6 ms·

"Even it that'd be the best code and design in the world, I won't use it. I don't trust it." Nothing about this sentence makes sense. What don't you trust abou

by jhack 3mo ago

"Even it that'd be the best code and design in the world, I won't use it. I don't trust it." Nothing about this sentence makes sense. What don't you trust about code you can see and audit yourself? What's untrustworthy about "the best code and design in the world"?

UqWBcuFx6NV4r 3mo ago
I do not agree with OP but to not understand “i don’t have the knowledge and/or resources to audit/review a language port of an entire JS runtime, but I still understand that a big-bang language port is something to be cautious of” is almost wilful tonedeafness
cmeacham98 3mo ago
I don't have the time to audit all the code in a JavaScript runtime myself, so I am forced to make assumptions about the quality of the code based on my trust of the authors. Additionally, even if the code is good today, I am trusting their process will produce good code tomorrow (as migrating to/from bun has a non-trivial cost). A single person approving the code of an LLM is not such a process with today's technology.
- TalkingCodeMonk 3mo ago
  jhack's perspetive is something that is all too common in tech. The implication that if code is open source the owners and maintainers don't owe consumers anything because "you can always fork or build it yourself"... as if that were ever possible for the average user, or in a digital world where anything you do with a computer depends on endless recursive sub-dependencies. It's analogous to saying "it's your fault because you didn't read the T&C's", when all the T&C's you've implicitly agreed to already would take more than a human lifetime to read and understand. That is not a reasonable implication or expectation for the vast majority of people, the vast majority of the time; therefore it is logically corrupt, and should not be entertained. This is ofcourse a fair point of view for 1-few person codebases built for fun, or to solve their own problems, open sourced out of the kindness of their hearts, but when the open source code is built or maintained as part of a job function (receiving a paycheck) &/or to generate profit (either directly or indirectly to influence standards, gain market share, etc) the open-sourcing is more of a means to build trust and becon attention or adoption in the age of relentless enshittification. Open sourcing should not be an accepted path for profit seeking orgs or individuals to exploit and screw over consumers, as though they are eternal beta testers whose trust and dependence are worthless externalities. It also completely ignores the time and effort consumers must invest themselves to learn your product, workaround any errors, and build it into their workflow. That is arguably worth significantly more than whatever fee they could pay you for your code.
  - Eufrat 3mo ago
    I still really don’t understand what is so entitled about asking for a level of base empathy and care from maintainers. People now yell at you that their only obligation is whatever is spelled out in the license they attached to the code. I think this is the same place where the logic of Code = Law comes from. People who think that you can encode the legal/judicial system into a set of axioms. This is not how the law works nor is it how it is taught and asserting this is a fundamental misunderstanding of human systems. It is incredibly destructive when people start applying maths as ground rules for human interaction. People do not live in black/white. We live in grey. I am certainly not old enough to have experienced it, but I would venture a guess that the reason the BSD/MIT licenses originally existed was so that the universities had a CYA clause. I think you can see this erosion from a group of people sharing software in academic and hobbyist circles into weird legal absolutism as software becomes more of a business. For instance, Bill Gates’ famous letter to hobbyists or the PKZIP fiasco.
    - scared_together 3mo ago
      > I still really don’t understand what is so entitled about asking for a level of base empathy and care from maintainers. > People now yell at you that their only obligation is whatever is spelled out in the license they attached to the code. Let’s turn your implied question around: if a person wants to share code without any expectation of care and maintenance, what should they do? Is the entire concept bogus, and the developer should just keep the code to themselves forever? Or put a “DO NOT USE FOR YOUR BILLION DOLLAR COMPANY” in a README? What communication other than the license could reasonably be provided? I think the person you’re responding to made a pretty good point that open-source is sometimes the passion of an unpaid 1-person “team” and sometimes the product of a VC-funded attempt to buy goodwill. The idea that asking for more from maintainers is entitled is clearly suitable for the former case but not the latter. Now that Bun has been bought out perhaps they are more deserving of scrutiny.
      - Eufrat 3mo ago
