Hacker Newsnew | past | comments | ask | show | jobs | submit | comex's commentslogin

If it works, then it’s impressive. Does it work? Looking at test.sh, the oracle tests (the ones compared against SQLite) seem to consist in their entity of three trivial SELECT statements. SQLite has tens of thousands of tests; it should be possible to port some of those over to get a better idea of how functional this codebase is.

Edit: I looked over some of the code.

It's not good. It's certainly not anywhere near SQLite's quality, performance, or codebase size. Many elements are the most basic thing that could possibly work, or else missing entirely. To name some examples:

- Absolutely no concurrency.

- The B-tree implementation has a line "// TODO: Free old overflow pages if any."

- When the pager adds a page to the free list, it does a linear search through the entire free list (which can get arbitrarily large) just to make sure the page isn't in the list already.

- "//! The current planner scope is intentionally small: - recognize single-table `WHERE` predicates that can use an index - choose between full table scan and index-driven lookup."

- The pager calls clone() on large buffers, which is needlessly inefficient, kind of a newbie Rust mistake.

However…

It does seem like a codebase that would basically work. At a large scale, it has the necessary components and the architecture isn't insane. I'm sure there are bugs, but I think the AI could iron out the bugs, given some more time spent working on testing. And at that point, I think it could be perfectly suitable as an embedded database for some application as long as you don't have complex needs.

In practice, there is little reason not to just reach for actual SQLite, which is much more sophisticated. But I can think of one possible reason: SQLite has been known to have memory safety vulnerabilities, whereas this codebase is written in Rust with no unsafe code. It might eat your data, but it won't corrupt memory.

That is impressive enough for now, I think.


> But I can think of one possible reason: SQLite has been known to have memory safety vulnerabilities, whereas this codebase is written in Rust with no unsafe code.

I've lost every single shred of confidence I had in the comment's more optimistic claims the moment I read this.

If you read through SQLite's CVE history, you'll notice most of those are spurious at best.

Some more context here: https://sqlite.org/cves.html


I am using sqlite in my project. It definitely solves problems, but I keep seeing overly arrogant and sometimes even irresponsible statements from their website, and can't really appreciate much of their attitude towards software engineering. The below quote from this CVE page is one more example of such statements.

> All historical vulnerabilities reported against SQLite require at least one of these preconditions:

> 1. ...

> 2. The attacker can submit a maliciously crafted database file to the application that the application will then open and query.

> Few real-world applications meet either of these preconditions, and hence few real-world applications are vulnerable, even if they use older and unpatched versions of SQLite.

This 2. precondition is literally one of the idiomatic usage of sqlite that they've suggested on their site: https://sqlite.org/appfileformat.html


SQLite is tested against failure to allocate at every step of its operation: running out of memory never causes it to fail in a serious way, eg data loss. It's far more robust than almost every other library.

assuming your malloc function returns NULL when out of memory. Linux systems don't. They return fake addresses that kill your process when you use them.

Lucky that SQLite is also robust against random process death.


That's not how Linux memory management works, there are no poison values. Allocations are deferred until referenced (by default) and when a deferred allocation fails that's when you get a signal. The system isn't giving you a "fake address" via mmap.

My interpretation of the GP comment is that you are saying the same thing. Linux will return a pointer that is valid for your address space mappings, but might not be safe to actually use, because of VM overcommit. Unixes in general have no way to tell the process how much heap can be safely allocated.

Unfortunately it is not so easy. If rigorous tests at every step were able to guarantee that your program can't be exploited, we wouldn't need languages like Rust at all. But once you have a program in an unsafe language that is sufficiently complex, you will have memory corruption bugs. And once you have memory corruption bugs, you eventually will have code execution exploits. You might have to chain them more than in the good old days, but they will be there. SQLite even had single memory write bugs that allowed code execution which lay in the code for 20 years without anyone spotting them. Who knows how many hackers and three letter agencies had tapped into that by the time it was finally found by benevolent security researchers.

I'm not impressed:

- if you're not passing SQLite's open test suite, you didn't build SQLite

- this is a "draw the rest of the owl" scenario; in order to transform this into something passing the suite, you'd need an expert in writing databases

These projects are misnamed. People didn't build counterstrike, a browser, a C compiler, or SQLite solely with coding agents. You can't use them for that purpose--like, you can't drop this in for maybe any use case of SQLite. They're simulacra (slopulacra?)--their true use is as a prop in a huge grift: tricking people (including, and most especially, the creators) into thinking this will be an economical way to build complex software products in the future.


