May 25, 2026

VMs: now hiding in your toaster

Bytecode VMs in surprising places (2024)

Your computer is hiding tiny secret engines everywhere, and commenters are losing it

TLDR: The article reveals that tiny code-running engines show up in unexpected software, from Linux internals to debugging tools. Commenters stole the spotlight by arguing the list missed even wilder examples like TikTok, Java Card, Go regex, Quake, and old RAR files — turning it into a geeky game of one-upmanship.

A seemingly nerdy post about tiny built-in code runners hiding inside everyday software turned into a full-on comment-section treasure hunt. The original article pointed out that these little engines don’t just live in programming languages like JavaScript or Python — they also show up in surprising places like Linux’s networking tools and even debugging info used by developers to inspect programs. In plain English: there are lots of places where software quietly carries around its own mini language and a tiny machine to run it.

But the real show was the crowd yelling, “That list is way too short!” One commenter immediately tossed in TikTok’s scrambled bytecode setup, which added a whiff of mystery and conspiracy flavor. Another came in hot with “entirely incomplete”, insisting you can’t have this conversation without Java Card — tiny Java software living on smart cards and other unexpected gadgets. Then came the nerd-flex pile-on: Go’s regular expressions have one, Quake had one, and yes, even old RAR archives once packed their own little virtual machine before dropping it later.

The funniest bit? A dry joke about Go’s re.Compile suddenly sounding less like a boring function name and more like a confession: of course it “compiles” — there’s a whole mini machine in there. The mood was part amazement, part one-upmanship, and part chaotic trivia contest, with everyone racing to out-weird each other’s example.

Key Points

  • The article was prompted by Richard Hipp’s explanation of why SQLite uses a bytecode VM for executing SQL statements.
  • It argues that bytecode virtual machines appear in systems beyond general-purpose language runtimes, and highlights eBPF and DWARF expressions as examples.
  • eBPF in the Linux kernel is described as a register-based VM with a bytecode interpreter, JIT compiler, ten general-purpose registers, and more than 100 opcodes.
  • The article traces BPF from its 1993 packet-filtering origins through later Linux milestones, including a 2011 x86-64 JIT, a 2012 non-networking use case, and broader 2014 expansion.
  • DWARF expressions are presented as a stack-based opcode stream used by debuggers to compute variable values or locations from compiler-generated debug information.

Hottest takes

"This list is entirely incomplete without mentioning Java Card" — omeid2
"TikTok shipping XOR cipher’d bytecode & interp is right up there" — ignoramous
"I guess that is why you say re.Compile" — pratikdeoghare
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.