        Textualism is a scam wrapped in academic regalia. It is implausible on its face and arguing that “we only have the text to go off of” sounds nice and is demonstrably not how the law has been parsed. > What communication other than the license could reasonably be provided? Nobody encodes everything in text. No law can be fully represented in text. The law is a combination of many things including norms and customs at a moment in time. The law as written is a framework. This can be demonstrated pretty obviously in just how some laws are written intentionally vague because we have human beings to parse them for meaning and context. A legal/justice machine does not and will never exist as long as these are frameworks for human interaction. This is not a computable problem and attempting it to frame it as one is deeply harmful. I have met a lot of EECS folks who think that the law is just a set of rules to be applied and that a consistent and fair decision will just “happen”. This is ridiculous and anyone who thinks this should be smacked with a copy of the Bluebook. There is also kind of a spirit vs. letter of the law issue here. The intention and spirit in which this software is given out should and must inform how the law is interpreted. Arguing this isn't how the law works is just wrong. I stress this because it shows just how fuzzy the law really is. I think people want bright lines where they don't exist. I don't know what the obsession with this is, but it is unproductive. I certainly understand that this desire to return to a more nuanced and more empathetic view of all of this has gradients, but I think I am just deeply saddened how any attempt to suggest that there were and should still be some implied cultural norms regarding expectations and the response from some folks really sounds like an angry Ayn Rand instead of a discussion about what that means. It’s just a blanket rejection for a lot of people here. Software is for people. The consumers are ultimately people. People are the only things that matter. Like, you start a business and society—through the government and law has said—hey, you can’t refuse to serve people based on certain reasons. This is actively being attacked by some people with the same pathetic argument of, “You can’t tell me what to do. I hate X and it’s my free speech right to tell them to go pound sand. I never agreed to the civil rights acts!” It’s like the stupidest version of Ron Swanson.
- pjjpo 3mo ago
  I think this is precisely why I don't mind it that much. I can't audit a huge codebase like a JavaScript runtime, whether the code is by a human from scratch or not. I just have to trust it as a black box. I've seen LLMs produce terrible code indeed, but I have also seen humans produce terrible code. I haven't dug in to JS runtimes specifically but have read plenty of code in openjdk and cpython - there are many points that could be done better, but there's also no point since it's working, and keeping working code unchanged tends to be a smart decision in software engineering. So of course the last point brings up whether it was a good idea to rewrite bun if it was working. Apparently the bun team thought the difficulty in getting changes in zig upstream meant it is. I don't intend to hold LLM code to a higher bar than human code - notably if the runtime continues to work, that is as good as I can expect from what is otherwise a huge black box of extreme programming (not that agile kind).
  - kennywinker 3mo ago
    The difference is you can evaluate a small bit of the output of a human or a team of humans and expect all their other code to be roughly in the same ballpark of quality. An LLM can’t be trusted to produce code and make higher level project structure choices of the same quality at all times, because it can’t be trusted at all - trust is for deterministic systems. But still it begs us to trust it. Every prompt that yields good results sets us up to expect good results, so we get lazy - and then the next prompt it spews out garbage.
    - simonra 3mo ago
      As long as the odds are good enough (and/or you know the distribution), there is nothing wrong in relying on and profiting from stochastic systems despite not every outcome being positive. What matters is the sum of outcomes, not the individual ones. It means you need to be able to handle failure, but you should always have a good grip on how to correct if you intend to set things out in the real world which messes up everything always anyways.
      - kennywinker 3mo ago
- mingqiz 3mo ago
  I honestly trust code reviewed by llms multiple rounds more than human reviewed code. Here is the thing. I don't know the human who wrote the code but i am familiar with the model they use, which might already be better than many human.
nozzlegear 3mo ago
How can you trust that they won't just rug pull all of the code you've hand-audited when they merge some 1800 file PR written by an LLM? Even if you decide to hold off on any security updates or minor bumps until you can hand audit again, what's the point? You could just go back to Node where they aren't engaging in a modern day Ship of Theseus every other week.
unknownfuture 3mo ago
It's called "mileage". This new codebase doesn't have any. Who knows what gremlins lurk in some of its darker corners.
- Jarred 3mo ago
  > new codebase doesn’t have any Claude Code & Prisma use it as of last week.
  - marshray 3mo ago
    That comment had me reaching for the skull emoji.
  - vips7L 3mo ago
    Claude is riddled with bugs. That doesn’t inspire confidence.
  - dijksterhuis 3mo ago
    original comment: >> new codebase doesn’t have any > No longer accurate. As of last week, Claude Code (an incredibly popular CLI tool) runs on Bun’s Rust rewrite.
diatone 3mo ago
First word of second sentence: > Stability ie: lack of volatility, ie: integrity, ie: I know it does what it says and don’t have to second guess that.
pier25 3mo ago
It's not about the code or the use of AI. It's about the governance of the Bun project. Nobody knows if the Rust AI rewrite was a good decision from a technical pov. We do know it was a unilateral and drastic decision taken behind closed doors and imposed onto all Bun users. There was a poll on r/bun where only about 30% of users said they were going to use the Rust port. https://www.reddit.com/r/bun/comments/1u3j4d7/are_you_going_to_use_the_rust_port_of_bun/ https://www.reddit.com/r/bun/comments/1u3j4d7/are_you_going_... Even worse, users on the Zig version have been pretty much abandoned. Any future bug fixes, security patches, etc will only be released in the Rust version.

