Hacker Newsnew | past | comments | ask | show | jobs | submit | conartist6's commentslogin

Is anyone talking about any web page being a zip bomb even without JS turned on?

How would that work? I think you posted something on the github but I don't think what you're conceiving here is possible with this API. It just reroutes HTML insertions from the template to a different location, there is no duplication.

The Content-Encoding header allows any page to be a literal zip-bomb. That's how early versions of Tailwind worked; you'd deliver a 50KB Brotli payload that exploded into 2MB of CSS ( https://v1.tailwindcss.com/docs/controlling-file-size ). So pages potentially being zip-bombs is already a well-accepted part of the Web platform.

Sure, but how is this related to out of order streaming?

<div> <?marker name="placeholder2"> </div>

<template for="placeholder2"> <?marker name="placeholder1"> <?marker name="placeholder1"> </template>

<template for="placeholder1"> <?marker name="placeholder"> <?marker name="placeholder"> </template>

<template for="placeholder"> Here is some <em>HTML content</em>! </template>

Before you couldn't make this dangerous (without JS) because there was no way to auto expand the templates


This would end up as:

<div> Here is some <em>HTML content</em>! <?marker name="placeholder"> <?marker name="placeholder1"> </div>

(only the first matching marker set is replaced.


So... you'll have to write Javascript that goes and replaces the additional markers with the stuff they're supposed to expand to? Because what I see there is just a state of partial evaluation, and that leads me to ask (and would lead anyone to ask) how evaluation of all substitutions can be completed...

At the moment - you can treat it as a single "search & replace", and not as a replace all. And yes JS can do the rest atm. Hopefully introducing this (and processing instructions in general) can lead to additional enhancements in the future. But it would have to be gradual, kind of like how modern CSS evolved.

It just feels half-done. This seems to be a loose end left hanging because this is all rooted in theory and not in practice. In theory it doesn't matter if you have to polyfill half the builtin feature with JS because otherwise it doesn't work. In practice, yes it matters.

Oh nooooooo are you kidding? That's beyond horrific.

That's really really really awful


As far as I can tell, this is not actually allowed by the current proposal. The definition of the "find markers" algorithm in https://github.com/whatwg/html/pull/11818 requires that the <?end> marker be a sibling of the <?start> marker in the DOM, so they can't have different parents like this.

Well, you're allowed to write it, but the browser will just ignore the <?end> marker. The range will end at the </em> tag, the same place https://github.com/WICG/declarative-partial-updates/blob/mai... says it goes by default if you don't write the <?end> at all. (That default wouldn't make a ton of sense if patch ranges were allowed to break out of their parent elements like this.)

Jake Archibald thinks it'd be cool to use a similar syntax to do CSS highlights, but there are other problems with that (like not being able to create overlapping ranges), and he's not on the Chrome team that's pushing this proposal.


We're working together with Jake on this. I do hope that processing instructions can help with highlights in the future.

(and this is correct, the start/end marker need to be siblings. You can't input something that starts in one parent and ends in another.)

It specifically lists H1B as non-immigrant visa on that page, so if you are here working at Google you must leave the country.

yes, because as we know from history without agents there is no internet or technology or anything

What do you mean?

I'm saying that AI is going to develop software from here on. I don't think you can expect that a human is going to review every line of code. Not that it's good, but that's just how it is. It's not so different from manufacturing. A human is not reviewing every weld. I see a lot of sloppy beads, but in a lot of cases, it's good enough.


I'm saying that's self-evidently ludicrous. Software is not like welding. Do you think Notch could have become rich and famous by welding? How about Bill Gates, famous as a really consistent welder?

> A human is not reviewing every weld.

On civil engineering projects, I’m pretty sure a human reviews each weld. For mass-produced things, maybe not, although a company would not look good in a lawsuit if they had inadequate inspection procedures which allowed a fault causing injury or death to occur.


> On civil engineering projects, I’m pretty sure a human reviews each weld.

Nope. It’s sampled.


Yeah because they are not auto regressively generated!

There's no way that AI develops software from now on. It isn't remotely good enough for that, nor has it really gotten better in the past few years. We're going to see a push to use AI, then a move away from it once the dreadful quality of AI slop becomes too obvious to ignore.

