Why is it a new surface? Either you can run UEFI code, or you can't. Attacking the JS interpreter itself is unrealistic IMHO, it's the poorly written JavaScript running on top of this that might open new surfaces of attack. But other UEFI code is mostly written in C or C++, so let's call that a wash?
Can someone break this down for me? Looks like it's using... C? to load a js interpreter which bootstraps an API around all UEFI features? Do I have that right?
And, if so, does that mean that once the API has been bootstrapped, one could actually write an OS in js? Or are there other abstractions that would need to be migrated first?
Seems like a small number of hobbyists have attempted.
I've heard of people doing this with other high level languages. Basically you need enough low level code to bootstrap a VM. Once you have that, you can make the high level language decide some logic that traditionally would be in C code, like manipulating page tables or whatever.
Automatic Garbage Collection in a kernel probably won't work:
I vaguely remember hearing about someone trying to use .Net in the Windows kernel.
The big problem is garbage collection: If I remember correctly, the fact that "any" operation can fail with an out of memory exception was a huge problem. Another problem was that random pauses for garbage collections in the kernel had major stability issues.
In short, I hope that the js kernel is for amusement and education; otherwise it would need a much more advanced garbage collector then earl 2000's .Net.
> I vaguely remember hearing about someone trying to use .Net in the Windows kernel.
Microsoft did that, it was called Longhorn. That release cycle was long delayed and they abandoned most of its ambitious projects, especially C# in the kernel, and the result was Windows Vista.
GC was not the only reason for the failure of that project. Someone could write a book about it. A lot of it was actually more about the organization of people. I also had heard from insiders that lack of ahead of time compilation was an issue. The other issue I remember hearing about was a complaint that Windows components were not layered cleanly and they ended up with circular dependencies when they tried to rewrite them.
I think it's possible to write a kernel with GC, and to still be judicious about memory usage with a GC language. And I say that as someone who happens to think that a big issue with modern software is that too many programmers are spending their whole education and career to depend on GC without thinking about it carefully. That is to say I'm already a skeptic of high-level languages and GC, but I will still afford that it is technically possible.
My source for that is I was on the Windows team at Microsoft from 2008-2011. I learned a bunch of this history from talking to coworkers who were there. I specifically recall people talking about c# in the kernel.
Another part of it was, IIRC, that Longhorn was based off of the Windows XP core, i.e. the non-server stuff. While the Windows Server development continued apace, with lots of security and hardening to make for a reliable OS to build upon, the Windows Non-Server team continued with the existing mess of a codebase, not prioritizing security features or stability in favor of trying to manage feature creep. Longhorn was meant as a stopgap between XP and 'Blackcomb', but a lot of Blackcomb stuff started creeping backwards, bogging them down.
When security and reliability were suddenly key issues for Microsoft (to the extent that they ever were), it was obvious that what the Longhorn team had built was never going to meet that bar so they started over building off the Windows Server codebase instead.
Most of this story I remember from a video on YouTube of that old guy who worked at Microsoft since forever and left around the time of the Longhorn debacle, but a lot of it is corroborated in the Wikipedia article as well. https://en.wikipedia.org/wiki/Development_of_Windows_Vista
> I think it's possible to write a kernel with GC, and to still be judicious about memory usage with a GC language. ... but I will still afford that it is technically possible.
I need to split some hairs for a bit:
Do you mean what is colloquially referred to as "GC", as in the dotnet / Java / Javascript / golang "mark-and-sweep", fully-automatic style?
Or do you mean other automatic memory management systems, which some people technically define as GC, like automatic reference counting? (IE, they clean up memory immediately, and except for requiring some manual form of breaking cyclic loops, generally are fully automatic?)
Given that we are talking about JavaScript, I meant the former.
The latter is pretty much the status quo in terms of the state of the art. Most kernels aren't built with automatic reference counting, reference counted objects are plentiful even if more manual, but the automatic part is trivial to add to a C++ code base using smart pointers for example, and things like rust or apple ARC can also do it.
I think the former (a "true" GC that can resolve cycles) could be done in a kernel, it's just not common.
I'm not well versed in this historical example, did the "lisp machine" not have a GC in its OS?
You'd need to write an entire hardware abstraction layer to do anything useful. There's projects that do this for microcontrollers - eg MicroPython and Espruino.
Yes, it would need support from lower level code. But then, so does C -- many things that an OS needs to do, such as installing interrupt handlers, changing the current page table pointer, jumping into a target process already in progress, etc., are not part of the C standard.
