5 ms·

grep -nr 'unsafe' . Is all you need to know to consider how much of an abomination it is

simonw 2mo ago
This comment inspired me to take a look at the trend of "unsafe" in the Bun code over time since the rewrite PR first landed - here are the commits where that number changed by at least 10: 2026-05-14 23427db 13907 2026-05-14 19d8ade 13861 2026-05-15 4d443e5 13840 2026-05-17 172afa5 13803 2026-05-17 80a06a8 13849 2026-05-18 fba43af 14026 2026-05-19 303cd28 14052 2026-05-20 21db682 14243 2026-05-22 a06a00a 14239 2026-05-23 49c97de 14090 2026-05-28 472a06a 14076 2026-06-01 a0d1472 14071 2026-06-04 8553428 14032 2026-06-09 717542f 14053 2026-06-10 1c90e5a 14043 2026-06-11 6e91d24 14031 2026-06-16 bd8edc7 14086 2026-06-17 6ef5977 14104 2026-06-20 315ed50 14106 2026-06-22 c6be834 14120 2026-06-23 ea7e44f 14108 2026-06-23 03042ab 14128 2026-06-29 86d32c8 14046 2026-07-01 6640fcf 14077 2026-07-04 51074e3 14099 2026-07-06 9d0e93d 14186 2026-07-08 ab6eb2d 13953 2026-07-09 86caf6e 13936 2026-07-10 91675d0 13930 2026-07-13 73b6c14 13951 2026-07-16 4bbe075 13978 2026-07-16 57e30a5 13995 So not as much cleanup as I had expected! ChatGPT written script for counting here: https://gist.github.com/simonw/b1015bcadcedd1a781cedb7af9cbb2d0 https://gist.github.com/simonw/b1015bcadcedd1a781cedb7af9cbb...
rwz 2mo ago
The original code was one giant unsafe block with almost no tangible way to find or debug all the subtle memory bugs and leaks they had. Now it's smaller, faster and has fewer bugs. Also its every potential memory issue is neatly annotated by an unsafe block so you can go and refactor them out one by one with confidence. All this seems like a pretty huge improvement to me. Why is this an abomination in your eyes?
- endospore 2mo ago
  > The original code was one giant unsafe block True. > has fewer bugs Nope, this is demonstrably false because Rust has its own invariants around its types and the codebase is violating a lot of them. > every potential memory issue is neatly annotated by an unsafe block "Potential memory issue" can originate in unsafe blocks and safe code that are able to alternate the input condition of these unsafe blocks. Guess what? That still counts towards 100% in this code base, hence the abomination remark. > refactor them out one by one Not as easy as it sounds. They are like threads in a yarn ball, if there are one or two ends visible it's easier to sort them out. The actual situation is more like we have tens of thousands of ends (all the raw pointer code that comes with every shared object), to fix them it's basically a requirement to unwind the whole thing (rewrite all the callees and reorder the data flow as needed, redesigning all the APIs during that). It's too early to declare it as anything remotely close to a win, optimistically saying.
  - d5lt5 2mo ago
    For someone who is not a rust dev, would you mind giving me an example of this: "Nope, this is demonstrably false because Rust has its own invariants around its types and the codebase is violating a lot of them."
    - endospore 2mo ago
      Aw I feel quite sorry for using the word "demonstrable" while not intending to demonstrate anything, in order to avoid any contributions to the project. I apologize for that. That being said I've found a case that doesn't do much harm even if it's fixed, and is technically not my contribution. You may take a look at that: https://github.com/oven-sh/bun/pull/30794 https://github.com/oven-sh/bun/pull/30794
    - LtWorf 2mo ago
      An "unsafe" in rust is like an axiom in mathematics. You can use to prove higher level theorems but it has to make sense. The second that you start to introduce nonsensical axioms (or bugs in unsafe sections) all your proven correct theorems will be worthless.
      - whytevuhuni 2mo ago
        But code is not mathematics, so incorrect code is not worthless, it’s just worth less. It’ll most likely still do 99% of the things people need it to do, there’ll be a an issue created for that broken 1%, and eventually it’ll be iterated upon and fixed. Unless you’re working on a security boundary of course, there you should treat it like maths.
        LtWorf 2mo ago
        Rust doesn't check for logical errors, it checks for memory errors. So every single issue in an unsafe section is a potential CVE.
        whytevuhuni 2mo ago
- William_BB 2mo ago
  > has fewer bugs who claimed that? Are you suggesting that the rewrite did not introduce any new bugs? The correct answer is, by the way, that no one knows since it's millions of lines of code no one has properly read. > smaller, faster I thought this has already been debunked. You could just write better zig and make it smaller, faster (and have fewer bugs!)

