Replit Blog
Wed, Mar 16, 2022Reasons Not to Join Replit
We want the people at Replit to really love working here (we do!). To help you make an informed decision about whether that would be the case for you, we challenged ourselves to come up with a list of reasons someone wouldn’t want to join our team. We hope it’ll help you learn more about the way we work together and whether that’s the way you’d be excited to work, too. 1. You don’t think the internet should be an open platform Replit’s mission is to bring the next billion software creators online. To realize that mission, we need to be a place where all kinds of people, with all kinds of backgrounds, experiences, ideologies, and values are warmly welcomed.
Wed, Mar 16, 2022Escaping Dirty Pipe (a.k.a. CVE-2022-0847), mostly unscathed
You may have heard that there was a very critical Linux kernel vulnerability making the rounds. As with all important enough vulnerabilities, this one has a catchy name: Dirty Pipe (no logo, though). This blogpost attempts to explain how that vulnerability impacted Replit. The good news is that as far as we know, there weren't any successful exploitations of it! That article linked above has the full explanation and is definitely worth the read because it narrates the journey from discovery to fix. In case you're in a hurry, the short description of that vulnerability is that it allowed any user to temporarily overwrite any file in the filesystem, without requiring any write permissions to do so. Temporarily because it didn't actually change the file, just the in-memory page cache, so if the kernel was under any sort of memory pressure, those changes would go away. There were a few more restrictions (mostly about the position, alignment, and length of the write), but other than that this allowed the attacker to make all sorts of very scary modifications to the system. Notably, the proof-of-concept code allowed any user to open a root shell by overwriting a setuid binary that had privileges to "become" root by the mere act of invoking it. The moment our "security advocate" (in reality it's just one of our platform engineers in a funny disguise until we hire a full-time security engineer) realized that this was such a serious bug, we immediately tried the proof-of-concept code. And we were delighted that it didn't work! We very recently enabled the no new privs bit that negated the effects of the setuid bit, so the user was greeted with a normal shell instead of a root shell. This meant that the scariest part of this exploit (escalation of privileges) was not possible in our system. Furthermore, the container has a very limited set of capabilities, which meant that even if the root shell would have indeed been possible, the attacker would not have been able to make most changes to the system. Hooray for defense in depth! Our initial happiness quickly dissipated, though. Even if the proof-of-concept didn't quite work all the way, it still had an effect: the files were still rewritten. So what's the worse that an attacker could do with that newly found power? Since we use Linux containers (through Docker), that means that the files in the root filesystem are shared in read-only fashion among all the containers in a system. So what if we tried to overwrite an important binary that everybody used (say, /bin/sh)? Turns out that the page cache is shared among containers too, so the modifications were visible to all repls in that one machine! This means that if a malicious user wanted, they could have been able to surreptitiously make changes to the shell, which means that they could make any modifications to any repl that happened to be running in that same machine. Exfiltration of secrets, modification of files, anything. So we needed to patch this ASAP. Fortunately the kernel already had a patch available, so all we needed to do was to make a deployment and wait a bit. We got very lucky here, because this could be a very long battle to get mitigations in place, but the disclosure of this was well-coordinated. We were very happy that this moment was mostly anti-climactic. By the way, if you tried to open any C# repl between 2022-03-09 and 2022-03-11, you might have seen a warning about a kernel bug preventing those repls from running. It turns out that it's a different, unrelated issue. Two different kernel bugs in the same week? What are the odds!? But that's a story for another day.
Wed, Mar 9, 2022Betting on CodeMirror
At Replit, our mission is to bring the next billion software creators online. In order to achieve that ambitious goal, we need to make sure that the experience of writing, running, and sharing code is as seamless as possible. At the heart of that experience is the editor itself. As a result, we dedicate a huge amount of time and energy to improving the stability, performance, and accessibility of our editor. Monaco For years, we had been relying on Monaco to power that experience. Monaco is the open source editor behind VS Code, written and maintained by Microsoft. At the time, the decision to adopt Monaco was an easy one. It was packed full of useful features that helped users navigate and write code quicker, had built in support for a large number of popular languages, and looked familiar to those coming from VS Code and other popular IDEs. These reasons, along with its growing open source community, quickly made Monaco the de-facto way to write code on the web.
