Comment by fg137

5 days ago

> We've built a minimal JavaScript interpreter

Huh?

This scared me even more than all the other security issues (like hot reloading of plugins, permissions not being followed, etc.).

A vibe coded minimal JavaScript interpreter? This sounds dangerous af.

With several thousand of open issues on GitHub already.

Are we just ignoring security when it comes to harnesses?

This should be the top comment. This is frankly very alarming that they think this is a reasonable approach.

Imagine if there were already existing ones like QuickJS...

  • They intentionally skipped QuickJS because it's "too complicated" (paraphrasing) which I think is a decision they'll regret.

    • Yes that sounds odd. There' quickjs-ng I think which is an effort to speed it up and modernise it, so why not use an existing effort that works? Lots of wheel reinvention occurring with these LLM teams.