Replit rebuilt its sandbox engine with microVMs

Replit used to be a great platform for sharing code in a way which made it easy for anyone to run or modify. It was great for students, and kids learning to code. But then, in 2024, they removed all social features, and reduced the maximum number of repls for free users from practically unlimited to 3. I stopped using it after this, and shortly after, they implemented a strict ratelimit for downloading your own repls. I'm now taking a look at Replit for the first time in a while, and it looks like they completely redid their interface: Their whole web IDE appears to be gone or vastly simplified, and it seems like half of of everything I click on fails with error 429, after just a tiny bit of looking around. Their old IDE that functioned as a code editor, and gave you basic tools such as a file tree viewer, is no more. Replit turned an awesome product into a glorified LLM chat which is vastly dysfunctional for any sort of hand coding.

I've been picking up bits of fractional CTO work over the last year or so and getting more involved with other founders... and I'm seeing plenty of people using it (and the other systems like it). They're just not generally people from a software engineering background, as you'd probably expect. So it's not a massive surprise that you're not crossing paths with them.

Generally it's entrepreneurial types who would have gone to an agency to get something built, or would have wanted to go to an agency but couldn't afford the costs involved. These platforms are far cheaper and quicker, and if we're really honest not necessarily worse quality than what they would have gotten from the vast majority of those agencies, especially the cheaper ones.

This is not a comment on whether this is a good thing or not, and I have all sorts of concerns, but it's undeniably something I'm seeing, and the nearshore/offshore agencies are certainly starting to feel the impact.

I did some contract work on a project that was produced with replit, extracting it to github and setting up its production and staging environments, auditing for issues, resolving some of them.

There was so much that wasn't done, it was basically an Airbnb-like service and it lacked any capacity to register users or hosts, pay for or disburse payments, create or manage listings, notifications, administration. They went from expecting to launch in a couple weeks to looking at my roadmap and quote of about 3 months more development work just for a launchable MVP, which wildly exceeded their budget or commitment to the project.

I don't know how much of this was Replit's fault but some of it certainly was, like despite being a monorepo the frontend had no connectivity with the backend, there was no barriers between user data and most endpoints were not secured, the server had zero hardening, some endpoints would take the user's id as a posted value.

I have been helping a non-profit migrate off Replit. What an awful experience using the platform has been. Their LLMs produce very bad code compared to Claude Code or Codex with the exact same prompt. Ultimately you end up having to go back and forth to get to a better solution while they nickel and dime you on tokens. It feels questionable, like it is intentional to squeeze money out of you.

Having used lovable.dev as well, I must say Lovable is a much better product.

Replit is easily one of the worst products and platforms I've use. I wouldn't even recommend it to my enemies.

I used Replit quite a lot back in the day to share code snippets with clients.

No, that's pretty overwritten. The simple story is: like most neocloud providers, they were using Docker and/or Linux containers as a workload isolation primitive, those have never been safe, and they've now worked out how to scale actual KVM isolation to their users.

A thing I wish more people would do: ask prospective cloud hosting companies "is there a mode of this offering where my workloads might share a kernel with other tenants I don't trust, as would be the case with Docker?", and if the answer to that question is ever "yes", disqualify the provider.

The general vibe I hear from security practitioners is that they (gvisor and Firecracker/Cloud-Hypervisor) are comparable. You generally do Firecracker if you can get away with it, because it's simpler and faster, but to do it well you generally need bare-metal hosts.

I think "hardware" vs. "software" is the wrong way to frame this. The big difference is between shared-kernel multitenant and guest kernels. gVisor (in some configurations) is like an 80% solution; a partially emulated guest kernel. I think the verdict is in on shared-kernel vs. not: don't share kernels between tenants.

The hardware isolation itself --- AMD-V, VT-X, &c --- has held up for almost 2 decades now. You never know, of course, but if you were going to place a bet it probably wouldn't be on hardware isolation failing before software did.

[dead]

Yeah this is the first thing I think of whenever I see the company’s name. What a pointless power trip.