This comment inspired me to take a look at the trend of "unsafe" in the Bun code over time since the rewrite PR first landed - here are the commits where that number changed by at least 10: 2026-05-14 23427db 13907 2026-05-14 19d8ade 13861 2026-05-15 4d443e5 13840 2026-05-17 172afa5 13803 2026-05-17 80a06a8 13849 2026-05-18 fba43af 14026 2026-05-19 303cd28 14052 2026-05-20 21db682 14243 2026-05-22 a06a00a 14239 2026-05-23 49c97de 14090 2026-05-28 472a06a 14076 2026-06-01 a0d1472 14071 2026-06-04 8553428 14032 2026-06-09 717542f 14053 2026-06-10 1c90e5a 14043 2026-06-11 6e91d24 14031 2026-06-16 bd8edc7 14086 2026-06-17 6ef5977 14104 2026-06-20 315ed50 14106 2026-06-22 c6be834 14120 2026-06-23 ea7e44f 14108 2026-06-23 03042ab 14128 2026-06-29 86d32c8 14046 2026-07-01 6640fcf 14077 2026-07-04 51074e3 14099 2026-07-06 9d0e93d 14186 2026-07-08 ab6eb2d 13953 2026-07-09 86caf6e 13936 2026-07-10 91675d0 13930 2026-07-13 73b6c14 13951 2026-07-16 4bbe075 13978 2026-07-16 57e30a5 13995 So not as much cleanup as I had expected! ChatGPT written script for counting here: https://gist.github.com/simonw/b1015bcadcedd1a781cedb7af9cbb2d0 https://gist.github.com/simonw/b1015bcadcedd1a781cedb7af9cbb...

rwz 2mo ago

The original code was one giant unsafe block with almost no tangible way to find or debug all the subtle memory bugs and leaks they had. Now it's smaller, faster and has fewer bugs. Also its every potential memory issue is neatly annotated by an unsafe block so you can go and refactor them out one by one with confidence. All this seems like a pretty huge improvement to me. Why is this an abomination in your eyes?

endospore 2mo ago
> The original code was one giant unsafe block True. > has fewer bugs Nope, this is demonstrably false because Rust has its own invariants around its types and the codebase is violating a lot of them. > every potential memory issue is neatly annotated by an unsafe block "Potential memory issue" can originate in unsafe blocks and safe code that are able to alternate the input condition of these unsafe blocks. Guess what? That still counts towards 100% in this code base, hence the abomination remark. > refactor them out one by one Not as easy as it sounds. They are like threads in a yarn ball, if there are one or two ends visible it's easier to sort them out. The actual situation is more like we have tens of thousands of ends (all the raw pointer code that comes with every shared object), to fix them it's basically a requirement to unwind the whole thing (rewrite all the callees and reorder the data flow as needed, redesigning all the APIs during that). It's too early to declare it as anything remotely close to a win, optimistically saying.
- d5lt5 2mo ago
  For someone who is not a rust dev, would you mind giving me an example of this: "Nope, this is demonstrably false because Rust has its own invariants around its types and the codebase is violating a lot of them."
  - endospore 2mo ago
    Aw I feel quite sorry for using the word "demonstrable" while not intending to demonstrate anything, in order to avoid any contributions to the project. I apologize for that. That being said I've found a case that doesn't do much harm even if it's fixed, and is technically not my contribution. You may take a look at that: https://github.com/oven-sh/bun/pull/30794 https://github.com/oven-sh/bun/pull/30794
  - LtWorf 2mo ago
    An "unsafe" in rust is like an axiom in mathematics. You can use to prove higher level theorems but it has to make sense. The second that you start to introduce nonsensical axioms (or bugs in unsafe sections) all your proven correct theorems will be worthless.
    - whytevuhuni 2mo ago
      But code is not mathematics, so incorrect code is not worthless, it’s just worth less. It’ll most likely still do 99% of the things people need it to do, there’ll be a an issue created for that broken 1%, and eventually it’ll be iterated upon and fixed. Unless you’re working on a security boundary of course, there you should treat it like maths.
      - LtWorf 2mo ago
        Rust doesn't check for logical errors, it checks for memory errors. So every single issue in an unsafe section is a potential CVE.
        whytevuhuni 2mo ago
William_BB 2mo ago
> has fewer bugs who claimed that? Are you suggesting that the rewrite did not introduce any new bugs? The correct answer is, by the way, that no one knows since it's millions of lines of code no one has properly read. > smaller, faster I thought this has already been debunked. You could just write better zig and make it smaller, faster (and have fewer bugs!)