Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fabrice Bellard Releases MicroQuickJS

github.com

Post reply on HN
Print view View original

371–380 of 594 posts

Re: Fabrice Bellard Releases MicroQuickJS

#371

Post by virtualwhys »

alexdowad wrote: post #251
pizlonator wrote: post #127

Earlier quoted context omitted.

Yeah QuickJS is great. I bet MQJS will also be very popular. Quite impressive that bro is going to have two JS engines to brag about in addition to a lot of other very useful things!

> Quite impressive... Yes, quite! Monsieur Bellard is a legend of computer programming. It would be hard to think of another programmer whose body of public work is more impressive than FB. Unfortunate that he doesn't seem to write publicly about how he thinks about software. I've never seen him as a guest on any podcast either. I have long wondered who the "Charlie Gordon" who seems to collaborate with him on everyt…

It would be odd, but that name does ring a bell, Charlie Gordon is the central character in the ever poignant, Flowers for Algernon.

Maybe Bellard identifies with the genius, but fears the loss of it.

Re: Fabrice Bellard Releases MicroQuickJS

#372

Post by TheTaytay »

alabhyajindal wrote: post #86
simonw wrote: post #76

Earlier quoted context omitted.

Forget about the AI bit. Do you think it's interesting that MicroQuickJS can be used from Python via FFI or as a compiled module, and can also be compiled to WebAssembly and called from Node.js and Deno and from Pyodide running in a browser? ... and that it provides a useful sandbox in that you can robustly limit both the memory and time allowed, including limiting expensive regular expression evaluation? I included…

It's interesting but I don't think it belongs as a comment under this post. I can use LLMs to create something tangential for each project posted on HN, and so can everyone else. If we all started doing this then the comment section will quickly become useless and not on point.

Tangential would be “I wrote a Fibonacci function in this and it worked, just like it said on the tin!”

Compiling this to wasm and calling it from python as a sandboxed runtime isn’t tangential. I wouldn’t have know from reading the project’s readme that this was possible, and it’s a really interesting use case. We might as well get mad at simonw for using an IDE while he explored the limits of a new library.

Re: Fabrice Bellard Releases MicroQuickJS

#373

Post by MobiusHorizons »

Reubend wrote: post #285
MobiusHorizons wrote: post #145

Earlier quoted context omitted.

I was surprised by this one that only showed up lower in the document: - Date: only Date.now() is supported. [0] I certainly understand not shipping the js date library especially in an embedded environment both for code-size, and practicality reasons (it's not a great date library), but that would be an issue in many projects (even if you don't use it, libraries yo use almost certainly do. https://github.com/bellard…

Good catch. I didn't realize that there was a longer list of restrictions below the section called "Stricter mode", and it seems like a lot of String functions I use are missing too.

> String functions: codePointAt, replaceAll, trimStart, trimEnd.

As I read it, these are supported es5 extensions, not missing as part of stricter mode.

Re: Fabrice Bellard Releases MicroQuickJS

#374

Post by TheTaytay »

alabhyajindal wrote: post #142
keeganpoppen wrote: post #108

Earlier quoted context omitted.

but there is signal in what people are inspired to do upon seeing a new project-- why not simply evaluate the interestingness level of these sorts of mashups on their own terms? it actually feels very "hacker"-y to go out and show people possibilities like this. i have no particular comment on how "interesting" the derivative projects are in this case, but i have a feeling if his original post had been framed more li…

I agree that there is signal, and that phrasing his original post as you pointed out would have been better. My issue is that the cost, in terms of time, for these experiments have really gone down with LLMs. Earlier, if someone played around with the posted project, we knew they spent a reasonable amount of time on it, and thus care about the subject. With LLMs, this is not the case.

That’s true - the assumed time is different now. We have to judge it on the content/findings of the experiment, rather than the fact that someone experimented with it. I share your frustration with random GitHub repos though. Used to, if someone could create a new GitHub repository with a few commits, there was likely to be some intelligence or quality behind it, but I commonly stumble across vibe coded slop with AI-slop READMEs. So maybe you are describing a similar reaction here in HN posts.

Re: Fabrice Bellard Releases MicroQuickJS

#375

Post by MobiusHorizons »

kettlecorn wrote: post #333
MobiusHorizons wrote: post #116

Earlier quoted context omitted.

What is the purpose of compiling this to web assembly? What web assembly runtimes are there where there is not already an easily accessible (substantially faster) js execution environment? I know wasmtime exists and is not tied to a js execution engine like basically every other web assembly implementation, but the uses of wasmtime are not restricted from dependencies like v8 or jsc. Usually web assembly is used for…

As I noted in another comment Figma has used QuickJS to run JS inside Wasm ever since a security vulnerability was discovered in their previous implementation. In a browser environment it's much easier to sandbox Wasm successfully than to sandbox JS.

