[ianm218]

In case the topic of memory safety is interesting to anyone I've been experimenting with using AI agents to port common web infra projects to safe/ performant Rust. Somewhat inspired by the Bun port - was thinking that at some point memory safety might be such a big deal that people just need drop in replacements.

- Valkey/ Redis port here https://github.com/ianm199/valdr (passes ~99% of single node test suite, real prod features like replication/ clustering/ HA early or not implemented) - Further along port of Lua 5.1-5.5 https://github.com/ianm199/lua-rs-port/tree/main - I have a less developed nginx version that would be the north star - These projects are very alpha at the moment

If anyone is interested in getting involved in this or has done similar experiments I'd love to collaborate! There is so much variation in how you can run these large scale agent fleets I don't think anyone has a perfect system yet.

[julianlam]

Respectfully, as an OSS maintainer (not to the scale of nginx or valkey, of course)... if a third-party used an AI agent to rewrite my software in a different language, that gives me absolutely no reason to support that new project.

It is in all respects foreign code in a language I may or may not be familiar with, and worse yet, if I were to take over, I'd be responsible for maintaining the whole black box forever more?

Thank you but no thanks.

[baq]

I don’t think anyone expects you to TBH. If you show interest, great. If not, the robot will translate your work into a different form of expression anyway. If you’re releasing open source software under BSD-like licenses, it’s still better than some company taking your work and selling it with zero value contributed back.

[rxhampton]

This kind of nihilistic argument worked in 2000 when open source software was a counter movement.

[patates]

I don't understand how it's nihilistic and how it doesn't work in 2026.

[mswphd]

seems like it could be a decent opportunity for a bad actor to slip in something nefarious as well. We all know that nobody is reviewing a >>500k loc diff. For something like the Bun rewrite, where plausibly the person driving the agent(s) didn't want to sneak in something nefarious things might be ok. That seems significantly less true when you cannot trust the person driving the agent(s)/producing the >>500k loc diff.

[ianm218]

Yes I hope this can be separated from people who are inundating OSS maintainers with slop PRs - these are fully separate projects with zero expectation of involvement from maintainers. Valkey itself is forked off the original Redis.

There might be a world where people soon just find unsafe C code exposed to the web (i.e. nginx) an untenable situation and I hope it can be a helpful resource.

Anyway, I see open source code as positive sum. Maybe in the end only a small community who cares about cross compilation finds this helpful and thats a win!

[dyauspitr]

Why would you have to take it over? Wouldn’t it just be a fork/different project entirely.

[jspdown]

I find this kind of rewrite both disrespectful and completely useless. Useless because the difficulty isn't getting to a working state but maintaining it. You now have to build a community around it to make any of this worthwhile. What would this software be worth if security issues weren't patched and bugs weren't fixed? You can't do this alone. And I find it disrespectful because people have spent decades building this, and you're taking all that collectively built knowledge to create something that will compete with the project itself.

I hope people will restrain themself from doing this at least in the name of good ethic. I fear this is going to hurt OSS a lot.

I hope people will hold back from this, if only out of respect for the work that came before. I fear it could do real damage to OSS. It would discourage the maintainers whose effort makes any of it possible.

[ianm218]

Hmm I view open source as purely positive sum. Valkey was forked from Redis in the first place.

But this is more about memory safety - you can have immense respect for the giants who built these tools but also be worried that memory safety might become an even bigger deal. If someone found a memory zero day in nginx or openSSL for example that is a very big deal!

I think this is one strategy we should look into, hopefully people in the C community look into other options like project Glasswing/ next generation fuzzers etc. When the world of security is changing so fast it is good to get a lot of shots on net.

[0x000xca0xfe]

And what if someone gets pwned by a bog standard logic or input validation bug in your slopped together "nginx" that is not present in the original?

[pixl97]

And what if they get owned by a memory safety issue that's in the original and not the rewrite?

