frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Show HN: Xmloxide – an agent made rust replacement for libxml2

https://github.com/jonwiggins/xmloxide
24•jawiggins•2h ago
Recently several AI labs have published experiments where they tried to get AI coding agents to complete large software projects.

- Cursor attempted to make a browser from scratch: https://cursor.com/blog/scaling-agents

- Anthropic attempted to make a C Compiler: https://www.anthropic.com/engineering/building-c-compiler

I have been wondering if there are software packages that can be easily reproduced by taking the available test suites and tasking agents to work on projects until the existing test suites pass.

After playing with this concept by having Claude Code reproduce redis and sqlite, I began looking for software packages where an agent-made reproduction might actually be useful.

I found libxml2, a widely used, open-source C language library designed for parsing, creating, and manipulating XML and HTML documents. Three months ago it became unmaintained with the update, "This project is unmaintained and has [known security issues](https://gitlab.gnome.org/GNOME/libxml2/-/issues/346). It is foolish to use this software to process untrusted data.".

With a few days of work, I was able to create xmloxide, a memory safe rust replacement for libxml2 which passes the compatibility suite as well as the W3C XML Conformance Test Suite. Performance is similar on most parsing operations and better on serialization. It comes with a C API so that it can be a replacement for existing uses of libxml2.

- crates.io: https://crates.io/crates/xmloxide

- GitHub release: https://github.com/jonwiggins/xmloxide/releases/tag/v0.1.0

While I don't expect people to cut over to this new and unproven package, I do think there is something interesting to think about here in how coding agents like Claude Code can quickly iterate given a test suite. It's possible the legacy code problem that COBOL and other systems present will go away as rewrites become easier. The problem of ongoing maintenance to fix CVEs and update to later package versions becomes a larger percentage of software package management work.

Comments

blegge•1h ago
> arena-based tree with zero unsafe in the public API

Why "in the public API"? Does this imply it's using unsafe behind the hood? If so, what for?

DetroitThrow•36m ago
Yeah I'm a bit confused because you can have an entirely unsafe code base with just the public interface marked as safe. No unsafe in the interface isn't a measure of safety at all.
mirashii•25m ago
It is a measure of the intended level of care that the users of your interface have to take. If there's no unsafe in the interface, then that implies that the library has only provided safe interfaces, even if it uses unsafe internally, and that the interface exposed enforces all necessary invariants.

It is absolutely a useful distinction on whether your users need to deal with unsafe themselves or not.

fourthark•1h ago
Does it fix the security flaws that caused the original project to be shut down?
blegge•1h ago
https://gitlab.gnome.org/GNOME/libxml2/-/commit/0704f52ea4cd...

Doesn't seem to have shut down or even be unmaintained. Perhaps it was briefly, and has now been resurrected?

notpushkin•48m ago
If by flaws you mean the security researchers spamming libxml2 with low effort stuff demanding a CVE for each one so they can brag about it – no, I don’t think anybody can fix that.
bawolff•10m ago
Based on context, i kind of imagine they are more thinking of the issues surounding libxslt.
jawiggins•2m ago
Because it was written in C, libxml2's CVE history has been dominated by use-after-free, buffer overflows, double frees, and type confusion. xmloxide is written in pure Rust, so these entire vulnerability classes are eliminated at compile time.
nicoburns•1h ago
How does it compare to the original in terms of source code size (number of lines of code?)
jawiggins•11m ago
It's significantly smaller. Because Rust doesn't require header files or memory management, xmloxide is ~40k lines while libxml2 is ~150k lines.
kburman•1h ago
Amazing work! I'd love to hear more details about your workflow with Claude Code.

As a side note and this isn't a knock on your project specifically. I think the community needs to normalize disclaimers for "vibe-coded" packages. Consumers really need to understand the potential risks of relying on agent-generated code upfront.

jawiggins•18m ago
Yeah its a fair point. I wondered if it might be irresponsible to publish the package because it was made this way, but I suspect I'm not the first person to try and develop a package with Claude Code, so I think the best I can do is be honest about it.

As for the workflow, I think the best advice I can give is to setup as many guardrails and tools as possible, so Claude and do as many iterations before needing any intervention. So in this case I setup pre-commit hooks for linting and formatting, gave it access to the full testing suite, and let it rip. The majority of the work was done in a single thinking loop that lasted ~3 hours where Claude was able to run the tests, see what failed, and iterate until they all passed. From there, there was still lots of iterations to add features, clean up, test, and improve performance - but allowing Claude to iterate quickly on it's own without my involvement was crucial.

wooptoo•42m ago
A comment on libxml, not on your work: Funny how so many companies use this library in production and not one steps in to maintain this project and patch the issues. What a sad state of affairs we are in.
jawiggins•22m ago
Yeah I agree, maintaining OS projects has been a weird thing for a long time.

I know a few companies have programs where engineers can designate specific projects as important and give them funds. But it doesn't happen enough to support all the projects that currently need work, maybe AI coding tools will lower the cost of maintenance enough to improve this.

I do think there are two possible approaches that policy makers could consider.

1) There could probably be tax credits or deductions for SWEs who 'volunteer' their time to work on these projects.

2) Many governments have tried to create cyber reserve corps, I bet they could designate people as maintainers of key projects that they rely on to maintain both the projects as well as people skilled with the tools that they deem important.

alexhans•20m ago
> I do think there is something interesting to think about here in how coding agents like Claude Code can quickly iterate given a test suite.

