Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A look at Cloudflare's AI-coded OAuth library

neilmadden.blog

Post reply on HN
Print view View original

21–30 of 170 posts

Re: A look at Cloudflare's AI-coded OAuth library

#21

Post by yusina »

thegeomaster wrote: post #16
chrismorgan wrote: post #15

Earlier quoted context omitted.

Admittedly I have done some cryptographic string generation based on different alphabet sizes and characteristics a few years ago, which is pretty specifically relevant, and I’m competent at cryptographic and security concerns for a layman, but I certainly hope security reviewers will be more skilled at these things than me. I’m very confident I would have noticed this bias in a first pass of reviewing the code. The…

But... is it a real problem? As the author says, the entropy reduction is tiny.

It shows carelessness or incompetence or a combination thereof which extend to the entire code base.

Re: A look at Cloudflare's AI-coded OAuth library

#22

Post by marcusb »

afro88 wrote: post #18

> What this interaction shows is how much knowledge you need to bring when you interact with an LLM. The “one big flaw” Claude produced in the middle would probably not have been spotted by someone less experienced with crypto code than this engineer obviously is. And likewise, many people would probably not have questioned the weird choice to move to PBKDF2 as a response For me this is the key takeaway. You gain pro…

I’m puzzled when I hear people say ‘oh, I only use LLMs for things I don’t understand well. If I’m an expert, I’d rather do it myself.’

In addition to the ability to review output effectively, I find the more closely I’m able to describe what I want in the way another expert in that domain would, the better the LLM output. Which isn’t really that surprising for a statistical text generation engine.

Re: A look at Cloudflare's AI-coded OAuth library

#23

Post by jstummbillig »

Note that this has very little to do with AI assisted coding; the authors of the library explicitly approved/vetted the code. So this comes down to different coders having different thoughts about what constitutes good and bad code, with some flaunting of credentials to support POVs, and nothing about that is particularly new.

Re: A look at Cloudflare's AI-coded OAuth library

#24

Post by donatj »

afro88 wrote: post #18

> What this interaction shows is how much knowledge you need to bring when you interact with an LLM. The “one big flaw” Claude produced in the middle would probably not have been spotted by someone less experienced with crypto code than this engineer obviously is. And likewise, many people would probably not have questioned the weird choice to move to PBKDF2 as a response For me this is the key takeaway. You gain pro…

My question is kind of in this brave new world, where do the domain experts come from? Whose going to know this stuff?

Re: A look at Cloudflare's AI-coded OAuth library

#25

Post by maegul »

donatj wrote: post #24
afro88 wrote: post #18

> What this interaction shows is how much knowledge you need to bring when you interact with an LLM. The “one big flaw” Claude produced in the middle would probably not have been spotted by someone less experienced with crypto code than this engineer obviously is. And likewise, many people would probably not have questioned the weird choice to move to PBKDF2 as a response For me this is the key takeaway. You gain pro…

My question is kind of in this brave new world, where do the domain experts come from? Whose going to know this stuff?

This, for me, has been the question since the beginning. I’m yet to see anyone talk/think about the issue head on too. And whenever I’ve asked someone about it, they’ve not had any substantial thoughts.

Re: A look at Cloudflare's AI-coded OAuth library

#26

Post by simonw »

CuriouslyC wrote: post #2

Mostly a good writeup, but I think there's some serious shifting the goalposts of what "vibe coded" means in a disingenuous way towards the end: 'Yes, this does come across as a bit “vibe-coded”, despite what the README says, but so does a lot of code I see written by humans. LLM or not, we have to give a shit.' If what most people do is "vibe coding" in general, the current definition of vibe coding is essentially m…

How do you define vibe coding?

Re: A look at Cloudflare's AI-coded OAuth library

#27

Post by stuaxo »

djoldman wrote: post #6

> At ForgeRock, we had hundreds of security bugs in our OAuth implementation, and that was despite having 100s of thousands of automated tests run on every commit, threat modelling, top-flight SAST/DAST, and extremely careful security review by experts. Wow. Anecdotally it's my understanding that OAuth is ... tricky ... but wow. Some would say it's a dumpster fire. I've never read the spec or implemented it.

The times I've been involved with implementations it's been really horrible.

Re: A look at Cloudflare's AI-coded OAuth library

#28

Post by shswkna »

donatj wrote: post #24
afro88 wrote: post #18

> What this interaction shows is how much knowledge you need to bring when you interact with an LLM. The “one big flaw” Claude produced in the middle would probably not have been spotted by someone less experienced with crypto code than this engineer obviously is. And likewise, many people would probably not have questioned the weird choice to move to PBKDF2 as a response For me this is the key takeaway. You gain pro…

My question is kind of in this brave new world, where do the domain experts come from? Whose going to know this stuff?

Most important question on this entire topic.

Fast forward 30 years and modern civilisation is entirely dependent on our AI’s.

Will deep insight and innovation from a human perspective perhaps come to a stop?

Re: A look at Cloudflare's AI-coded OAuth library

#29

Post by ajmurmann »

afro88 wrote: post #18

> What this interaction shows is how much knowledge you need to bring when you interact with an LLM. The “one big flaw” Claude produced in the middle would probably not have been spotted by someone less experienced with crypto code than this engineer obviously is. And likewise, many people would probably not have questioned the weird choice to move to PBKDF2 as a response For me this is the key takeaway. You gain pro…

I've been using an llm to do much of a k8s deployment for me. It's quick to get something working but I've had to constantly remind it to use secrets instead of committing credentials in clear text. A dangerous way to fail. I wonder if in my case this is caused by the training data having lots of examples from online tutorials that omit security concerns to focus on the basics.

Re: A look at Cloudflare's AI-coded OAuth library

#30

Post by [deleted] »

kcatskcolbdi wrote: post #7

Really interesting breakdown. What jumped out to me wasn’t just the bugs (CORS wide open, incorrect Basic auth, weak token randomness), but how much the human devs seemed to lean on Claude’s output even when it was clearly offbase. That “implicit grant for public clients” bit is wild; it’s deprecated in OAuth 2.1, and Claude just tossed it in like it was fine, and then it stuck.

[deleted]
Post reply on HN