I know many of these projects have been around for years but it's time for developers to put on their big boy panties and start taking memory safe languages seriously. Watching the same attacks again and again for 30 years is getting droll.

[ianm218]

If someone is running projects with a big "alpha" tag in production, exposed to the web they very well might get pwned haha!

[overfeed]

Are you preserving the original software licenses, or AI-laundering the code in the manner[1] of https://malus.sh

1. AI-rewrites are not clean room implementations.

[15155]

Do you have any specific case citations to substantiate this idea?

[overfeed]

"AI-laundering" is a moral judgement, based on not being a dick.

Regarding the footnote: pick any of the litigated cases, then consider if AI rewrites meet the bar of a clean-room.

[ianm218]

Yes original licenses are preserved

[safercplusplus]

If the source language is C++, another option might be to use AI agents to port to a memory-safe subset of C++ [1]. For the most part, this involves surgical changes and glorified find-and-replace operations. And I'm guessing way fewer tokens :)

If the source language is legacy C, then another option might be (deterministic) transpilation to a memory-safe subset of C++ [2]. The resulting code wouldn't necessarily be performance-optimal, but it can be used for the majority of code that isn't really performance-sensitive.

[1] https://github.com/duneroadrunner/scpp_code_migration [2] https://github.com/duneroadrunner/SaferCPlusPlus-AutoTransla...

[notnullorvoid]

I love Rust, but porting others software to Rust (or any language) is a mixed bag. I'm a strong believer that good software requires deep domain knowledge to build and maintain. Porting code you don't understand by hand already risks still not understanding it afterwards, doing it in an automated fashion all but guarantees it.

All that to say I think these automated ports are interesting experiments. However if you want to build something people can trust, the people need to be able to trust that you fully understand what is built, and why it's built the way it is.

[rxhampton]

If someone is porting such disparate projects as Valkey and Lua it is just for show and will be pre-alpha forever.

No one wants Bun in Rust, no one wants the rsync vibe code additions. This is just the only pro-AI comment, so the AI people voted it to the top.

[ianm218]

Hmm my reasoning was that in order to have Nginx work in Rust you want to expose scripting so having a decent Lua in Rust is key to not call out to C for that. And then Valkey/ Redis is a lot simpler than nginx so it was a good way to learn how some of this works.

And I'd disagree on no one wants - Lua is quite helpful since it is easily used in WASM. There has been some interest from people in the Bevy community - a game engine in Rust - since you can't have Lua scripting in browser games easily with the C version.

But anyway if people want it or not memory safety might become much more important so I think it is a good area to explore. Some people think large C codebases are inherently unsecurable https://alexgaynor.net/2020/may/27/science-on-memory-unsafet...

[WatchDog]

> disparate projects as Valkey and Lua

Lua is often heavily used in Redis/Valkey, if you are interested in porting Valkey, it makes sense to also port Lua, they aren't "disparate".

[baq]

I don’t care if bun is written in zig, rust, go, f# or sql. If it works, it works.

I also don’t care if it’s written by humans or LLMs or robot overlords from Alpha Centauri. Again, if it works, it works.

The operative word here is ‘works’. Code is now cheap, QA still isn’t. Since people don’t really like doing the same thing twice, specs for working code have never been written. Nowadays there is no reason to not create a spec detailed enough for robots to make no mistakes (pun intended) when filling in the gaps when converting from spec space to code space. As long as this remains true, I don’t care who or what does the boring parts.

[jspdown]

Who is going to maintain all these forks? The person forking it has no community and can't realistically be an expert in all of these domains.

So no, it doesn't "work", it just worked at some point in the past.

[overfeed]

> Who is going to maintain all these forks?

"Claude" would probably be the response of a typical tokenmaxxer. I have no desire to use software that was drive-by forked by someone who doesn't understand the trade-offs made by a project, or the values underpinning them. I'll AI-assisted domain-expert, or experienced maintainer who stumbled into the role over someone with no grounding in the domain being the human in the loop for AI agents.