This is a point I've tried to advocate for a while. Specially to empower non coders and make them see that we CAN approach automation with control.

Some aspects will be the classic unit or integration tests for validation. Others, will be AI Evals [1] which to me could be the common language for product design for different families/disciplines who don't quite understand how to collaborate with each other.

The amount of progress in a short time is amazing to see.

- [1] https://ai-evals.io/

We do not think Anthropic should be designated as a supply chain risk

https://twitter.com/OpenAI/status/2027846016423321831
261•golfer•4h ago•107 comments

The Windows 95 user interface: A case study in usability engineering (1996)

https://dl.acm.org/doi/fullHtml/10.1145/238386.238611
139•ksec•4h ago•78 comments

Microgpt

http://karpathy.github.io/2026/02/12/microgpt/
18•tambourine_man•44m ago•3 comments

Obsidian Sync now has a headless client

https://help.obsidian.md/sync/headless
392•adilmoujahid•9h ago•141 comments

The happiest I've ever been

https://ben-mini.com/2026/the-happiest-ive-ever-been
330•bewal416•2d ago•151 comments

Show HN: Xmloxide – an agent made rust replacement for libxml2

https://github.com/jonwiggins/xmloxide
25•jawiggins•2h ago•15 comments

Block the “Upgrade to Tahoe” Alerts

https://robservatory.com/block-the-upgrade-to-tahoe-alerts-and-system-settings-indicator/
139•todsacerdoti•7h ago•61 comments

Addressing Antigravity Bans and Reinstating Access

https://github.com/google-gemini/gemini-cli/discussions/20632
201•RyanShook•12h ago•171 comments

Woxi: Wolfram Mathematica Reimplementation in Rust

https://github.com/ad-si/Woxi
249•adamnemecek•3d ago•104 comments

H-Bomb: A Frank Lloyd Wright Typographic Mystery

https://www.inconspicuous.info/p/h-bomb-a-frank-lloyd-wright-typographic
8•mrngm•2d ago•3 comments

Building a Minimal Transformer for 10-digit Addition

https://alexlitzenberger.com/blog/post.html?post=/building_a_minimal_transformer_for_10_digit_add...
36•kelseyfrog•4h ago•6 comments

Verified Spec-Driven Development (VSDD)

https://gist.github.com/dollspace-gay/d8d3bc3ecf4188df049d7a4726bb2a00
147•todsacerdoti•9h ago•70 comments

Qwen3.5 122B and 35B models offer Sonnet 4.5 performance on local computers

https://venturebeat.com/technology/alibabas-new-open-source-qwen3-5-medium-models-offer-sonnet-4-...
224•lostmsu•6h ago•144 comments

Deterministic Programming with LLMs

https://www.mcherm.com/deterministic-programming-with-llms.html
18•todsacerdoti•3d ago•8 comments

Werner Herzog Between Fact and Fiction

https://www.thenation.com/article/culture/werner-herzog-future-truth/
65•Hooke•1d ago•14 comments

Show HN: Now I Get It – Translate scientific papers into interactive webpages

https://nowigetit.us
186•jbdamask•12h ago•99 comments

New evidence that Cantor plagiarized Dedekind?

https://www.quantamagazine.org/the-man-who-stole-infinity-20260225/
110•rbanffy•3d ago•69 comments

The whole thing was a scam

https://garymarcus.substack.com/p/the-whole-thing-was-scam
619•guilamu•9h ago•169 comments

MCP server that reduces Claude Code context consumption by 98%

https://mksg.lu/blog/context-mode
236•mksglu•16h ago•56 comments

747s and Coding Agents

https://carlkolon.com/2026/02/27/engineering-747-coding-agents/
128•cckolon•1d ago•58 comments

The archivist preserving decaying floppy disks

https://www.popsci.com/technology/floppy-disk-archivist-project/
46•Brajeshwar•3d ago•4 comments

Just two days of oatmeal cut bad cholesterol by 10%

https://www.sciencedaily.com/releases/2026/02/260225081217.htm
12•gradus_ad•39m ago•4 comments

Our Agreement with the Department of War

https://openai.com/index/our-agreement-with-the-department-of-war
219•surprisetalk•5h ago•194 comments

Ghosts'n Goblins – “Worse danger is ahead”

https://superchartisland.com/ghostsn-goblins/
64•elvis70•3d ago•24 comments

Running a One Trillion-Parameter LLM Locally on AMD Ryzen AI Max+ Cluster

https://www.amd.com/en/developer/resources/technical-articles/2026/how-to-run-a-one-trillion-para...
10•mindcrime•58m ago•2 comments

The Eternal Promise: A History of Attempts to Eliminate Programmers

https://www.ivanturkovic.com/2026/01/22/history-software-simplification-cobol-ai-hype/
234•dinvlad•3d ago•165 comments

Unsloth Dynamic 2.0 GGUFs

https://unsloth.ai/docs/basics/unsloth-dynamic-2.0-ggufs
198•tosh•17h ago•53 comments

From Noise to Image – interactive guide to diffusion

https://lighthousesoftware.co.uk/projects/from-noise-to-image/
107•simedw•2d ago•15 comments

Samsung Galaxy update removes Android recovery menu tools, including sideloading

https://9to5google.com/2026/02/27/samsung-galaxy-update-android-recovery-menu-removed/
6•pabs3•24m ago•0 comments

The United States and Israel have launched a major attack on Iran

https://www.cnn.com/2026/02/28/middleeast/israel-attack-iran-intl-hnk
1054•lavp•19h ago•2290 comments