13 ms·

I have learned so much reading Andrew’s code and as I said in the original post: Bun would never have happened without Zig. > The post claims they were fuzzin

by Jarred 2mo ago

I have learned so much reading Andrew’s code and as I said in the original post: Bun would never have happened without Zig. > The post claims they were fuzzing their Zig code, while during our calls the whole Bun team told us that they were not fuzzing anything. This appears to be an outright fabrication. Fuzzilli integration: https://github.com/oven-sh/bun/pull/24826 https://github.com/oven-sh/bun/pull/24826 Merged PRs fixing issues Fuzzilli found in Bun’s Zig code: - https://github.com/oven-sh/bun/pull/28926 https://github.com/oven-sh/bun/pull/28926 - https://github.com/oven-sh/bun/pull/28934 https://github.com/oven-sh/bun/pull/28934 - https://github.com/oven-sh/bun/pull/29255 https://github.com/oven-sh/bun/pull/29255 - https://github.com/oven-sh/bun/pull/29210 https://github.com/oven-sh/bun/pull/29210 - https://github.com/oven-sh/bun/pull/29199 https://github.com/oven-sh/bun/pull/29199 Searching “Fuzzilli” shows more PRs: https://github.com/search?q=repo%3Aoven-sh%2Fbun+is%3Apr+Fuzzilli++is%3Amerged&type=pullrequests&s=created&o=asc https://github.com/search?q=repo%3Aoven-sh%2Fbun+is%3Apr+Fuz...