I'm generally not this pedantic, but yeah, "I wrote an embedded database" is fine to say. If you say "I built SQLite", I expected to at least see how many of the SQLite tests your thing passed.

> tricking people (including, and most especially, the creators),

I believe it's an ad. Everything about it is trying so hard to seem legit and it's the most pointless thing I have ever seen.


Also, the very idea is flawed. These are open-source projects and the code is definitely part of the training data.

That's why our startup created the sendfile(2) MCP server. Instead of spending $10,000 vibe-coding a codebase that can pass the SQLite test suite, the sendfile(2) MCP supercharges your LLM by streamlining the pipeline between the training set and the output you want.

Just start the MCP server in the SQLite repo. We have clear SOTA on re-creating existing projects starting from their test suite.


This would be relevant if you could find matching code between this and sqlite. But then that would invalidate basically any project as "not flawed" really - given GitHub, there's barely any idea which doesn't have multiple partial implementations already.

Even if was copying sqlite code over, wouldn't the ability to automatically rewrite sqlite in Rust be a valuable asset?

Not really because it's not possible for SQLite written in Rust to pass SQLite's checks. See https://www.sqlite.org/whyc.html

That doesn't seem to support your claim; guessing you mean:

> "2. Safe languages insert additional machine branches to do things like verify that array accesses are in-bounds. In correct code, those branches are never taken. That means that the machine code cannot be 100% branch tested, which is an important component of SQLite's quality strategy."

'Safe' languages don't need to do that, if they can verify the array access is always in bounds at compile time then they don't need to emit any code to check it. That aside, it seems like they are saying:

    for (int i=0; i<10; i++) {
        foo(array[i]);
    }
in C might become the equivalent of:

    for (int i=0; i<10; i++) {
        if (i >= array_lower && i < array_higher) {
            foo(array[i]);
        } else {
            ??? // out of bounds, should never happen
        }
    }
in a 'safe' language, and i will always be in inside the array bounds so there is no way to test the 'else' branch?

But that can't be in SQLite's checks as you claim, because the C code does not have a branch there to test?

Either way it seems hard to argue that a bounds test which can never fail makes the code less reliable and less trustworthy than the same code without a bounds test, using the argument that "you can't test the code path where the bounds check which can never fail, fails" - because you can use that same argument "what if the C code for array access which is correct, sometimes doesn't run correctly, you can't test for that"?


Correct, that's what I mean. I trust SQLite's devs to know more about this, so I trust what they wrote. There are parts of Rust code that are basically:

  do_thing().expect(...);
This branch is required by the code, even if it can't be reached, because the type system requires it. It's not possible to test this branch, therefore 100% coverage is impossible in those cases.

You normally count/test branches at the original language level, not the compiled one. Otherwise we'd get VERY silly results like:

- counting foo().except() as 2 branches

- counting a simple loop as a missed branch, because it got unrolled and you didn't test it with 7,6,5,4,3,2,1 items

- failing on unused straight implementation of memcpy because your CPU supports SIMD and chose that alternative

Etc. The compiled version will be full of code you'll never run regardless of language.


That’s not my requirement, that’s SQLite’s requirement. If you want to dispute their claim, I recommend you write to them, however I strongly suspect they know more about this than you do.

The type system does not require that. You can just discard the result:

  let _ = do_thing();

Except that doesn’t work if you need to use the result…

Well--given a full copy of the SQLite test suite, I'm pretty sure it'd get there eventually. I agree that most of these show-off projects are just prop pieces, but that's kind of the point: Demonstrate it's technically possible to do the thing, not actually doing the thing, because that'd have diminishing returns for the demonstration. Still, the idea of setting a swarm of agents to a task, and, given a suitable test suite, have them build a compliant implementation, is sound in itself.

Sure, but that presumes that you have that test suite written without having a single line of application code written (which, to me, is counterintuitive, unrealistic, and completely insane)

SQLite apparently has 2 million tests! If you started only with that and set your agentic swarm against it, and the stars aligned and you ended up with a pristine, clean-room replica that passes everything, other than proof that it could be done, what did you achieve? You stood on the shoulders of giants to build a Bizarro World giant that gets you exactly back to where you began?

I'd be more interested in forking SQLite as-is, setting a swarm of agents against it with the looping task to create novel things on top of what already exists, and see what comes out.