It hasn't gotten better in the past few years? Come on...

in some ways it remains exactly the same technology with the same critical weaknesses

I have a very, very hard time believing that. Surely the acquisition left his wealth largely in the form of Anthropic stock, so his personal definition of success is "rep Anthropic so my stock goes up" and at that point he has succeeded.

Me, I still have to be competent to succeed. I don't just get to declare that because I used AI the effort was a success, and I have 0 desire to work with those kinds of people.


see that's fine with me if they want to take a year or two of human time and do the rewrite properly

this is a piece of software with no architecture, and whose owners have no regard or respect for architecture. I can virtually guarantee that on average every bug they fix will create one new bug, because that's what it's like to work on software with no intentional architecture


What are you talking about?? Bun in Rust is a port, almost exactly the same code base on a different syntax. The architecture did not change at all. Amazing how people comment without even knowing what they are talking about.

Zig and Rust are significantly different languages. If bun has a good architecture in zig (which I don't know if it does or not), that doesn't necessarily mean it had a good architecture for rust. A direct translation of zig code would probably result in pretty unusual rust code, and probably a lot more unsafe usage than if it had been originally written in rust.

I don’t really understand this objection. For every tool that I use, am I supposed to divine the best underlying language for it and then determine whether or not it is written in that language? Don’t I have better things to do?

Because of borrow checker you would build data structures differently in Rust compared to Zig. Automated translation simply maps Zig constructs onto unsafe Rust code. I have no idea how feasible it is to go from totally unique way of using Rust to mimic Zig to idiomatic Rust.

I understand that. That’s a specific example of an inaptness moving from one language to another. That’s not what I’m talking about.

I am asking if we are expected to understand this hypothetical condition about all possible tools that we use. Should I have to worry that something is written in Python when it should’ve been written in C? It just seems like that in order to have a big concern here, I had to be really invested in what language Bun used. I guess the whole matter makes more sense if people are REALLY mad about something else and the choice of language is supposed to serve as a more respectable thing to be mad about.


I'm not saying that bun shouldn't be written in rust. I'm saying that since it was originally written in zig, there were undoubtedly architecture and design decisions that were made that made sense in zig, but not so much in rust. When rewriting something in a different language, especially one significantly different than the original it is common to need to re-architect some things, and mechanically translating line by line from one language is probably going to result in some low quality code, even if the original was decent.

I think that using AI to translate bun from zig to rust might produce a good starting point. But it was done one file at a time, with minimal human review, and I'm skeptical that the result is quality maintainable code.


I don't want to say that skepticism is unwarranted, but I'm not sure we apply this level of scrutiny with any kind of defensible evenness. I just can't think of a single open source project I use where I'm aware of their refactor cadence and practice. I'm just...not checking in on their feature branches and stuff, and I think most people aren't. I couldn't tell you if the uv maintainers work at 3AM while high on drugs or at 9:30 AM wearing FORTRAN blue ties.

I dunno. I think my sense here is that the bun maintainers did something shocking and dramatic using AI and people are shocked and dramatized. They're not WRONG to be so. But I don't know that the shock comes out of any generalized duty of care we have toward open source tooling. I think the uncomfortable point that bun has been releasing for 6 months with smaller AI code edits hasn't really been reckoned with. If we were actually this invested in what was happening, the migration would've begun months ago when it was clear they were using agents to ship code faster than they were willing to review.


What is that tool in relation to the rest of your workshop though? If it's a simple hammer that you can swap out for $20 and you only use it once a month, who cares what kind of metal it's made out of, as long as it works. But if the $6,000 4-axis CNC machine that's at the heart of your machine shop and every minute of downtime on it costs you money, if it's starting to rust, no, you don't have better things to do than to look into what it's made of.

Yeah what if the tool is a JavaScript runner released for free?

What is being expressed here about Bun is using the language of due diligence but doesn’t seem to adhere to any of the sensibilities. Should we all be auditing our toolchains to understand internal decisions that each toolmaker undertakes? Maybe! DO WE? Absolutely not. The level of scrutiny bun is getting is *unusual*. They just did an unusual and dramatic thing, so it’s not surprising. But I just don’t believe that bun is being deprecated due to normal engineering discipline that we are constantly carrying and applying everywhere. That’s…just hard to buy.