Tue, Mar 8, 2022Hack Week 2022 Recap
Hey, everyone! I’m sure you all heard about the infamous, annual Replit Hack Week, but what exactly is it? Every year, we come together as a team to brainstorm, hack, and push the limits of our platform to set the tone for the year. During the first Hack Week last year, our team integrated Nix into Replit which transformed how we do infrastructure, packages, and languages. Nix also allows users to configure Replit to suit their needs. In line with our purpose for Hack Week ‘22, the theme for the year is “Community and Extensibility”.
Sun, Feb 27, 2022Kaboom Draw
Programming is hard, especially for beginners where the code <-> output feedback loop is cumbersome. People need to click run button, see output, change code, click run again see output. There are a lot of ideas that greatly improved this experience like live-reloading (a lot in the audio / visual context, and UI dev). However the most exciting idea I've seen is still the experiments done by Bret Victor, like in Learnable Programming. Seeing his experiements on combining live reload + sensible controls still takes my breath every time. You might know we're on the way of adopting Codemirror 6 to replace Monaco for a more extensible and maintainable editor (shoutout to Sergei for carrying us through this hard time!). One day I saw Faris made a css color picker codemirror 6 extension and it got me thinking, hmm CM6's extension system is really handy, what if we make some more sensible controls over all kinds of values, and make something like the Bret Victor experiments? Excited by the idea, I decided to do shove off some non-urgent tasks and do a little hack week on my own to jam out these thoughts. But first, gotta book a slot on the demo calendar: excited to excite Barron
Wed, Feb 23, 2022All New Repls are Powered By Nix
For the past year we have been working hard to integrate Nix into our platform and rebuild our existing language experiences with package from Nix. We are excited to announce that all new repls are now powered by Nix. In this post we'll talk about what this means for the future of the platform and all the work that it took to get here. With Nix you can easily create templates for languages Replit didn't support before, pull in more development tools than ever, and access any cli application in the shell without installing anything: Every new repl being powered by Nix means that we've be able to make vast improvements to our existing languages: Long awaited Node.js v16 support 100x faster Python package management
Thu, Feb 17, 2022Getting Started with Solidity on Replit
Have you ever wanted to quickly prototype an idea, reproduce a bug, or share a code demo? Maybe you just got an idea for a new smart contract that allows users to bet on soccer teams, and you want to quickly prototype this and share it with your teammates. In all of these instances, Replit is the perfect solution. Replit is a powerful online integrated developer environment (IDE) with a simple user interface that supports more than fifty programming languages. It also supports real-time collaboration, allowing for use cases like team member onboarding or hands-on learning for students. It integrates seamlessly with GitHub, allowing you to create repositories from a repl or load a repo from GitHub without any manual setup. Replit also gives you the power to share demos through a link that can be accessed by any device, anywhere in the world. In this article you’ll learn how to get started with Solidity on Replit. Solidity is a statically typed, curly-braces programming language designed for developing smart contracts that run on Ethereum. It can also be used by other blockchains for interoperability and easier migration. Getting Started with Solidity on Replit In this section, you’ll learn how to get started with Solidity on Replit and deploy your first smart contract.
Mon, Feb 14, 2022Make a Multiplayer Game with Kaboom.js and Heroic Labs
Many developers are familiar with Replit, the in-browser IDE. However, you may not know that it can be used to make full applications and games. With Kaboom, a JavaScript game-programming library that helps you quickly make fun games, and Nakama, an open source distributed server created by Heroic Labs, you can easily create a multiplayer game that runs on Replit. In this article, you’ll learn how to make a multiplayer game using Kaboom in Replit, utilizing Heroic Labs as the game server. If you want to check out the finished product or just follow along with this tutorial, you can use this REPL. What Are Multiplayer Games Multiplayer games are usually played as matches, where players join a match and compete for high scores or try to defeat each other in a battle royale with other players from all over the world. The action is happening in real time and can be played as a team or individual; Nakama can support both kinds.
Fri, Feb 11, 2022Announcing File Persistence in Hosted Apps… for Everyone!
Replit is your computer — for whatever you need to do. We announced last year that Hackers would be able to have their hosted apps be able to persist file changes since that made it possible to build a lot more apps. But we were not quite satisfied that only Hackers were going to get this new feature. Today we are announcing that we are opening this up for everyone! Why the change? Back in November, we knew that this new feature was going to have a small, but measurable, impact to our infrastructure. This meant that opening this up for everyone from the get-go was not ideal. We wanted to get this out to users as soon as possible, so we decided to be iterative. We crafted a plan to open this up for Hackers first to observe what a realistic load would look like, while pondering some potential optimizations that we could use to improve it. In addition, we added more monitoring just in case anything came up. After enabling this and blogging about it, we saw a very small difference between our predictions and reality. The plan had worked! And our hunch about something unexpected appearing was right on the money: the extra monitoring enabled us to find (and fix) an extremely low-probability bug that could only be observed when operating at Replit scale. With the new data, we could make data-driven decisions. We went through the planned optimizations and the additional load is now in a much better place, so we're comfortable opening this up for everyone.
Fri, Feb 4, 2022Making new Python repls 100x faster to start up
Python is currently the world's (and Replit's) most popular programming language. We've improved the Python experience during last year, with a Python package cache to make installs faster, and an integrated, multiplayer debugger to increase the understanding of what programs do. But there are still a few problems with Python. Packages are often very space-consuming, so they are installed into an ephemeral 2 GiB scratch disk to avoid filling up repl directories. Unfortunately this means that every time a Python repl starts, a lengthy package installation process must happen. This makes some Python repls take forever to start! Some other packages that have a large number of dependencies (like TensorFlow and Torch) were completely unusable because they don't even fit on the scratch directory. We decided to address these shortcomings and make Python a bit faster on top of that! Today, we're releasing a brand new Python template that has a lot of neat things. Newly created Python repls will now be based on nix so that additional programs and libraries can be installed, have a standard virtual environment stored inside the repl, and a brand new caching mechanism so that packages are installed even faster and they don't take up too much space. I had the wildest dream, that I was able to run the TensorFlow 2 quickstart on replit without running out of disk space or memory How does it work? We had a few goals in mind when we started designing this:
Wed, Feb 2, 2022What We Look for When We Interview
We’re on a mission to bring the next billion software creators online. In 2022, to get there, we're focusing on: Making Replit run fast on popular devices across the globe. Helping new coders build and ship for their first time. Reaching those goals requires infrastructure work and real-world experimentation, so we are growing our team!
Mon, Jan 31, 2022Understanding Repl Resource Utilization
Every computer on earth needs these three essential resources in some form: Processor Memory Storage The computers we provide for Replit users, or Repls, have access to a virtual CPU, an allocation of RAM, and a virtualized filesystem. It’s important to understand resource utilization within the context of the software that you’re writing. To this end, we have started rolling out a new component in the file tree to make this more transparent and visible to all of our users.
Fri, Jan 21, 2022Going Where the Next Billion Creators Are
Mobile is the future of computing. But building good software creation tools for mobile devices is hard. Luckily, at Replit, we like to run toward the hard things. This week, we launched a completely rearchitected mobile IDE for web. If you’ve used it before, the new version won’t look much different, but it will likely feel different. Why We Care Mobile devices are the world’s most ubiquitous computers. At Replit, we have kids coding their next big idea on their phone on the way to school, instead of scrolling through social media. We have local communities in developing countries learning & teaching code together on their phones, in order to get hired for jobs. We have colleagues coding prototypes in multiplayer and demoing their work on their phones, while they are on the go. We even noticed users sharing Replit coding tutorials on TikTok: @coding4python3 Antwoorden aan @wewillcum #replit #code #coding #coding4python3 #python ♬ origineel geluid - coding4python3
- Thu, Jan 20, 2022
Getting Started with Rust on Replit
If you’ve been debating which new programming language to learn, Rust is a strong option. According to a recent Stack Overflow developer survey, Rust is: The most loved programming language, according to almost eighty-seven percent of surveyed developers. One of the highest-paid languages, only behind Ruby, Perl, and a pack of ever-lucrative functional languages. The best way to learn Rust, of course, is to start coding. This is where Replit comes in. Replit is a collaborative in-browser integrated development environment (IDE) that supports over fifty programming languages with built-in tooling to write and organize code; manage dependencies; perform version control; and build, run, test, and visualize execution of applications. There are a few reasons to use Replit when learning Rust:
Tue, Jan 18, 2022Use Replit At Work With Teams Pro
For the past 6 months, we have been testing Teams Pro while in private beta. Today, we are excited to release it to the world. Teams Pro is Replit for work. If your company wants to have a collaborative repository for sharing and editing code, create a team now. Here's what some of our users are doing: Host slack bots, cron jobs, web scrapers, scripts, webpages, and more