[jdiff]

Do these hacks make bun less secure than other runtimes? I find it a little hard to believe you can get much more robust and performant than V8 or SpiderMonkey without cutting some corners that notably went uncut by either for all these years.

[msdz]

Bun uses JavaScriptCore, which is Safari’s JS engine, for the actual interpreter portion of its runtime.

Which makes the parent comment’s “Bun performance hacks and optimizations” sound a little far-fetched, at least in this scenario I don’t think that’s gonna be the deciding factor. Their vendored JSC is also not touched by this port-rewrite at all whatsoever (still Cpp), so I’m not sure if it’s even possible to hack-improve all that much there.

[jFriedensreich]

yes, especially compared to deno bun does not have proper isolation or permissions at runtime layer which is why anthropic tries to fix the lack by a mixture of app layer (build into claude code) and os layer (srt) however using runtime permissions would allow much better security if done right.