We're all only human, so the deprecation happening is gonna have some biasing going on due to how people feel about AI, yeah. JavaScript runners is a whole ecosystem separate from, say, Python. If Python went and said that the next version of Python, we're using this new AI transpiled runtime that we baked for nine days, people would also freak out "due to normal engineering discipline that we are constantly carrying and applying everywhere." The real question then is just how far off from normal is it? Maybe you don't do audits that you think you should be doing, but eg moving from Python 3.10 to 3.12 can be as rigorous or as yolo as you want. And those versions are old, too. Other ecosystems are going to take their time as well. LLVM isn't going to switch over to something AI banged out in nine days. They're going to have a long dragged out period where they run things in parallel for a while until everyone feels okay about it. If they'd even do something like that.

Very amazing indeed. Here you are making bold assumptions about a huge pile of code not a single human being has ever read in any meaningful amount.

The only assumption you need to make is how the process went about, which was described by Jarred on a HN comment when the PR was first discussed: they had prompt that described exactly how things should be translated, for each "pattern" they were using in Zig, an appropriate equivalent was described in Rust. Zig and Rust are not that different, both are system languages and things can be done similarly in both languages, so architecture-wise I would think the exact same thing would work fine. I am not sure whether the LLM actually wrote a transpiler which just followed the rules, or if it did the job itself, since that information is not public yet, as far as I know, but my guess is that the LLM wrote a transpiler to do the job, then reviewed/fixed compilation issues, then fixed tests. And I'm pretty sure some human interaction was part of that as well.

>The only assumption you need to make is how the process went about, which was described by Jarred

This is not how the process went. This is how Jarred thinks it went, a huge difference.

>my guess is that the LLM wrote a transpiler to do the job

My guess is different. I think one agent translated code, another compiled it, feeding errors back into translator to fix. Then last agent modifies code to fix tests. All governed by a set of md files.


So now you've gone from making assumptions to making up wild stories territory. Well, the commit granularity isn't that of transpiler passes, and more importantly, it's completely irrelevant to how the majority of the code hasn't even been read by anyone.

Nobody reviewed resulting code. Maybe all tests are empty and this is why they pass. Maybe tests were modified to pass because this is the only thing LLM could do to make them pass. Maybe it hallucinated something in the process. We have no idea.

We do have an idea, and it contradicts your guess: https://news.ycombinator.com/item?id=48133806

You suggest there is only JS tests that do not need a rewrite? This is crazier than I thought…

I took tests as an example. There are so many other things that can go wrong. Rust and Zig standard libraries may have different semantics not picked up by AI. Like one guarantees insertion order of a dictionary and other does not. Differences in how runtimes react to Linux signals, how they do file IO, etc.

If I were a Bun user I would be moving off from bun unless it has excellent test coverage (which I think it does not). During a normal release cycle I offered a small increment of functionality with small number of issues. Here I’ve been offered a complete rewrite, potentially having thousands of issues. I don’t want to be a guinea pig in this experiment.

I’m genuine curious how this will unfold.


I wouldn't call it politics. I've seen enough people aim a gun at their foot and pull the trigger. They'll never thank you for stopping them, they just want to be left alone while they do it.

So, great, if this dude wants to regress through the workforce to a level of engineering maturity I associate with a high school student, I don't wish to try to be the one to stop him. Doesn't mean I'm gonna follow him. It's possible to be smart enough to just not walk into the tarpit. He's going in, I'm not.


I can't help thinking about Mitchell Hashimoto's recent post about "whole companies consumed by AI psychosis." I read that as naming Bun without directly naming Bun...

I'm the opposite. Trust can only be given so long as it isn't used to facilitate rampant abuse. Open abuse is rampant now. I'll slam the door in your face if you try to slop on me because that's the only way anyone is ever going to learn at the scale a lesson needs to be learned.

And of course I notice the people posting the massive slop screed don't seem to have thought critically about it at all. After all, if they had time to read it thinking critically, they probably would have had time to write it.


> Who's to say AI won't be able to just rewrite the code cleanly while keeping the core idea within 6, 12, or 18 months?

Well lets say it's 18 months from now and AI writes lovely, ideal code. At that moment, the AI would have eliminated the need for AI, right? If the code is good, you can just read it and edit it.

The selling point of AI is that you will embrace that idea that you code is a mile-high stinking garbage heap, so that any human would be overwhelmed by the stench. Only so long as the best strategy for engineering is to pile the garbage as high as possible as fast as possible will the best tool for engineering be AI.

So my counter argument is: just wait 18 months and you can completely skip adopting AI.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: