Live data from Hacker News

Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

github.com

351–360 of 366 posts

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#351

Earlier quoted context omitted.

https://tsz.dev/sound-mode/ This is awesome. Typescript really needs more of this. I hope this gets more publicized and perhaps get adopted by Microsoft. I am not sure you should call it sound mode though. > It is not a mathematical proof of soundness, and it does not make third-party .d.ts files truthful. Here there are two completely unrelated things First, soundness is a mathematical thing (sorry). If something is…

Thank you for the feedback. I think I should rename the "Sound Mode" to something more honest. "Strict" is already taken so I should think of a better name. Making tsz compatible with tsc and making it sound is mathematically impossible. The history of this stuff ( https://hegel.js.org ) is telling. If you really make a sound JS checker, nobody will really use it unless you build an entire ecosystem as big as npm wit…

> TypeScript's decision to embrace existing npm ecosystem and layering .d.ts on top was a very practical decision that made it so successful.

I don't think this is the problem.

I mean, ok, the first part of the problem is that typescript can't or won't represent at the type level some real world Javascript constructs. But that's understandable since Javascript can get arbitrarily complicated. (you could do a survey on npm and make a type system strong enough for all existing libraries, but this would probably be too complicated to use)

So this is not by itself too bad if, for each instance of non-representable APIs, you wrote a wrapper library that called the bad library but gave you a perfectly good API to work with. Similar to how in Rust you are supposed to wrap unsafe libraries with a safer, higher level API on top. (except it' s not about memory safety, but type safety. but the same reasoning applies, it's just lower stakes since UB is not involved)

Bur the other, more fundamental problem is that for some godforsaken reason, Typescript decided it was okay to lie with types. Some operations return the wrong type rather than a more honest type. This is not caused by the fact that Typescript has to work with libraries in npm, it's entirely self inflicted. Elsewhere in the thread someone gave an example: stringArray[0] has type string when it should be string | undefined.

This (and all other instances of deliberately lying with types) is why Typescript is unsound. Here's a list of things that cause unsoundness (not sure if complete) https://effectivetypescript.com/2021/05/06/unsoundness/

If all those things are patched up, Typescript can be in general mostly sound, even though it has to work with npm libraries and even though you need to trust other people's .d.ts files. To gain full soundness on your application code, you just need to write wrappers to work around the most egregious cases (which should be a minority). Again, the same situation as Rust is supposed to be: it's in general sound but when you need to interact with bad stuff you write a wrapper. (Note: Rust has its shares of unsoundness, but contrary to Typescript, Rust has a plan to eventually patch them up, even if this causes incompatibilities down the line)

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#352
post #67

I was a little shocked that they could get it fully working in a week to be honest. My side project is a very similar ambition ( https://tsz.dev ) but I am in no way claiming success. i keep adding more and more tests to ensure things works. Even after all of TypeScript's own tests pass I am finding bugs which I was totally expecting. The bar for matching tsc's behavior is really _really_ high. see: https://github.co…

> verification should be 100x more robust now that we can output code at this rate.

If you believe that having enough tests can save an LLM codebase - I have bad news for you. You can write a test for every single interaction ever written in typescript and it'd not be even close to 10% coverage.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#353

Earlier quoted context omitted.

Zig is every bit as fast with typically even lower memory footprint as Rust. The main thing Rust promises that Zig cannot already do natively is memory safety. This is not about Python vs Rust. It is one systems language vs another.

Notably the rewrite managed to also both reduce binary size and reduce compile time. Given it's largely a straight non idiomatic migration, that's surprising to me.

-9MB on Win/Linux and unchanged on Mac. It wasn't a 100% pure idiomatic migration there was some cleanup done.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#354

So a "robobun" clanker responds to the issue and writes a fix (probably just papering over it). This is what Anthropic wants: Let the users do the work, train the fricking bot and claim the credit. If you find a bug, just go straight to blog posts and CVEs to denounce this idiocy. It ranks higher on Google.

That's not how CVEs work.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#355
post #340

Earlier quoted context omitted.