[0] https://en.wikipedia.org/wiki/SQLite#Development_and_distrib...


You think an implementation of SQLite in another language, with more memory safety, has no value?

I agree that this current implementation is not very useful. I would not trust it where I trust SQLite.

Regardless, the potential for having agents build clean room implementations of existing systems from existing tests has value.


> I'm pretty sure it'd get there eventually.

Why? The combinatorics of “just try things until you get it right” makes this impractical.


If you minimax for passing the SQLite test suite, I’m still not sure you’ll have a viable implementation. You can’t prove soundness of code through a test suite alone.

agreed!

sorry for misleading, added an update stating that this is a simulacra of sqlite

> That is impressive enough for now, I think.

There are lot of embedded SQL libraries out there. I'm not particularly enamoured with some of the design choices SQLite made, for example the "flexible" approach they take to naming column types, so that isn't why I use it.

I use it for one reason: it is the most reliable SQL implementation I know of. I can safely assume if file corruption, or invariants I tried to keep aren't there, it isn't SQLite. By completely eliminating one branch of the failure tree, it saves me time.

That one reason is the one thing this implementation lacks - while keeping what I consider SQLite's warts.


IIRC the official test-suite is not open-source, so I'm not sure how possible this is.

You do not recall correctly. There is more than 500K SLOC of test code in the public source tree. If you "make releasetest" from the public source tarball on Linux, it runs more than 15 million test cases.

It is true that the half-million lines of test code found in the public source tree are not the entirety of the SQLite test suite. There are other parts that are not open-source. But the part that is public is a big chunk of the total.


Out of curiosity, why aren't all tests open source?

One set of proprietary tests is used in their specialist testing service that is a paid for service.

What is that service used for besides SQLite?

It's still SQLite, they just need to make money: https://sqlite.org/prosupport.html

Edit: also this:

> TH3 Testing Support. The TH3 test harness is an aviation-grade test suite for SQLite. SQLite developers can run TH3 on specialized hardware and/or using specialized compile-time options, according to customer specification, either remotely or on customer premises. Pricing for this services is on a case-by-case basis depending on requirements.


That's interesting. Here is more information https://sqlite.org/th3.html

The roots of SQLite are in defence industry projects of US Navy and General Dynamics. Seems like TH3 might be of interest for these sort of users.


One could assume also for Fossil.

> I think the AI could iron out the bugs, given some more time spent working on testing

I would need to see evidence of that. In my experience it's really difficult to get AI to fix one bug without having it introduce others.


Have it maintain and run a test suite.

V8 is faster than LuaJIT. But sure, it has a large binary size.

The announcement itself looks potentially AI-assisted, judging by the bulleted list style and redundant text under the "Charity: Transition to Kuwasha" section. But maybe some people just write that way.

I admit I am guilty of that, although I ran it via several iterations to make sure it covers everything I needed and created a nice style that i liked. It just saves me so much time.

Wait a couple of more months, and no-none will know to write any other way.

Huh? Homebrew supports and frequently uses dependencies between formulae. It’s a bit janky around upgrades in my experience, but you’re going to have to clarify what you mean.

Dependency management means the ability to have more than 1 version of the dependency installed, under the same package name.

i.e. Let's say you install a bunch of homebrew packages, everything is working. Then 6 months later you go to install another package - homebrew likes to upgrade all your packages (and their dependencies) willy nilly.

And if it breaks shit, there's no way to downgrade to a specific version. Sometimes shit broke because the newer package is actually a broken package, or sometimes it's because the dev environment was depending on a specific version of that package.

There's basically no way to have multiple versions of the exact same package installed unless they use their hacky workaround to create additional packages with the version number included in the package name.


> Your premise is that a YouTube video published Dec 26, 2025 somehow motivated a federal law enforcement action that commenced on Dec 4, 2025.

The surge of ~2,000 officers only happened around Jan 5-6, 2026. And this happened after the video in question was reposted by J.D. Vance and referenced by Kash Patel.

It's true that Operation Metro Surge as a whole started a month earlier. But, zooming out from that specific video, the operation was from the start motivated by the fraud scandal, according to reliable sources [1]. Official statements around this time of the later surge also referenced the fraud scandal [2]. Meanwhile, Trump delivered several speeches during this time complaining in racist terms about Somalis in general.

