Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A look at Cloudflare's AI-coded OAuth library

neilmadden.blog

Post reply on HN
Print view View original

51–60 of 170 posts

Re: A look at Cloudflare's AI-coded OAuth library

#51

Post by sarchertech »

I just finished writing a Kafka consumer to migrate data with heavy AI help. This was basically best case a scenario for AI. It’s throw away greenfield code in a language I know pretty well (go) but haven’t used daily in a decade.

For complicated reasons the whole database is coming through on 1 topic, so I’m doing some fairly complicated parallelization to squeeze out enough performance.

I’d say overall the AI was close to a 2x speed up. It mostly saved me time when I forgot the go syntax for something vs looking it up.

However, there were at least 4 subtle bugs (and many more unsubtle ones) that I think anyone who wasn’t very familiar with Kafka or multithreaded programming would have pushed to prod. As it is, they took me a while to uncover.

On larger longer lived codebases, I’ve seen something closer to a 10-20% improvement.

All of this is using the latest models.

Overall this is at best the kind of productivity boost we got from moving to memory managed languages. Definitely not something that is going to replace engineers with PMs vibe coding anytime soon (based on rate of change I’ve seen over the last 3 years).

My real worry is that this is going to make mid level technical tornadoes, who in my experience are the most damaging kind of programmer, 10x as productive because they won’t know how to spot or care about stopping subtle bugs.

I don’t see how senior and staff engineers are going to be able to keep up with the inevitable flood of reviews.

I also worry about the junior to senior pipeline in a world where it’s even easier to get something up that mostly works—we already have this problem today with copy paste programmers, but we’ve just make copy paste programming even easier.

I think the market will eventually sort this all out, but I worry that it could take decades.

Re: A look at Cloudflare's AI-coded OAuth library

#52

Post by risyachka »

donatj wrote: post #24
afro88 wrote: post #18

> What this interaction shows is how much knowledge you need to bring when you interact with an LLM. The “one big flaw” Claude produced in the middle would probably not have been spotted by someone less experienced with crypto code than this engineer obviously is. And likewise, many people would probably not have questioned the weird choice to move to PBKDF2 as a response For me this is the key takeaway. You gain pro…

My question is kind of in this brave new world, where do the domain experts come from? Whose going to know this stuff?

Use it or lose it.

Experts will become those who use llm to learn and not to write code for them or solve tasks for them so they can build that skill.

Re: A look at Cloudflare's AI-coded OAuth library

#53

Post by jstummbillig »

afro88 wrote: post #18

> What this interaction shows is how much knowledge you need to bring when you interact with an LLM. The “one big flaw” Claude produced in the middle would probably not have been spotted by someone less experienced with crypto code than this engineer obviously is. And likewise, many people would probably not have questioned the weird choice to move to PBKDF2 as a response For me this is the key takeaway. You gain pro…

You will always trust domain experts at some junction; you can't build a company otherwise. The question is: Can LLMs provide that domain expertise? I would argue, yes, clearly, given the development of the past 2 years, but obviously not on a straight line.

Re: A look at Cloudflare's AI-coded OAuth library

#54

Post by blibble »

svara wrote: post #32
donatj wrote: post #24

Earlier quoted context omitted.

My question is kind of in this brave new world, where do the domain experts come from? Whose going to know this stuff?

LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. The maximalists and skeptics both are confusing the debate by setting up this straw man that people will be delegating to LLMs blindly. The idea that someone clueless about OAuth should develop an OAuth lib with LLM support without learning a lot about the topic is... Just wrong. Don…

how do you gain anything useful from a sycophantic tutor that agrees with everything you say, having being trained to behave as if the sun shines out of your rear end?

making mistakes is how we learn, and if they are never pointed out...

Re: A look at Cloudflare's AI-coded OAuth library

#55

Post by elvis10ten »

svara wrote: post #32
donatj wrote: post #24

Earlier quoted context omitted.