You don't need a JS bootloader to write an OS in JS. The bootloader just drops the machine into some memory address for it to start executing your OS init script. that bit could be a Javascript interpreter. You can't do much with the architecture in Javascript though, because it doesn't allow you to map memory directly to your types (unless there's some ungodly nonesense I'm not aware of) so you'll have to drop into C/asm to e.g. interact with the ports/registers/tables to set up userspace.
I'm pretty sure someone already compiled Linux to asm.js a few years ago. As asm.js is/was a subset of JS, you could say it's already been done. In theory, you could continue work from there in JS.
webuefi has already been shipped by google for use on chromebooks. but mozilla and apple irrationally refuse to implement the standard for "security reasons"
Does it manage to support floats? I am not sure if those can be safely used in the UEFI environment. (I recall GRUB’s build of Lua being integer-only, and Linux avoiding the use of floating-point arithmetic in kernel mode, but I don’t remember the reason.)
Whoa, I haven not been following ASM.js stuff in any detail.
Seeing that Metal replaces kernel/userspace boundaries with VM protections for memory, meaning that system call overhead is eliminated, at the price of ASM/VM overhead.
I don't know if it's only me, but did this guy... Did this guy make a huge mistake?
I think he was trying to bend reality with words. I can see many apps that are running in electron on my laptop, each consuming 300MB+ (e.g. Spotify), while many other apps are written in native Swift for example, especially with the help of AI, giving the best performance possible...
There is a pretty significant difference between the way JS is used there and in electron apps.
This might be what you were getting to but I tend to agree with the idea of place all the interaction logic in a high kevel language and get the performance where it's needed.
Electron does not do that and neither does the people developing electron apps most of the time. I doubt many people throwing electron apps together chose to do that so they can put their CPU intensive code in C/C++/Rust/swift, they want to erite everything in JS.
What should happen is the bare minimum needs to be in JS and the rest in an efficient compiled language.
I mean even the browser does that, the DOM API hands off to lower level libraries for multimedia etc.
Funny, I've always found it interesting how "on point" it was...
Granted, yeah, we never (or haven't yet) really transitioned to running "full legacy software" inside the browser, or at least it's not common place. That said, I've seen people compile Wine to wasm, Linux to wasm, and lots of other things to wasm, and run em in a browser. Many of the "fake" demos could be done for real now.
The one aspect that remains thoroughly farcical is an equivalent of Wine for OS X/Cocoa good enough to run a web browser. :-(
[edit] And asm.js kind of died on the vine. Not sure how to feel about that one. Wasm could he described as an evolution of the same idea, but in a lot of ways it's something entirely different.
I’m always amazed and slightly envious of what programming languages with large developer bases can do. I mean if a language is Turing complete it can do anything, but JavaScript takes this to the extreme.
Mind you I never said anything about quality or performance, obviously doing everything in JavaScript comes with it’s own issues but if you were to say that someone got JavaScript running in the Linux kernel as a POC I wouldn’t even be surprised
Could this be used as a learning tool? Rebooting the computer takes so much more time compared to reloading the browser tab. And you probably can't brick your computer.
This is hilarious lol, it’ll be any day now before we get a full JS kernel. Garbage collection could be an obstacle, but I know there have been some kernels written in Go/Java before
I don't have real context here, but I can imagine that a platform where the hardware costs millions of dollars, will be booted up in "Production" exactly once, and is guaranteed to be physically destroyed before it hits 1 day of uptime, just "Give it 128GB of RAM and YOLO (literally)" is great advice!
Note: 128GB of DRAM may add another million dollars to the build cost by 2027 at the current derivative of the $/GB curve
1) JavaScript must stay in the box (aka in the browser).
2) JavaScript as a general purpose programming language.
While I can absolutely understand 1), I have had wanted to access
the filesystem via JavaScript, just as I do via ruby or python, for
local use only. After I googled for a while, they would say that
this is not possible unless one uses npm/node. I think this shows
that there are use cases here and the "default" JavaScript, aka 1),
does not cover these. I do not like JavaScript, but based on my
own use cases, I actually favour 2) far more than 1). So from that
point of view, being able to access UEFI can also be useful. So
why not.
As for (1) vs (2), it’s not really an issue of JavaScript at all. The main question is, do you want to build something that runs in a browser? If you’re building a web app, you’ll have to use the sandboxed APIs (and probably JavaScript). If you don’t care about the runtime, yeah, you can use Node or Bun or Deno (or use another language altogether).