It's also true that the actual activity of Operation Metro Surge is mostly unrelated to the fraud. But that's the whole point! The administration seized on the fraud, and later seized on that specific video, as an excuse to send in ICE and CBP agents to do something completely different. As the parent said, this probably did not "make it more [..] likely that we'll be able to investigate and resolve the fraud situation in MN". Or if it did, it did so very inefficiently compared to other possible approaches such as getting the FBI to focus on it (which also happened). The surge did focus public attention on the issue, which might encourage local officials to resolve it. But it also massively poisoned the well. How much you want to talk about the fraud issue is now a proxy for how much you _don't_ want to talk about what liberals see as the much larger issue of abuses by ICE/CBP.

[1] https://www.nytimes.com/2025/12/02/us/politics/ice-somali-mi...

[2] https://x.com/KristiNoem/status/2005687345895645204


At one point it says “fully pronated like we can, or bunnies can”, which sounds like a reference to actual rabbits, but some quick Googling suggests that rabbits don’t pronate? (I know nothing about the subject myself.)

I don't really understand what "pronating" is supposed to mean if you're not referring to human hands. This isn't a problem for the phrase "bunny hands", which refers to human hands.

But for, say, human feet, "pronation" would appear to refer to a position in which the soles of the feet face toward the ground, just as in hands it refers to a position in which the palms face toward the ground, or in humans overall it refers to a position in which the face and belly face toward the ground. That is the meaning of "prone" ("lying on your front"; it is the opposite of supine, "lying on your back"), and "pronation" just means "making something be prone".

But obviously all feet are always pronated in this sense. The article seems to have a model of the word which is more like "pronation [in the hands] involves a certain configuration of the bones in the arm, and I'm going to call that configuration pronation too". But then they also refer to rotating the forearm, which confuses bone configuration with yet another issue, the changeability of the configuration.†

So I'm left mystified as to how this single-or-possibly-manifold concept is supposed to apply to feet, human or otherwise. The article suggests that pronat_ed_ feet have the toes facing forward, parallel to the direction of the gaze, and also that pronat_ing_ feet requires the ability to rotate the lower part of the leg.

In humans, these claims cannot both be true. Toes are angled forward, but the lower leg doesn't rotate. Something else has happened.

So it's hard to say what I should conclude about the mammoth legs that the article also complains about.

† The article complains about a dinosaur skeleton in which the hands aren't pronated - they face inwards, in a pose we might call "karate chop hands". But it says that this pose requires "pronation" in what is presumably the arm-bones sense. In "bunny hands", the hands are pronated according to the normal definition of the word, facing the ground.


Looks like you need to be careful with the definition of pronation and supination for feet. There's a lot of results for running where they use the term dynamically, and it looks to be different from the original technical meaning.

You can look at images here (be careful to only look at images where it is obvious whether it is a left foot or a right foot, otherwise you'll be doubly confused): https://duckduckgo.com/?q=pronating+feet&ia=images&iax=image...

For hands you can see the twisting more clearly: https://duckduckgo.com/?q=pronating+hands&ia=images&iax=imag...

For feet, the word pronating seems to also mean (perhaps colloquially) rolling the foot inwards at the ankle. Not clear at all: although some of the images show twisting the shin or not (toe in vs duck feet).


The downside is that you miss the chance to brush up on your math skills, skills that could help you understand and express more complicated requirements.

...This may still be worth it. In any case it will stop being a problem once the human is completely out of the loop.

edit: but personally I hate missing out on the chance to learn something.


That would indeed be the case if one has never learned the stuff. And I am all in for not using AI/LLM for homework/assignments. I don't know about others, but when I was in school, they didn't let us use calculators in exams.

Today, I know very well how to multiply 98123948 and 109823593 by hand. That doesn't mean I will do it by hand if I have a calculator handy.

Also, ancient scholars, most notably Socrates via Plato, opposed writing because they believed it would weaken human memory, create false wisdom, and stifle interactive dialogue. But hey, turns out you learn better if you write and practice.


In later classes in school, the calculator itself didn't help. If you didn't know the material well enough, you didn't know what to put into the calculator.

In most cases security is not a matter of adding anything in particular, but a matter of just not making specific types of mistakes.

Maybe I'm being dumb but that reads very contradictory? I would say that security is explicitly a matter of adding particular things.

Not an OP, but seems like you might be talking about different things.

Security could be about not adding certain things/making certain mistakes. Like not adding direct SQL queries with data inserted as part of the query string and instead using bindings or ORM.

If you have insecure raw query that you feed into ORM that you added on top - that's not going to make query more secure.