My question is kind of in this brave new world, where do the domain experts come from? Whose going to know this stuff?

LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. The maximalists and skeptics both are confusing the debate by setting up this straw man that people will be delegating to LLMs blindly. The idea that someone clueless about OAuth should develop an OAuth lib with LLM support without learning a lot about the topic is... Just wrong. Don…

> LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains.

With learning, aren’t you exposed to the same risks? Such that if there was a typical blind spot for the LLM, it would show up in the learning assistance and in the development assistance, thus canceling out (i.e unknown unknowns)?

Or am I thinking about it wrongly?

Re: A look at Cloudflare's AI-coded OAuth library

#56

Post by roxolotl »

junon wrote: post #42
svara wrote: post #32

Earlier quoted context omitted.

LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. The maximalists and skeptics both are confusing the debate by setting up this straw man that people will be delegating to LLMs blindly. The idea that someone clueless about OAuth should develop an OAuth lib with LLM support without learning a lot about the topic is... Just wrong. Don…

On the flip side, I wanted to see what common 8 layer PCB stackups were yesterday. ChatGPT wasn't giving me an answer that really made sense. After googling a bit, I realized almost all of the top results were AI generated, and also had very little in the way of real experience or advice. It was extremely frustrating.

This is my big fear. We’re going to end up in a world where information that isn’t common is significantly more difficult to find than it is today.

Re: A look at Cloudflare's AI-coded OAuth library

#57

Post by jofzar »

djoldman wrote: post #6

> At ForgeRock, we had hundreds of security bugs in our OAuth implementation, and that was despite having 100s of thousands of automated tests run on every commit, threat modelling, top-flight SAST/DAST, and extremely careful security review by experts. Wow. Anecdotally it's my understanding that OAuth is ... tricky ... but wow. Some would say it's a dumpster fire. I've never read the spec or implemented it.

Oauth is so annoying, there is so much niche to it.

Re: A look at Cloudflare's AI-coded OAuth library

#58

Post by belter »

svara wrote: post #32
donatj wrote: post #24

Earlier quoted context omitted.

My question is kind of in this brave new world, where do the domain experts come from? Whose going to know this stuff?

LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. The maximalists and skeptics both are confusing the debate by setting up this straw man that people will be delegating to LLMs blindly. The idea that someone clueless about OAuth should develop an OAuth lib with LLM support without learning a lot about the topic is... Just wrong. Don…

> But if you're willing to learn, this is rocket fuel.

LLMs will tell you 1 or 2 lies for each 20 facts. Its a hard way to learn. They cant even get their urls right...

Re: A look at Cloudflare's AI-coded OAuth library

#59

Post by diggan »

belter wrote: post #58
svara wrote: post #32

Earlier quoted context omitted.

LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. The maximalists and skeptics both are confusing the debate by setting up this straw man that people will be delegating to LLMs blindly. The idea that someone clueless about OAuth should develop an OAuth lib with LLM support without learning a lot about the topic is... Just wrong. Don…

> But if you're willing to learn, this is rocket fuel. LLMs will tell you 1 or 2 lies for each 20 facts. Its a hard way to learn. They cant even get their urls right...

> LLMs will tell you 1 or 2 lies for each 20 facts. Its a hard way to learn.

That was my experience when growing up with school also, except you got punished one way or another for speaking up/trying to correct the teacher. If I speak up with the LLM they either explain why what they said is true, or corrects themselves, 0 emotions involved.

> They cant even get their urls right...

Famously never happens with humans.

Re: A look at Cloudflare's AI-coded OAuth library

#60

Post by roxolotl »

> Many of these same mistakes can be found in popular Stack Overflow answers, which is probably where Claude learnt them from too.

This is what keeps me up at night. Not that security holes will inevitably be introduced, or that the models will make mistakes, but that the knowledge and information we have as a society is basically going to get frozen in time to what was popular on the internet before LLMs.

Post reply on HN