by jhack 3mo ago

UqWBcuFx6NV4r 3mo ago

I do not agree with OP but to not understand “i don’t have the knowledge and/or resources to audit/review a language port of an entire JS runtime, but I still understand that a big-bang language port is something to be cautious of” is almost wilful tonedeafness

cmeacham98 3mo ago

I don't have the time to audit all the code in a JavaScript runtime myself, so I am forced to make assumptions about the quality of the code based on my trust of the authors. Additionally, even if the code is good today, I am trusting their process will produce good code tomorrow (as migrating to/from bun has a non-trivial cost). A single person approving the code of an LLM is not such a process with today's technology.

TalkingCodeMonk 3mo ago
jhack's perspetive is something that is all too common in tech. The implication that if code is open source the owners and maintainers don't owe consumers anything because "you can always fork or build it yourself"... as if that were ever possible for the average user, or in a digital world where anything you do with a computer depends on endless recursive sub-dependencies. It's analogous to saying "it's your fault because you didn't read the T&C's", when all the T&C's you've implicitly agreed to already would take more than a human lifetime to read and understand. That is not a reasonable implication or expectation for the vast majority of people, the vast majority of the time; therefore it is logically corrupt, and should not be entertained. This is ofcourse a fair point of view for 1-few person codebases built for fun, or to solve their own problems, open sourced out of the kindness of their hearts, but when the open source code is built or maintained as part of a job function (receiving a paycheck) &/or to generate profit (either directly or indirectly to influence standards, gain market share, etc) the open-sourcing is more of a means to build trust and becon attention or adoption in the age of relentless enshittification. Open sourcing should not be an accepted path for profit seeking orgs or individuals to exploit and screw over consumers, as though they are eternal beta testers whose trust and dependence are worthless externalities. It also completely ignores the time and effort consumers must invest themselves to learn your product, workaround any errors, and build it into their workflow. That is arguably worth significantly more than whatever fee they could pay you for your code.
- Eufrat 3mo ago
  I still really don’t understand what is so entitled about asking for a level of base empathy and care from maintainers. People now yell at you that their only obligation is whatever is spelled out in the license they attached to the code. I think this is the same place where the logic of Code = Law comes from. People who think that you can encode the legal/judicial system into a set of axioms. This is not how the law works nor is it how it is taught and asserting this is a fundamental misunderstanding of human systems. It is incredibly destructive when people start applying maths as ground rules for human interaction. People do not live in black/white. We live in grey. I am certainly not old enough to have experienced it, but I would venture a guess that the reason the BSD/MIT licenses originally existed was so that the universities had a CYA clause. I think you can see this erosion from a group of people sharing software in academic and hobbyist circles into weird legal absolutism as software becomes more of a business. For instance, Bill Gates’ famous letter to hobbyists or the PKZIP fiasco.
  - scared_together 3mo ago
    > I still really don’t understand what is so entitled about asking for a level of base empathy and care from maintainers. > People now yell at you that their only obligation is whatever is spelled out in the license they attached to the code. Let’s turn your implied question around: if a person wants to share code without any expectation of care and maintenance, what should they do? Is the entire concept bogus, and the developer should just keep the code to themselves forever? Or put a “DO NOT USE FOR YOUR BILLION DOLLAR COMPANY” in a README? What communication other than the license could reasonably be provided? I think the person you’re responding to made a pretty good point that open-source is sometimes the passion of an unpaid 1-person “team” and sometimes the product of a VC-funded attempt to buy goodwill. The idea that asking for more from maintainers is entitled is clearly suitable for the former case but not the latter. Now that Bun has been bought out perhaps they are more deserving of scrutiny.
    - Eufrat 3mo ago
      Textualism is a scam wrapped in academic regalia. It is implausible on its face and arguing that “we only have the text to go off of” sounds nice and is demonstrably not how the law has been parsed. > What communication other than the license could reasonably be provided? Nobody encodes everything in text. No law can be fully represented in text. The law is a combination of many things including norms and customs at a moment in time. The law as written is a framework. This can be demonstrated pretty obviously in just how some laws are written intentionally vague because we have human beings to parse them for meaning and context. A legal/justice machine does not and will never exist as long as these are frameworks for human interaction. This is not a computable problem and attempting it to frame it as one is deeply harmful. I have met a lot of EECS folks who think that the law is just a set of rules to be applied and that a consistent and fair decision will just “happen”. This is ridiculous and anyone who thinks this should be smacked with a copy of the Bluebook. There is also kind of a spirit vs. letter of the law issue here. The intention and spirit in which this software is given out should and must inform how the law is interpreted. Arguing this isn't how the law works is just wrong. I stress this because it shows just how fuzzy the law really is. I think people want bright lines where they don't exist. I don't know what the obsession with this is, but it is unproductive. I certainly understand that this desire to return to a more nuanced and more empathetic view of all of this has gradients, but I think I am just deeply saddened how any attempt to suggest that there were and should still be some implied cultural norms regarding expectations and the response from some folks really sounds like an angry Ayn Rand instead of a discussion about what that means. It’s just a blanket rejection for a lot of people here. Software is for people. The consumers are ultimately people. People are the only things that matter. Like, you start a business and society—through the government and law has said—hey, you can’t refuse to serve people based on certain reasons. This is actively being attacked by some people with the same pathetic argument of, “You can’t tell me what to do. I hate X and it’s my free speech right to tell them to go pound sand. I never agreed to the civil rights acts!” It’s like the stupidest version of Ron Swanson.
pjjpo 3mo ago
I think this is precisely why I don't mind it that much. I can't audit a huge codebase like a JavaScript runtime, whether the code is by a human from scratch or not. I just have to trust it as a black box. I've seen LLMs produce terrible code indeed, but I have also seen humans produce terrible code. I haven't dug in to JS runtimes specifically but have read plenty of code in openjdk and cpython - there are many points that could be done better, but there's also no point since it's working, and keeping working code unchanged tends to be a smart decision in software engineering. So of course the last point brings up whether it was a good idea to rewrite bun if it was working. Apparently the bun team thought the difficulty in getting changes in zig upstream meant it is. I don't intend to hold LLM code to a higher bar than human code - notably if the runtime continues to work, that is as good as I can expect from what is otherwise a huge black box of extreme programming (not that agile kind).
- kennywinker 3mo ago
  The difference is you can evaluate a small bit of the output of a human or a team of humans and expect all their other code to be roughly in the same ballpark of quality. An LLM can’t be trusted to produce code and make higher level project structure choices of the same quality at all times, because it can’t be trusted at all - trust is for deterministic systems. But still it begs us to trust it. Every prompt that yields good results sets us up to expect good results, so we get lazy - and then the next prompt it spews out garbage.
  - simonra 3mo ago
    As long as the odds are good enough (and/or you know the distribution), there is nothing wrong in relying on and profiting from stochastic systems despite not every outcome being positive. What matters is the sum of outcomes, not the individual ones. It means you need to be able to handle failure, but you should always have a good grip on how to correct if you intend to set things out in the real world which messes up everything always anyways.
    - kennywinker 3mo ago
mingqiz 3mo ago
I honestly trust code reviewed by llms multiple rounds more than human reviewed code. Here is the thing. I don't know the human who wrote the code but i am familiar with the model they use, which might already be better than many human.