That’s very interesting! Have they documented the reasoning for that approach? I would have expected iframes to be both simpler and faster sandboxing mechanism especially in compute bound cases. Maybe the communication overhead is too high in their workload?

EDIT: found this from your other comment: https://www.figma.com/blog/an-update-on-plugin-security/ they do not address any alternatives considered.

Re: Fabrice Bellard Releases MicroQuickJS

#376

Post by fc417fc802 »

somat wrote: post #363
fc417fc802 wrote: post #358

Earlier quoted context omitted.

I don't see why? Your window width will presumably be tailored to accommodate common scenarios in your preferred tab width. More than that, in the general case for common C like languages things should almost never be nested more than a few levels deep. That's usually a sign of poorly designed and difficult to maintain code. Lisps are a notable exception here, but due to limitations (arguably poor design) with how th…

I find it tends to be a structural thing, Tabs for indenting are fine, hell I prefer tabs for indenting. But use tabs for spacing and columnar layout and the format tends to break on tab width changes. Honestly not a huge deal but as such I tend to avoid tabs for layout work.

I completely agree, hence my point about Lisps. In terms of the abstraction a tab communicates a layer of indentation, with blocks at different indentation levels being explicitly decoupled in terms of alignment.

Unfortunately the discussion tends to be somewhat complicated by the occasional (usually automated) code formatting convention that (imo mistakenly) attempts to change the level of indentation in scenarios where you might reasonably want to align an element with the preceding line. For example, IDEs for C like languages that will add an additional tab when splitting function arguments across multiple lines. Fortunately such cases are easily resolved but their mere existence lends itself to objections.

Re: Fabrice Bellard Releases MicroQuickJS

#377

Post by rramadass »

lioeters wrote: post #362
rramadass wrote: post #345

Earlier quoted context omitted.

> It would be hard to think of another programmer whose body of public work is more impressive than FB. I am of the firm belief that "Monsieur Fabrice Bellard" is not one person but a group of programmers writing under this nom de plume like "Nicolas Bourbaki" was in Mathematics ;-) I don't know of any other programmer who has similar breadth and depth in so many varied domains. Just look at his website - https://bel…

The last link has more info than I've seen elsewhere. Here's an altenative link with PDF download. https://www.ipaidia.gr/wp-content/uploads/2020/12/117-2020-f...

Thanks. Post it to HN since i don't think most folks know of this. It would be a shame to have it be buried in the comments.

Re: Fabrice Bellard Releases MicroQuickJS

#378

Post by leptons »

hnlmorg wrote: post #233
antirez wrote: post #111

If this had been available in 2010, Redis scripting would have been JavaScript and not Lua. Lua was chosen based on the implementation requirements, not on the language ones... (small, fast, ANSI-C). I appreciate certain ideas in Lua, and people love it, but I was never able to like Lua, because it departs from a more Algol-like syntax and semantics without good reasons, for my taste. This creates friction for newcom…

Lua only departs from norms if you’ve had a very narrow experience with other programming languages. Frankly, I welcome the fact that Redis doesn’t use JavaScript. It’s an abomination of a language. The fewer times I need to use it the better.

Every programming language is an abomination depending on the perspective.

Re: Fabrice Bellard Releases MicroQuickJS

#379

Post by leptons »

foresto wrote: post #114

I wonder if this could become the most lightweight way for yt-dlp to solve YouTube Javascript challenges. https://github.com/yt-dlp/yt-dlp/wiki/EJS (Note that Bellard's QuickJS is already a supported option.)

There's no reason it has to be lightweight, what it has to do is solve Youtube challenges without workarounds due to limited Javascript syntax.

Re: Fabrice Bellard Releases MicroQuickJS

#380

Post by simonw »

MobiusHorizons wrote: post #369
simonw wrote: post #284

Earlier quoted context omitted.

... whoa, I don't know how I missed it but I hadn't seen STPyV8 before. I'd seen PyV8 and ruled it out as very unmaintained. One of my requirements for a sandbox is that it needs to me maintained by a team of professionals who are running a multi-million dollar business on it. Cloudflare certainly count! I wonder what they use STPyV8 for themselves? ... on closer inspection it doesn't seem to have the feature I care…

I’m sure you are aware the sandbox that requires maintaining is v8 itself. Of course there are ways for the wrapper to break the sandbox by providing too much in thr global context, but short of that, which the application code could easily do as well, I don’t see why a wrapper should require significant resources to maintain beyond consuming regular updates from upstream. Is there some other reason you hold such a h…

None of those v8 solutions provide what I need:

1. The ability to restrict the amount of memory that the sandboxed code can use

2. The ability to set a reliable time limit on execution after which the code will be terminated

My third requirement is that a company with real money on the line and a professional security team is actively maintaining the library. I don't want to be the first person to find out about any exploits!

Post reply on HN