Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A look at Cloudflare's AI-coded OAuth library

neilmadden.blog

Post reply on HN
Print view View original

61–70 of 170 posts

Re: A look at Cloudflare's AI-coded OAuth library

#61

Post by sarchertech »

kypro wrote: post #49
donatj wrote: post #24

Earlier quoted context omitted.

My question is kind of in this brave new world, where do the domain experts come from? Whose going to know this stuff?

In a few years hopefully the AI reviewers will be far more reliable than even the best human experts. This is generally how competency progresses in AI... For example, at one point a human + computer would have been the strongest combo in chess, now you'd be insane to allow a human to critic a chess bot because they're so unlikely to add value, and statistically a human in the loop would be far more likely to introdu…

My prediction is that for that to happen we’ll need to figure out a way to measure software quality in the way we can measure a chess game, so that we can use synthetic data to continue improving the models.

I don’t think we are anywhere close to doing that.

Re: A look at Cloudflare's AI-coded OAuth library

#62

Post by sulam »

elvis10ten wrote: post #55
svara wrote: post #32

Earlier quoted context omitted.

LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. The maximalists and skeptics both are confusing the debate by setting up this straw man that people will be delegating to LLMs blindly. The idea that someone clueless about OAuth should develop an OAuth lib with LLM support without learning a lot about the topic is... Just wrong. Don…

> LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. With learning, aren’t you exposed to the same risks? Such that if there was a typical blind spot for the LLM, it would show up in the learning assistance and in the development assistance, thus canceling out (i.e unknown unknowns)? Or am I thinking about it wrongly?

If you trust everything the LLM tells you, and you learn from code, then yes the same exact risks apply. But this is not how you use (or should use) LLMs when you’re learning a topic. Instead you should use high quality sources, then ask the LLM to summarize them for you to start with (NotebookLM does this very well for instance, but so can others). Then you ask it to build you a study plan, with quizzes and exercises covering what you’ve learnt. Then you ask it to setup a spaced repetition worksheet that covers the topic thoroughly. At the end of this you will know the topic as well as if you’d taken a semester-long course.

One big technique it sounds like the authors of the OAuth library missed is that LLMs are very good at generating tests. A good development process for today’s coding agents is to 1) prompt with or create a PRD, 2) break this down into relatively simple tasks, 3) build a plan for how to tackle each task, with listed out conditions that should be tested, 3) write the tests, so that things are broken, TDD style and finally 4) write the implementation. The LLM can do all of this, but you can’t one-shot it these days, you have to be a human in the loop at every step, correcting when things go off track. It’s faster, but it’s not a 10x speed up like you might imagine if you think the LLM is just asynchronously taking a PRD some PM wrote and building it all. We still have jobs for a reason.

Re: A look at Cloudflare's AI-coded OAuth library

#63

Post by tuxone »

roxolotl wrote: post #60

> Many of these same mistakes can be found in popular Stack Overflow answers, which is probably where Claude learnt them from too. This is what keeps me up at night. Not that security holes will inevitably be introduced, or that the models will make mistakes, but that the knowledge and information we have as a society is basically going to get frozen in time to what was popular on the internet before LLMs.

> This is what keeps me up at night.

Same here. For some of the services I pay, say the e-mail provider, the fact that they openly deny using LLMs for coding would be a plus for me.

Re: A look at Cloudflare's AI-coded OAuth library

#64

Post by perching_aix »

elvis10ten wrote: post #55
svara wrote: post #32

Earlier quoted context omitted.

LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. The maximalists and skeptics both are confusing the debate by setting up this straw man that people will be delegating to LLMs blindly. The idea that someone clueless about OAuth should develop an OAuth lib with LLM support without learning a lot about the topic is... Just wrong. Don…

> LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. With learning, aren’t you exposed to the same risks? Such that if there was a typical blind spot for the LLM, it would show up in the learning assistance and in the development assistance, thus canceling out (i.e unknown unknowns)? Or am I thinking about it wrongly?

When I'm exploring a topic, I make sure to ask for links to references, and will do a quick keyword search in there or ask for an excerpt to confirm key facts.

This does mean that there's a reliance on me being able to determine what are key facts and when I should be asking for a source though. I have not experienced any significant drawbacks when compared to a classic research workflow though, so in my view it's a net speed boost.

However, this does mean that a huge variety of things remain out of reach for me to accomplish, even with LLM "assistance". So there's a decent chance even the speed boost is only perceptual. If nothing else, it does take a significant amount of drudgery out of it all though.

Re: A look at Cloudflare's AI-coded OAuth library

#65

Post by add-sub-mul-div »

jstummbillig wrote: post #23

Note that this has very little to do with AI assisted coding; the authors of the library explicitly approved/vetted the code. So this comes down to different coders having different thoughts about what constitutes good and bad code, with some flaunting of credentials to support POVs, and nothing about that is particularly new.

The whole point of this is that people will generally put the least effort into work as they think they can get away with, and LLMs will accelerate that force. This is the future of how code will be "vetted".

It's not important whose responsbility led to mistakes, it's important to understand we're creating a responsbility gap.

Re: A look at Cloudflare's AI-coded OAuth library

#66

Post by andersa »

roxolotl wrote: post #56
junon wrote: post #42

Earlier quoted context omitted.

On the flip side, I wanted to see what common 8 layer PCB stackups were yesterday. ChatGPT wasn't giving me an answer that really made sense. After googling a bit, I realized almost all of the top results were AI generated, and also had very little in the way of real experience or advice. It was extremely frustrating.

This is my big fear. We’re going to end up in a world where information that isn’t common is significantly more difficult to find than it is today.

It's going to be like the pre-internet dark ages, but worse. Back then you only didn't find the information. Now, you find unlimited information, but it is all wrong.

Re: A look at Cloudflare's AI-coded OAuth library

#67

Post by motorest »

elvis10ten wrote: post #55
svara wrote: post #32

Earlier quoted context omitted.

LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. The maximalists and skeptics both are confusing the debate by setting up this straw man that people will be delegating to LLMs blindly. The idea that someone clueless about OAuth should develop an OAuth lib with LLM support without learning a lot about the topic is... Just wrong. Don…

> LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. With learning, aren’t you exposed to the same risks? Such that if there was a typical blind spot for the LLM, it would show up in the learning assistance and in the development assistance, thus canceling out (i.e unknown unknowns)? Or am I thinking about it wrongly?

> With learning, aren’t you exposed to the same risks? Such that if there was a typical blind spot for the LLM, it would show up in the learning assistance and in the development assistance, thus canceling out (i.e unknown unknowns)?

I don't think that's how things work. In learning tasks, LLMs are sparring partners. You present them with scenarios, and they output a response. Sometimes they hallucinate completely, but they can also update their context to reflect new information. Their output matches what you input.

Re: A look at Cloudflare's AI-coded OAuth library

#68

Post by svara »

andersa wrote: post #66
roxolotl wrote: post #56

Earlier quoted context omitted.

This is my big fear. We’re going to end up in a world where information that isn’t common is significantly more difficult to find than it is today.

It's going to be like the pre-internet dark ages, but worse. Back then you only didn't find the information. Now, you find unlimited information, but it is all wrong.

I don't know, this sounds a lot like in the late 90s when we heard a lot about how anyone could put information on the internet and that you shouldn't trust what you read online.

Well it turns out you can manage just fine.

You shouldn't blindly trust anything. Not what you read, not what people say.

Using LLMs effectively is a skill too, and that does involve deciding when and how to verify information.

Re: A look at Cloudflare's AI-coded OAuth library

#69

Post by evnu »

sulam wrote: post #62
elvis10ten wrote: post #55

Earlier quoted context omitted.

> LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. With learning, aren’t you exposed to the same risks? Such that if there was a typical blind spot for the LLM, it would show up in the learning assistance and in the development assistance, thus canceling out (i.e unknown unknowns)? Or am I thinking about it wrongly?

If you trust everything the LLM tells you, and you learn from code, then yes the same exact risks apply. But this is not how you use (or should use) LLMs when you’re learning a topic. Instead you should use high quality sources, then ask the LLM to summarize them for you to start with (NotebookLM does this very well for instance, but so can others). Then you ask it to build you a study plan, with quizzes and exercise…

> Instead you should use high quality sources, then ask the LLM to summarize them for you to start with (NotebookLM does this very well for instance, but so can others).

How do you determine if the LLM accurately reflects what the high-quality source contains, if you haven't read the source? When learning from humans, we put trust on them to teach us based on a web-of-trust. How do you determine the level of trust with an LLM?

Re: A look at Cloudflare's AI-coded OAuth library

#70

Post by svara »

blibble wrote: post #54
svara wrote: post #32

Earlier quoted context omitted.

LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. The maximalists and skeptics both are confusing the debate by setting up this straw man that people will be delegating to LLMs blindly. The idea that someone clueless about OAuth should develop an OAuth lib with LLM support without learning a lot about the topic is... Just wrong. Don…

how do you gain anything useful from a sycophantic tutor that agrees with everything you say, having being trained to behave as if the sun shines out of your rear end? making mistakes is how we learn, and if they are never pointed out...

It's a bit of a skill. Gaining an incorrect understanding of some topic is a risk anyway you learn, and I don't feel it's greater with LLMs than many of the alternatives.

Sure, having access to legit experts who can tutor you privately on a range of topics would be better, but that's not realistic.

What I find is that if I need to explore some new domain within a field I'm broadly familiar with, just thinking through what the LLM is saying is sufficient for verification, since I can look for internal consistency and check against things I know already.

When exploring a new topic, often times my questions are superficial enough for me to be confident that the answers are very common in the training data.

When exploring a new topic that's also somewhat niche or goes into a lot of detail, I use the LLM first to get a broad overview and then drill down by asking for specific sources and using the LLM as an assistant to consume authoritative material.

Post reply on HN