But on the other hand when you're securing some endpoints in APIs you do add things like authorization, input validation and parsing.

So I think a lot depends on what you mean when you're talking about security.

Security is security - making sure bad things don't happen and in some cases it's different approach in the code, in some cases additions to the code and in some cases removing things from the code.


Is there ever a reason to store passwords in plaintext instead of as a hash? Even in a prototype.

The better question is which LLM is going to make such a basic mistake?

If you already know where the start of the opening tag is, then I think a regex is capable of finding the end of that same opening tag, even in cases like yours. In that sense, it’s possible to use a regex to parse a single tag. What’s not possible is finding opening tags within a larger fragment of HTML.

For any given regex, an opponent can craft a string which is valid HTML but that the regex cannot parse. There are a million edge cases like:

  <!—- Don't count <hr> this! -—> but do count <hr> this -->
and

  <!-- <!-- Ignore <ht> this --> but do count <hr> this —->
Now your regex has to include balanced comment markers. Solve that

You need a context-free grammar to correctly parse HTML with its quoting rules, and escaping, and embedded scripts and CDATA, etc. etc. etc. I don't think any common regex libraries are as powerful as CFGs.

Basically, you can get pretty far with regexes, but it's provably (like in a rigorous compsci kinda way) impossible to correctly parse all valid HTML with only regular expressions.


HTML comments do not nest. The obvious tokenizer you can create with regular expressions is the correct one.

If you're talking about tokenizers, then you're no longer parsing HTML with a regex. You're tokenizing it with a regex and processing it with an actual parser.

If you are talking about detecting tags, you (and the person asking that SO question) is talking about tokenization, and everybody (like the one making that famous answer) bringing parsing into the discussion is just being an asshole.

The original SO question was not asking about parsing.

I don't think your comment assumes the right givens. I just tried in Vivaldi (i.e. Chrome) and this snippet:

    <!doctype html>
    A<!—- Don't count <hr> this! -—> but do count <hr> that -->Z
gets fixed and rendered as

    <!DOCTYPE html>
    <html><head></head><body>A<!--—- Don't count <hr--> this! -—&gt; but do count <hr> that --&gt;Z</body></html>
Another surprise is that

    <!doctype html>
    A<!—- Don't count this! -— but do count that -->Z
gets rewritten to

    <!DOCTYPE html>
    <html><head></head><body>A<!--—- Don't count this! -— but do count that ---->Z</body></html>
Note the insertion of extra `--` minus-hyphens.

This is what MDN (https://developer.mozilla.org/en-US/docs/Web/HTML/Guides/Com...) has to say:

Comments start with the string `<!--` and end with the string `-->`, generally with text in between. This text cannot start with the string `>` or `->`, cannot contain the strings `-->` or `--!>`, nor end with the string `<!-`, though `<!` is allowed. [...] The above is true for XML comments as well. In addition, in XML, such as in SVG or MathML markup, a comment cannot contain the character sequence `--`.

Meaning that you can recognize HTML comments with (one branch of) a RegEx—you start wherever you see `<!--` and consume everything up to one of the listed alternatives. No nesting required.

Be it said that I find the precise rules too convoluted for what they do. Especially XML's prohibition on `--` in comments is ridiculous taken on its own. First you tell me that a comment ends with three characters `-->`, and then you tell me I can't use the specific substring `--`, either? And why can't I use `--!>`?

An interesting bit here is that AFAIK the `<!` syntax was used in SGML as one of the alternatives to write a 'lone tag', so instead of `<hr></hr>` or `<hr/>` (XHTML) or `<hr>` (HTML) you could write `<!hr>` to denote a tag with no content. We should have kept this IMO.

*EDIT* On the quoted HTML source you see things like `-—` (hyphen-minus, em-dash). This is how the Vivaldi DevTools render it; my text editor and HN comment system did not alter these characters. I have no idea whether Chrome's rendering engine internally uses these em-dashes or whether it's just a quirk in DevTool text output.


Personally I’ve handled this by just ignoring the gradual part and keeping everything strictly typed. This sometimes requires some awkwardness, such as declaring a variable for an expression I would otherwise just write inline as part of another expression, because Pyright couldn’t infer the type and you need to declare a variable in order to explicitly specify a type. Still, I’ve been quite satisfied with the results. However, this is mostly in the context of new, small, mostly single-author Python codebases; I imagine it would be more annoying in other contexts.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: