. Package authors and contributors that overdo the thematic names should stick to writing fiction, not code.

"keg" and "bottle" are cutesy?

well, to see the exact opposite of "cutesy", please fork homebrew and give all of those things GUIDs for names, including all the packages a user could install; you'll soon see why the names chosen are quite acceptable, indeed.

Re: Oven: The Company Behind Bun

#36

Post by DangitBobby »

benreesman wrote: post #26

Are Bun and Deno in direct competition or do these projects address different markets?

They are roughly in competition, though Deno made the decision early on to largely split itself from the ecosystem and existing conventions of Node (and an enormous body of existing JavaScript packages on npm), whereas Bun did not. Bun, AFAIK, aims to be compatible with Node and existing the npm ecosystem.

Re: Oven: The Company Behind Bun

#38

Post by naikrovek »

latenightcoding wrote: post #3

"Oven, the company behind Bun, has raised $7m in funding" "Oven will provide incredibly fast serverless hosting & continuous integration for backend & frontend JavaScript apps" Isn't trying to dethrone node.js (by making Bun better and more popular) something worth pursuing on its own, or there is no money in that?

I am surprised every day at how much raw human effort has gone (and continues to go) into making JavaScript into a good language, when at most 1/20th of that effort could have been used to simply replace it with something that is good to begin with.

Re: Oven: The Company Behind Bun

#39

Post by andrei »

AaronFriel wrote: post #31

It's an incredible achievement, though I worry about the use of an unproven language (Zig) that lacks memory safety by design. JavaScript runtimes, especially those with JITs, have been plagued by vulnerabilities from memory safety, type confusion, and data races. Node.js, despite being based on V8, is still susceptible independently of V8 and introduces its own vulnerabilities. It's not sufficient for the runtime to…

> 2. What measures is Oven taking to proactively detect and mitigate vulnerabilities? (e.g.: fuzzing, audits, bug bounties)

We're huge fans of bun at Fuzzbuzz (waiting for it to get a bit more production-ready). If Jarred's interested, we'd be happy to donate some compute to support fuzzing Bun.

@ fuzzbuzz.io

Re: Oven: The Company Behind Bun

#40

Post by brd529 »

quickthrower2 wrote: post #15
solardev wrote: post #6

Earlier quoted context omitted.

Isn't that what they're doing? Providing a monetizable system around open source software. It's the Vercel/Next.js model

I wonder if AWS is a sleeping crocodile ready to eat all these dev-focused paas companies up (by competing or takeovers) in a while. Maybe they are waiting to see who wins first.

I’m not sure where this movement went but efforts like SSPL [1] and similar aim to make it hard for cloud providers to resell an open source product as a service.

[1] https://techcrunch.com/2018/11/29/the-crusade-against-open-s...

Post reply on HN