embedding-shape 2mo ago
[flagged]
- simonw 2mo ago
  You want to see him address being "a stinky manager", having "beginner energy", choosing to take VC as opposed to "a solid living via crowdfunding", or "already writing slop well before he had access to LLMs"? Those are all opinions where arguing about them isn't going to be productive. Countering the accusation of "an outright fabrication" on the other hand is worthwhile because it's a claim that can be countered. If somebody called me a liar for something that demonstrably wasn't a lie I wouldn't let that stand, either.
  - nicce 2mo ago
    > Countering the accusation of "an outright fabrication" on the other hand is worthwhile because it's a claim that can be countered. Hmm, fuzzing integration was merged 8 months ago. First found bug mentioned 3 months ago. Bun is 4 years old. I think both arguments can be true at the same time based on this evidence. It is entirely possible that for more than 3 years team has said that no fuzzing was done, and the first fuzzing was done just 3 months ago, and this information did not travel.
    - simonw 2mo ago
      If you're going to accuse someone of "an outright fabrication" it's on you to check that you're not wrong before you say that.
      - nicce 2mo ago
        I agree that ""an outright fabrication" is a bit too much. But also the claims about the fuzzing in the original blog post are kinda too misleading. Fuzzing harness is basically just coverage-guided random bytes towards Bun's JS APIs and it will not really catch anything in depth from the code. Just the most obvious from the surface. And 24/7 fuzzing is introduced likely around the same time when Rust rewrite seemed to be main focus, as then the first issues were created. Current fuzzing does not give much trust about the code stability, but indeed the fuzzing has been started and likely improves in the future if someone puts some work for the harness.
        alistaiir 2mo ago
        > And 24/7 fuzzing is introduced likely around the same time when Rust rewrite seemed to be main focus, This is false, it was done many months before (Nov 20 2025). There is some irony in your comment being in reply to a thread about verifying claims before posting them...
        nicce 2mo ago
        > This is false, it was done many months before (Nov 20 2025). There is some irony in your comment being in reply to a thread about verifying claims before posting them... There is no evidence for this. It is integration PR to support fuzzing with one tool. The public repository does not have CI pipeline for it. Fuzzing is done privately somewhere, and the first linked issues are around April.
  - embedding-shape 2mo ago
    [flagged]
  - Mawr 2mo ago
    Those statements are all consistent with the publicly observable facts like this whole thing going from "I'm experimenting with this" to "this is merged into main now, yolo" within a week or so. The complaints from Jarred on the amount of bugs they've been having is too. It all checks out.
- threatofrain 2mo ago
  Bun donates $60,000 per year [month] and Jarred acts with graciousness and soft tones when talking to outside parties. Why do you think it's Jarred's obligation to continue after being insulted for professional dishonesty? Isn't it Andrew's obligation to show that he was worth that much kindness to begin with?
  - HAL3000 2mo ago
    > Bun donates $60,000 per month Per year, not month.
  - swiftcoder 2mo ago
    > worth that much kindness to begin with? Maybe I'm overly cynical, but I don't know that directing some funding towards the open-source project that is the foundation of your whole tech stack is really "kindness" per se. When you are vending a devtool to other open-source developers, and making a lot of hay about the specific technology choice, it's basically marketing spend. It's also often a way of buying favour (attention to issues, PRs, etc) from the project maintainers...
- famouswaffles 2mo ago
  The blog is not worth a reply. It's just a butthurt, petulant rant full of personal attacks.
nsagent 2mo ago
Your links show you used a fuzzer, but that doesn't address the other half of Andrew's statement. Is Andrew misreporting/misremembering your conversations? EDIT: It's really telling that asking a factual clarification question is somehow downvote worthy. I probably shouldn't be surprised, but this epitomizes the reason online discussions devolve in to flame wars (even moreso than real life, though it happens more and more there as well). The answer could be as simple as we didn't use a fuzzer until recently so both are accurate. I honestly don't know, which is why I'm asking. Yet somehow just asking is triggering to people.
- mi_lk 2mo ago
  Or, did the whole Bun team indeed state the otherwise to Zig?
- lolinder 2mo ago
  No one's obliged to respond to hearsay by trying to guess what the other party might have misheard to arrive at a false conclusion. It's enough to demonstrate that the conclusion they came to was false, and if the other party would like to defend themselves they're welcome to explain why they came to that misunderstanding.
tipiirai 2mo ago
Not sure I follow. Is "fuzzing their Zig code" somehow related to adding a Fuzzilli integration to Bun?
- mtlynch 2mo ago
  Yes, "their" refers to Bun's code, not the Zig compiler's code. Fuzzili is a fuzzing engine for JavaScript, so integrating it into Bun means that Fuzzili is fuzzing Bun.[0] From the Bun post[1] > We fuzz Bun's runtime APIs 24/7 using Fuzzilli, the JavaScript engine fuzzer used by V8 & JavaScriptCore From Andrew Kelley's post today[2]: > The post claims they were fuzzing their Zig code, while during our calls the whole Bun team told us that they were not fuzzing anything. This appears to be an outright fabrication. Sumner says that the Bun team has been fuzzing Bun's Zig code. Kelley says that this is a fabrication. Sumner showed proof that the Bun team has been fuzzing Bun's Zig code. It looks like Kelley is incorrect and made an unfounded claim. The generous interpretation is that at the time Kelley and Sumner had a more collaborative relationship, Sumner was not fuzzing Bun's Zig code, but I'd expect Kelley to check if anything had changed since then before publicly accusing Sumner of lying in this week's Bun blog post. [0] https://github.com/googleprojectzero/fuzzilli https://github.com/googleprojectzero/fuzzilli [1] https://bun.com/blog/bun-in-rust https://bun.com/blog/bun-in-rust [2] https://andrewkelley.me/post/my-thoughts-bun-rust-rewrite.html https://andrewkelley.me/post/my-thoughts-bun-rust-rewrite.ht...
  - orangeisthe 2mo ago
    Why are you not using hyperlinks and adding links citation style?
    - Philpax 2mo ago
      This is standard convention on HN for when you have more than one link. HN does not support masked links.
  - xlii 2mo ago
    AFAIU fuzzing code != fuzzing results. Through skimming it seems that integration tests were using fuzzing, but I would call it fuzzing the code itself. From "product" perspective there's no difference, but in program-compiler perspective (and e.g. raising bugs about compiler), Fuzilli isn't fuzzing. Per Wikipedia > (then...) The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. As for myself, I wouldn't use term fuzzing for integration testing such the one used by Fuzilla. I always caught it dynamic testing, scenario testing and in bigger cases property based tests. Fuzzing in my mind is reserved to a low-abstraction calls. Might just be me, though.
tel 2mo ago
Without having any opinion on whether or not the Bun team was meaningfully fuzzing their codebase... Andrew's claim was not about whether or not they were, it was noting that the story was different between what they claimed in conversation and what they stated in this article.
deleted 2mo ago
[deleted]
deleted 2mo ago
[deleted]
hoppp 2mo ago
Andrew means the zig build test --fuzz command probably the built in zig fuzzer, that's the tool that is in his scope.
- deleted 2mo ago
  [deleted]
- lolinder 2mo ago
  If that's what he meant that doesn't speak well for his communication in this post, because "the Bun team told us that they were not fuzzing anything" is a wildly different claim than "the Bun team told us they weren't using a specific tool for fuzzing".
v3gas 2mo ago
You're a champ, man
ovao 2mo ago
Note that Andrew's since removed the “outright fabrication” bit from his post. No indication of the edit itself though, which is a choice.
- ladyanita22 2mo ago
  It is a choice indeed. Well worded.
- abacate 2mo ago
  Original post: https://archive.is/wNLqY https://archive.is/wNLqY Updated version: https://archive.is/TpsUW https://archive.is/TpsUW
silver_silver 2mo ago
All of those commits except the initial integration are from after the acquisition. How do we know this wasn’t done without anyone on the call’s knowledge?
- deleted 2mo ago
  [deleted]
- deleted 2mo ago
  [deleted]
- deleted 2mo ago
  [deleted]
- zamadatix 2mo ago
  Since there are multiple ways to interpret Andrew's original comment, multiple ways to interpret what his newer edit of it implies, multiple logical reasons each way could have come about, and likely multiple opinions on what the expectations from each side should be... I'm finding myself getting stuck in a loop of trying to understand how/why these considerations are important. Could you help further explain which interpretations & ways you feel this info is relevant to?
ykurtov 2mo ago
Dude, that PR is on 25th of November 2025 :) Few weeks before Anthropic acquired Bun.