nozzlegear 3mo ago

How can you trust that they won't just rug pull all of the code you've hand-audited when they merge some 1800 file PR written by an LLM? Even if you decide to hold off on any security updates or minor bumps until you can hand audit again, what's the point? You could just go back to Node where they aren't engaging in a modern day Ship of Theseus every other week.

unknownfuture 3mo ago

It's called "mileage". This new codebase doesn't have any. Who knows what gremlins lurk in some of its darker corners.

Jarred 3mo ago
> new codebase doesn’t have any Claude Code & Prisma use it as of last week.
- marshray 3mo ago
  That comment had me reaching for the skull emoji.
- vips7L 3mo ago
  Claude is riddled with bugs. That doesn’t inspire confidence.
- dijksterhuis 3mo ago
  original comment: >> new codebase doesn’t have any > No longer accurate. As of last week, Claude Code (an incredibly popular CLI tool) runs on Bun’s Rust rewrite.

diatone 3mo ago

First word of second sentence: > Stability ie: lack of volatility, ie: integrity, ie: I know it does what it says and don’t have to second guess that.

pier25 3mo ago

It's not about the code or the use of AI. It's about the governance of the Bun project. Nobody knows if the Rust AI rewrite was a good decision from a technical pov. We do know it was a unilateral and drastic decision taken behind closed doors and imposed onto all Bun users. There was a poll on r/bun where only about 30% of users said they were going to use the Rust port. https://www.reddit.com/r/bun/comments/1u3j4d7/are_you_going_to_use_the_rust_port_of_bun/ https://www.reddit.com/r/bun/comments/1u3j4d7/are_you_going_... Even worse, users on the Zig version have been pretty much abandoned. Any future bug fixes, security patches, etc will only be released in the Rust version.