I've been using Deno a LOT for general shell scripting... it's been pretty nice in general. FWIW, Node, Bun and Deno have FS interfaces in the box, so yes, you can do it without npm modules. Though Deno allows you to directly reference the modules/repos from the script without needing a separate install step, package.json or node_modules directory.
It's also a single, self-updating executable and includes a lot in the box. Including SQLite3.
The choice of Duktape here is smart — it's one of the few JS engines that can actually run freestanding with minimal libc stubs, since it was designed for embedding in constrained environments. V8 or SpiderMonkey would be a nightmare to get running pre-boot.
What I find most interesting is the UEFI services binding approach. Rather than trying to abstract away the hardware, it exposes the raw EFI protocols (GraphicsOutput, SimpleFileSystem, etc.) directly to JS. That's a much more pragmatic design than trying to build a full HAL — you get to prototype UEFI applications rapidly while keeping the escape hatch to C for anything performance-critical.
Would love to see if anyone tries hooking this into UEFI's built-in network stack for PXE boot scripting. That could actually be useful beyond the novelty factor.
Pretty dang common. OS X and macOS (and maybe iOS and iPadOS, though I'm not certain) have been autocorrecting "--" into "—" for over a decade. Windows users have been using Alt codes for them since approximately forever ago: https://superuser.com/q/811318.
Typography nerds, which are likely overrepresented on HN, love both em dash and en dash, and we especially love knowing when to use each. Punctation geeks, too! If you know what an octothorp or an interrobang are, you've probably been using em dashes for a long time.
Folks who didn't know what an em dash was by name are now experiencing the Baader-Meinhof phenomenon en masse. I've literally had to disable my "--" autocorrect just to not be accused of using an LLM when writing. It's annoying.
Javascript is a horrible choice but I think having a scripting language for this is actually quite a good idea. If only there was a popular scripting language that didn't totally suck balls.
edward28 | a month ago
monax | a month ago
kijin | a month ago
lnenad | a month ago
madduci | a month ago
monax | a month ago
magicalhippo | a month ago
monax | a month ago
ThrowawayTestr | a month ago
madduci | a month ago
yjftsjthsd-h | a month ago
M95D | a month ago
eqvinox | a month ago
g051051 | a month ago
Pretty neat, though.
fbnszb | a month ago
redvulps | a month ago
monax | a month ago
aruametello | a month ago
tracker1 | a month ago
karel-3d | a month ago
It's what Claude Code is using.
my_throwaway23 | a month ago
monax | a month ago
spiffyk | a month ago
monax | a month ago
p_l | a month ago
catapart | a month ago
And, if so, does that mean that once the API has been bootstrapped, one could actually write an OS in js? Or are there other abstractions that would need to be migrated first?
monax | a month ago
nxobject | a month ago
DustinBrett | a month ago
asveikau | a month ago
I bet somebody has done that.
https://www.google.com/search?q=os+kernel+in+javascript
Seems like a small number of hobbyists have attempted.
I've heard of people doing this with other high level languages. Basically you need enough low level code to bootstrap a VM. Once you have that, you can make the high level language decide some logic that traditionally would be in C code, like manipulating page tables or whatever.
gwbas1c | a month ago
I vaguely remember hearing about someone trying to use .Net in the Windows kernel.
The big problem is garbage collection: If I remember correctly, the fact that "any" operation can fail with an out of memory exception was a huge problem. Another problem was that random pauses for garbage collections in the kernel had major stability issues.
In short, I hope that the js kernel is for amusement and education; otherwise it would need a much more advanced garbage collector then earl 2000's .Net.
asveikau | a month ago
Microsoft did that, it was called Longhorn. That release cycle was long delayed and they abandoned most of its ambitious projects, especially C# in the kernel, and the result was Windows Vista.
GC was not the only reason for the failure of that project. Someone could write a book about it. A lot of it was actually more about the organization of people. I also had heard from insiders that lack of ahead of time compilation was an issue. The other issue I remember hearing about was a complaint that Windows components were not layered cleanly and they ended up with circular dependencies when they tried to rewrite them.
