Replit rebuilt its sandbox engine with microVMs(frontier.replit.com)
45 pointsby gaplong4 hours ago10 comments
  • ghshephard2 hours ago
    Replit intrigues me. Other than Paul Graham talking it up a lot on Twitter - I've never once heard of anyone using it, seen any chatter about it in any or our internal slack forums. Every other AI company I get barraged with- no matter where I go, even antigravity/gemini carbon/argon/models/etc... - which nobody I know uses either - but at least I hear about them a lot.

    I wonder what ecosystem replit exists in that seems to completely not overlap with any of the other AI technologies and companies....

    • robgough2 hours ago
      I've been picking up bits of fractional CTO work over the last year or so and getting more involved with other founders... and I'm seeing plenty of people using it (and the other systems like it). They're just not generally people from a software engineering background, as you'd probably expect. So it's not a massive surprise that you're not crossing paths with them.

      Generally it's entrepreneurial types who would have gone to an agency to get something built, or would have wanted to go to an agency but couldn't afford the costs involved. These platforms are far cheaper and quicker, and if we're really honest not necessarily worse quality than what they would have gotten from the vast majority of those agencies, especially the cheaper ones.

      This is not a comment on whether this is a good thing or not, and I have all sorts of concerns, but it's undeniably something I'm seeing, and the nearshore/offshore agencies are certainly starting to feel the impact.

      • mritchie7129 minutes ago
        there's this brief window where replit makes sense, but it could disappear in a month if things like ChatGPT sites get much better.
    • nafey17 minutes ago
      I used Replit quite a lot back in the day to share code snippets with clients.
  • schainks2 hours ago
    My read on this is they re-invented the OTP supervision tree, process isolation, hibernation, and actor-to-actor message passing, but had to push the isolation boundary all the way down into Ring -1 (KVM/Cloud Hypervisor) and customized Linux tinyconfig kernels because their "actors" are actively trying to jailbreak the hypervisor.

    Is that about right?

  • clhodapp3 hours ago
    It's only somewhat related to the article, but:

    How do people feel about the hardware isolation provided by microVMs versus strong software isolation techniques like gvisor?

    Right now, we put a huge amount of stock in "hardware isolation". If that starts falling to agents to any substantial degree, I wonder whether we might end up seeing a transition toward patchable software isolation, similar to the rise of software RAID that occurred a while back.

    • tptacek2 hours ago
      The general vibe I hear from security practitioners is that they (gvisor and Firecracker/Cloud-Hypervisor) are comparable. You generally do Firecracker if you can get away with it, because it's simpler and faster, but to do it well you generally need bare-metal hosts.

      I think "hardware" vs. "software" is the wrong way to frame this. The big difference is between shared-kernel multitenant and guest kernels. gVisor (in some configurations) is like an 80% solution; a partially emulated guest kernel. I think the verdict is in on shared-kernel vs. not: don't share kernels between tenants.

      The hardware isolation itself --- AMD-V, VT-X, &c --- has held up for almost 2 decades now. You never know, of course, but if you were going to place a bet it probably wouldn't be on hardware isolation failing before software did.

    • oxcartctl2 hours ago
      [dead]
  • pearcoder2 hours ago
    MicroVMs are quite popular nowadays due to sandboxing but we need to also keep in mind least privilege principle. Applying that is also tricky.
  • stevekemp3 hours ago
    I do hope nobody reading this copies any of Replit's design decisions or architecture, lest they get threatened.

    I avoided reading the piece, just in case.

  • iberatoran hour ago
    Guys. You could do the same with ansible like decade ago.
  • slatedalean hour ago
    [flagged]
  • qingwind_galan hour ago
    [flagged]
  • guhcostan3 hours ago
    [flagged]