by Jarred 2mo ago

embedding-shape 2mo ago

[flagged]

simonw 2mo ago
You want to see him address being "a stinky manager", having "beginner energy", choosing to take VC as opposed to "a solid living via crowdfunding", or "already writing slop well before he had access to LLMs"? Those are all opinions where arguing about them isn't going to be productive. Countering the accusation of "an outright fabrication" on the other hand is worthwhile because it's a claim that can be countered. If somebody called me a liar for something that demonstrably wasn't a lie I wouldn't let that stand, either.
- nicce 2mo ago
  > Countering the accusation of "an outright fabrication" on the other hand is worthwhile because it's a claim that can be countered. Hmm, fuzzing integration was merged 8 months ago. First found bug mentioned 3 months ago. Bun is 4 years old. I think both arguments can be true at the same time based on this evidence. It is entirely possible that for more than 3 years team has said that no fuzzing was done, and the first fuzzing was done just 3 months ago, and this information did not travel.
  - simonw 2mo ago
    If you're going to accuse someone of "an outright fabrication" it's on you to check that you're not wrong before you say that.
    - nicce 2mo ago
      I agree that ""an outright fabrication" is a bit too much. But also the claims about the fuzzing in the original blog post are kinda too misleading. Fuzzing harness is basically just coverage-guided random bytes towards Bun's JS APIs and it will not really catch anything in depth from the code. Just the most obvious from the surface. And 24/7 fuzzing is introduced likely around the same time when Rust rewrite seemed to be main focus, as then the first issues were created. Current fuzzing does not give much trust about the code stability, but indeed the fuzzing has been started and likely improves in the future if someone puts some work for the harness.
      - alistaiir 2mo ago
        > And 24/7 fuzzing is introduced likely around the same time when Rust rewrite seemed to be main focus, This is false, it was done many months before (Nov 20 2025). There is some irony in your comment being in reply to a thread about verifying claims before posting them...
        nicce 2mo ago
        > This is false, it was done many months before (Nov 20 2025). There is some irony in your comment being in reply to a thread about verifying claims before posting them... There is no evidence for this. It is integration PR to support fuzzing with one tool. The public repository does not have CI pipeline for it. Fuzzing is done privately somewhere, and the first linked issues are around April.
- embedding-shape 2mo ago
  [flagged]
- Mawr 2mo ago
  Those statements are all consistent with the publicly observable facts like this whole thing going from "I'm experimenting with this" to "this is merged into main now, yolo" within a week or so. The complaints from Jarred on the amount of bugs they've been having is too. It all checks out.
threatofrain 2mo ago
Bun donates $60,000 per year [month] and Jarred acts with graciousness and soft tones when talking to outside parties. Why do you think it's Jarred's obligation to continue after being insulted for professional dishonesty? Isn't it Andrew's obligation to show that he was worth that much kindness to begin with?
- HAL3000 2mo ago
  > Bun donates $60,000 per month Per year, not month.
- swiftcoder 2mo ago
  > worth that much kindness to begin with? Maybe I'm overly cynical, but I don't know that directing some funding towards the open-source project that is the foundation of your whole tech stack is really "kindness" per se. When you are vending a devtool to other open-source developers, and making a lot of hay about the specific technology choice, it's basically marketing spend. It's also often a way of buying favour (attention to issues, PRs, etc) from the project maintainers...
famouswaffles 2mo ago
The blog is not worth a reply. It's just a butthurt, petulant rant full of personal attacks.

nsagent 2mo ago

Your links show you used a fuzzer, but that doesn't address the other half of Andrew's statement. Is Andrew misreporting/misremembering your conversations? EDIT: It's really telling that asking a factual clarification question is somehow downvote worthy. I probably shouldn't be surprised, but this epitomizes the reason online discussions devolve in to flame wars (even moreso than real life, though it happens more and more there as well). The answer could be as simple as we didn't use a fuzzer until recently so both are accurate. I honestly don't know, which is why I'm asking. Yet somehow just asking is triggering to people.

mi_lk 2mo ago
Or, did the whole Bun team indeed state the otherwise to Zig?
lolinder 2mo ago
No one's obliged to respond to hearsay by trying to guess what the other party might have misheard to arrive at a false conclusion. It's enough to demonstrate that the conclusion they came to was false, and if the other party would like to defend themselves they're welcome to explain why they came to that misunderstanding.

tipiirai 2mo ago

Not sure I follow. Is "fuzzing their Zig code" somehow related to adding a Fuzzilli integration to Bun?

mtlynch 2mo ago
Yes, "their" refers to Bun's code, not the Zig compiler's code. Fuzzili is a fuzzing engine for JavaScript, so integrating it into Bun means that Fuzzili is fuzzing Bun.[0] From the Bun post[1] > We fuzz Bun's runtime APIs 24/7 using Fuzzilli, the JavaScript engine fuzzer used by V8 & JavaScriptCore From Andrew Kelley's post today[2]: > The post claims they were fuzzing their Zig code, while during our calls the whole Bun team told us that they were not fuzzing anything. This appears to be an outright fabrication. Sumner says that the Bun team has been fuzzing Bun's Zig code. Kelley says that this is a fabrication. Sumner showed proof that the Bun team has been fuzzing Bun's Zig code. It looks like Kelley is incorrect and made an unfounded claim. The generous interpretation is that at the time Kelley and Sumner had a more collaborative relationship, Sumner was not fuzzing Bun's Zig code, but I'd expect Kelley to check if anything had changed since then before publicly accusing Sumner of lying in this week's Bun blog post. [0] https://github.com/googleprojectzero/fuzzilli https://github.com/googleprojectzero/fuzzilli [1] https://bun.com/blog/bun-in-rust https://bun.com/blog/bun-in-rust [2] https://andrewkelley.me/post/my-thoughts-bun-rust-rewrite.html https://andrewkelley.me/post/my-thoughts-bun-rust-rewrite.ht...
- orangeisthe 2mo ago
  Why are you not using hyperlinks and adding links citation style?
  - Philpax 2mo ago
    This is standard convention on HN for when you have more than one link. HN does not support masked links.
- xlii 2mo ago
  AFAIU fuzzing code != fuzzing results. Through skimming it seems that integration tests were using fuzzing, but I would call it fuzzing the code itself. From "product" perspective there's no difference, but in program-compiler perspective (and e.g. raising bugs about compiler), Fuzilli isn't fuzzing. Per Wikipedia > (then...) The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. As for myself, I wouldn't use term fuzzing for integration testing such the one used by Fuzilla. I always caught it dynamic testing, scenario testing and in bigger cases property based tests. Fuzzing in my mind is reserved to a low-abstraction calls. Might just be me, though.

tel 2mo ago

Without having any opinion on whether or not the Bun team was meaningfully fuzzing their codebase... Andrew's claim was not about whether or not they were, it was noting that the story was different between what they claimed in conversation and what they stated in this article.

deleted 2mo ago

[deleted]

deleted 2mo ago

[deleted]

hoppp 2mo ago

Andrew means the zig build test --fuzz command probably the built in zig fuzzer, that's the tool that is in his scope.

deleted 2mo ago
[deleted]
lolinder 2mo ago
If that's what he meant that doesn't speak well for his communication in this post, because "the Bun team told us that they were not fuzzing anything" is a wildly different claim than "the Bun team told us they weren't using a specific tool for fuzzing".

v3gas 2mo ago

You're a champ, man

ovao 2mo ago

Note that Andrew's since removed the “outright fabrication” bit from his post. No indication of the edit itself though, which is a choice.

ladyanita22 2mo ago
It is a choice indeed. Well worded.
abacate 2mo ago
Original post: https://archive.is/wNLqY https://archive.is/wNLqY Updated version: https://archive.is/TpsUW https://archive.is/TpsUW

silver_silver 2mo ago

All of those commits except the initial integration are from after the acquisition. How do we know this wasn’t done without anyone on the call’s knowledge?

deleted 2mo ago
[deleted]
deleted 2mo ago
[deleted]
deleted 2mo ago
[deleted]
zamadatix 2mo ago
Since there are multiple ways to interpret Andrew's original comment, multiple ways to interpret what his newer edit of it implies, multiple logical reasons each way could have come about, and likely multiple opinions on what the expectations from each side should be... I'm finding myself getting stuck in a loop of trying to understand how/why these considerations are important. Could you help further explain which interpretations & ways you feel this info is relevant to?

ykurtov 2mo ago

Dude, that PR is on 25th of November 2025 :) Few weeks before Anthropic acquired Bun.