I think it's possible to write a kernel with GC, and to still be judicious about memory usage with a GC language. And I say that as someone who happens to think that a big issue with modern software is that too many programmers are spending their whole education and career to depend on GC without thinking about it carefully. That is to say I'm already a skeptic of high-level languages and GC, but I will still afford that it is technically possible.
anonymars | a month ago
> Microsoft did that, it was called Longhorn
Do you have any reference for that? Or are you confusing Longhorn with Singularity (https://en.wikipedia.org/wiki/Singularity_(operating_system)) / Midori (https://en.wikipedia.org/wiki/Midori_(operating_system))?
I suspect you're referring to the shell/internals, though, not the kernel (https://longhorn.ms/the-reset/#:~:text=Why%20start%20over,re...)
asveikau | a month ago
danudey | a month ago
When security and reliability were suddenly key issues for Microsoft (to the extent that they ever were), it was obvious that what the Longhorn team had built was never going to meet that bar so they started over building off the Windows Server codebase instead.
Most of this story I remember from a video on YouTube of that old guy who worked at Microsoft since forever and left around the time of the Longhorn debacle, but a lot of it is corroborated in the Wikipedia article as well. https://en.wikipedia.org/wiki/Development_of_Windows_Vista
gwbas1c | a month ago
I need to split some hairs for a bit:
Do you mean what is colloquially referred to as "GC", as in the dotnet / Java / Javascript / golang "mark-and-sweep", fully-automatic style?
Or do you mean other automatic memory management systems, which some people technically define as GC, like automatic reference counting? (IE, they clean up memory immediately, and except for requiring some manual form of breaking cyclic loops, generally are fully automatic?)
asveikau | a month ago
The latter is pretty much the status quo in terms of the state of the art. Most kernels aren't built with automatic reference counting, reference counted objects are plentiful even if more manual, but the automatic part is trivial to add to a C++ code base using smart pointers for example, and things like rust or apple ARC can also do it.
I think the former (a "true" GC that can resolve cycles) could be done in a kernel, it's just not common.
I'm not well versed in this historical example, did the "lisp machine" not have a GC in its OS?
leoedin | a month ago
tracker1 | a month ago
asveikau | a month ago
tatskaari | a month ago
Zambyte | a month ago
monocasa | a month ago
hajile | a month ago
https://medium.com/@retrage/lkl-js-running-linux-kernel-on-j...
bayindirh | a month ago
faxmeyourcode | a month ago
> Prometheus stole fire from the gods and gave it to man. For this he was chained to a rock and tortured for eternity.
falcor84 | a month ago
> If this makes you grin, you are probably holding the torch.
tosti | a month ago
Smalltalker-80 | a month ago
monax | a month ago
ruined | a month ago
tosti | a month ago
outadoc | a month ago
bwat49 | a month ago
fenwick67 | a month ago
lioeters | a month ago
grougnax | a month ago
GranPC | a month ago
marijnz0r | a month ago
rezmason | a month ago
dfedbeef | a month ago
ycombinatornews | a month ago
Hilarious
pwdisswordfishy | a month ago
monax | a month ago
flopsamjetsam | a month ago
rafram | a month ago
eqvinox | a month ago
What if it makes me recoil in horror? screams into the void
fnimick | a month ago
monax | a month ago
ruined | a month ago
kiddico | a month ago
epistasis | a month ago
Seeing that Metal replaces kernel/userspace boundaries with VM protections for memory, meaning that system call overhead is eliminated, at the price of ASM/VM overhead.
What a fascinating idea. Kidding on the square...
p0w3n3d | a month ago
I think he was trying to bend reality with words. I can see many apps that are running in electron on my laptop, each consuming 300MB+ (e.g. Spotify), while many other apps are written in native Swift for example, especially with the help of AI, giving the best performance possible...
Edit.
And prices of RAM nowadays...
pwdisswordfishy | a month ago
They are consuming 300MB of RAM because they are built on Electron and the NPM ecosystem.
jpc0 | a month ago
This might be what you were getting to but I tend to agree with the idea of place all the interaction logic in a high kevel language and get the performance where it's needed.
Electron does not do that and neither does the people developing electron apps most of the time. I doubt many people throwing electron apps together chose to do that so they can put their CPU intensive code in C/C++/Rust/swift, they want to erite everything in JS.
What should happen is the bare minimum needs to be in JS and the rest in an efficient compiled language.