Yes, but "fixing some fundamental Node problems" is a low bar, hardly the high mark of ambition now, was it? And to offer a counter example, something like Dart appeared much more ambitious to me.

OK. But without changing programming laguages, "fix some fundamental Node problems" vs "don't fix those problems, just run them faster, and maybe inline the most popular dependencies"... Surely we can agree that one of those positions is relatively less ambitious?

Well it remains to be proven how they can make a business out of fixing nodejs fundamental problems.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#356
post #288
post #286

Earlier quoted context omitted.

What’s the downside? Go does library versioning very well, IMO, but I like to hear other opinions.

The core issue is philosophical. Whether you happen to have public infrastructure which provides a web front-end for your git repository, and what exact server that web front-end happens to be hosted on, ought to be completely incidental to compiling source code. But since you ask, Go is the best example of how this can go terribly wrong in practice, IMO. Here are just a few scattered pain points I've encountered: *…

All great examples why I only touch Go when it cannot be avoided, like Docker related projects.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#357
post #70

What I don't understand is if they were going to translate Zig to unsafe Rust, why not just build a translation tool for it? You could do a one-to-one mapping of language constructs, hardcoding patterns in your codebase, and as one friend put it "Tbh they could've just hooked up zig translate-c to c2rust". They would get deterministic translation, would probably have not been a heavy investment to build, and the outp…

> "Tbh they could've just hooked up zig translate-c to c2rust". Have you ever seen what comes out of c2rust? It's awful. It relies on a library of functions which emulate unsafe C pointer semantics with unsafe Rust. A few years ago, when I was struggling with bugs in OpenJPEG (a JPEG 2000 decoder), someone tried running it through c2rust. The converted unsafe rust segfaulted at the same place the C code did. It's com…

> The converted unsafe rust segfaulted at the same place the C code did

Isn't that exactly what you want from that kind of tool? Otherwise it means it's changing how stuff works and in this specific case that would be good but in most cases unwanted.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#358
post #355
post #340

Earlier quoted context omitted.

OK. But without changing programming laguages, "fix some fundamental Node problems" vs "don't fix those problems, just run them faster, and maybe inline the most popular dependencies"... Surely we can agree that one of those positions is relatively less ambitious?

Well it remains to be proven how they can make a business out of fixing nodejs fundamental problems.

I think the Anthropic acquisition means that Bun isn't in that business anymore. Bun is still fixing fundamental Node problems, but that's no longer the business.

The business value the Bun team needed to deliver (to make the acquisition pay out) might very well be this controversial, but nevertheless spectacular, 6-day Zig→Rust port.

But beyond that, now Bun is just tooling used internally at Anthropic, which also happens to be open-source.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#359
post #358
post #355

Earlier quoted context omitted.

Well it remains to be proven how they can make a business out of fixing nodejs fundamental problems.

I think the Anthropic acquisition means that Bun isn't in that business anymore. Bun is still fixing fundamental Node problems, but that's no longer the business . The business value the Bun team needed to deliver (to make the acquisition pay out) might very well be this controversial, but nevertheless spectacular, 6-day Zig→Rust port. But beyond that, now Bun is just tooling used internally at Anthropic, which also…

I also meant Deno as well.

Re: Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust"

#360
post #359
post #358

Earlier quoted context omitted.

I think the Anthropic acquisition means that Bun isn't in that business anymore. Bun is still fixing fundamental Node problems, but that's no longer the business . The business value the Bun team needed to deliver (to make the acquisition pay out) might very well be this controversial, but nevertheless spectacular, 6-day Zig→Rust port. But beyond that, now Bun is just tooling used internally at Anthropic, which also…

I also meant Deno as well.

Oh. Well, then, yes I agree. It certainly does remain to be proven if anybody can make "Node, but better" a business.

Certainly the recent layoffs¹ of ~half-or-so of the Deno team doesn't bode well for it, as AFAIK Bun was the only other significant player trying (to make it a business).

¹: https://www.reddit.com/r/Deno/comments/1rwjaeb/whats_going_o...

Post reply on HN