I mean even the browser does that, the DOM API hands off to lower level libraries for multimedia etc.
arxpoetica | a month ago
spijdar | a month ago
Granted, yeah, we never (or haven't yet) really transitioned to running "full legacy software" inside the browser, or at least it's not common place. That said, I've seen people compile Wine to wasm, Linux to wasm, and lots of other things to wasm, and run em in a browser. Many of the "fake" demos could be done for real now.
The one aspect that remains thoroughly farcical is an equivalent of Wine for OS X/Cocoa good enough to run a web browser. :-(
[edit] And asm.js kind of died on the vine. Not sure how to feel about that one. Wasm could he described as an evolution of the same idea, but in a lot of ways it's something entirely different.
paulddraper | a month ago
BobbyTables2 | a month ago
Probably wouldn’t be too hard to boot Linux (under QEMU compiled for wasm), and then fire up a Windows 95 VM using QEMU TCG …
Could repeat this a few times - Inception style…
bombela | a month ago
https://copy.sh/v86/?profile=windows2000
bpavuk | a month ago
Decabytes | a month ago
Mind you I never said anything about quality or performance, obviously doing everything in JavaScript comes with it’s own issues but if you were to say that someone got JavaScript running in the Linux kernel as a POC I wouldn’t even be surprised
vaylian | a month ago
sanufar | a month ago
fnimick | a month ago
cluckindan | a month ago
xp84 | a month ago
Note: 128GB of DRAM may add another million dollars to the build cost by 2027 at the current derivative of the $/GB curve
cluckindan | a month ago
shepherdjerred | a month ago
https://en.wikipedia.org/wiki/Java_processor
juancn | a month ago
shevy-java | a month ago
1) JavaScript must stay in the box (aka in the browser).
2) JavaScript as a general purpose programming language.
While I can absolutely understand 1), I have had wanted to access the filesystem via JavaScript, just as I do via ruby or python, for local use only. After I googled for a while, they would say that this is not possible unless one uses npm/node. I think this shows that there are use cases here and the "default" JavaScript, aka 1), does not cover these. I do not like JavaScript, but based on my own use cases, I actually favour 2) far more than 1). So from that point of view, being able to access UEFI can also be useful. So why not.
notpushkin | a month ago
There are some (limited) ways to do so now: https://developer.mozilla.org/en-US/docs/Web/API/File_System...
As for (1) vs (2), it’s not really an issue of JavaScript at all. The main question is, do you want to build something that runs in a browser? If you’re building a web app, you’ll have to use the sandboxed APIs (and probably JavaScript). If you don’t care about the runtime, yeah, you can use Node or Bun or Deno (or use another language altogether).
DJBunnies | a month ago
watermelon0 | a month ago
0) JavaScript must be abolished from the browser
pwdisswordfishy | a month ago
Gnome Shell and Firefox/SeaMonkey/Mozilla Application Suite/Netscape 6+ (and Zotero[1]) are implemented on top of SpiderMonkey.
1. <https://news.ycombinator.com/item?id=46735616>
tracker1 | a month ago
It's also a single, self-updating executable and includes a lot in the box. Including SQLite3.
raphaelmolly8 | a month ago
What I find most interesting is the UEFI services binding approach. Rather than trying to abstract away the hardware, it exposes the raw EFI protocols (GraphicsOutput, SimpleFileSystem, etc.) directly to JS. That's a much more pragmatic design than trying to build a full HAL — you get to prototype UEFI applications rapidly while keeping the escape hatch to C for anything performance-critical.
Would love to see if anyone tries hooking this into UEFI's built-in network stack for PXE boot scripting. That could actually be useful beyond the novelty factor.
written-beyond | a month ago
Not implying your comment is LLM generated, clearly it isn't but asking as a genuine question.
Kerrick | a month ago
Typography nerds, which are likely overrepresented on HN, love both em dash and en dash, and we especially love knowing when to use each. Punctation geeks, too! If you know what an octothorp or an interrobang are, you've probably been using em dashes for a long time.
Folks who didn't know what an em dash was by name are now experiencing the Baader-Meinhof phenomenon en masse. I've literally had to disable my "--" autocorrect just to not be accused of using an LLM when writing. It's annoying.
geocar | a month ago
ziml77 | a month ago
geocar | a month ago
cheers for that never even noticed
xp84 | a month ago
chihuahua | a month ago
smetannik | a month ago
moffkalast | a month ago
>looks inside
>node modules
IshKebab | a month ago
chihuahua | a month ago
fennec-posix | a month ago
javascriptfan69 | a month ago
iberator | a month ago
lproven | a month ago