Live data from Hacker News

Potential issues in curl found using AI assisted tools

mastodon.social

101–110 of 203 posts

Re: Potential issues in curl found using AI assisted tools

#101
post #32

Earlier quoted context omitted.

This is a point I see discussed surprisingly little. Given that many (most?) programmers like designing and writing code (excluding boilerplate), and not particularly enjoy reviewing code, it certainly feels backwards to make the AI write the code and relegate the programmer to reviewing it. (I know, of course, that the whole thing is being sold to stakeholders as "LoC machine goes brrrr" – code review? what's that?)

To me, it's the natural result of gaining popularity that enough people have started to use after the hype train rolled through and are now giving honest feedback. Real honest feedback can feel like a slap in the face when all you have had is overwhelming positive feedback from those aboard the hype train. The writing has been on the wall with so called hallucinations where LLMs just make stuff up that the hype was w…

I saw an article today from the BBC where travellers are using LLMs to plan their vacations and getting into trouble going places (sometimes dangerously remote ones) to visit landmarks that don't even exist:

https://www.bbc.com/travel/article/20250926-the-perils-of-le...

I'm mildly bearish on the human capacity to learn from its mistakes and have a feeling in my gut that we've taken a massive step backwards as civilization.

Re: Potential issues in curl found using AI assisted tools

#102
AI is non-deterministic as we know.

That makes its results unpredictable.

So don’t have AI create your bugs.

Instead have your AI look for problems - then have it create deterministic tools and let tools catch the issues in a repeatable, understandable, auditable way. Have it build short, easy to understand scripts you can commit to your repo, with files and line numbers and zero/nonzero exit codes.

It’s that key step of transforming AI insights into detection tools that transforms your outcomes from probabilistic to deterministic. Ask it to optimize the tools so they run in seconds. You can leave them in the codebase forever as linters, integrate them in your CI, and never have that same bug again.

Re: Potential issues in curl found using AI assisted tools

#103

Earlier quoted context omitted.

To me, it's the natural result of gaining popularity that enough people have started to use after the hype train rolled through and are now giving honest feedback. Real honest feedback can feel like a slap in the face when all you have had is overwhelming positive feedback from those aboard the hype train. The writing has been on the wall with so called hallucinations where LLMs just make stuff up that the hype was w…

I saw an article today from the BBC where travellers are using LLMs to plan their vacations and getting into trouble going places (sometimes dangerously remote ones) to visit landmarks that don't even exist: https://www.bbc.com/travel/article/20250926-the-perils-of-le... I'm mildly bearish on the human capacity to learn from its mistakes and have a feeling in my gut that we've taken a massive step backwards as civili…

I could almost understand a lawyer working late the night before a brief is due and just run out of time to review the output of the LLM. How do you not look up travel destinations before heading out? That's just something I can't wrap my head around in any way of trying to be kind and seeing the other side of something

Re: Potential issues in curl found using AI assisted tools

#104
post #87

Earlier quoted context omitted.

Is AI automating creativity away if you come up with an idea and have it actually implement it?

Yes, because ideas are not worth much if anything. If you have an idea of a book, or a painting, and have someone else implement it, you have not done creative work. Literally, you have not created the work, brought it to existence. The creator has done the creativity.

If you write a screenplay (the idea), and direct actors to act it out according to your vision (the implementation), did you _create_ the film?

I think my answer would be "Does it matter?"

If it brings joy to you or others, who cares about the semantics of creation

Re: Potential issues in curl found using AI assisted tools

#105
post #56

Earlier quoted context omitted.

I'm still faster than the cheap bots. The creative part for me includes both the implementation and the design, because the implementation also matters. The bots get in the way. Maybe I would be faster if I paid for Claude Code. It's too expensive to evaluate. If you like your expensive AI autocomplete, fine. But I have not seen any demonstrable and maintainable productivity gains from it, and I find understanding my…

> The creative part for me includes both the implementation and the design The implementations LLMs end up writing are predicable, because my design locks down what it needs to do. I basically know exactly what they'll end up doing, and how, but it types faster than I do, that's why I hand it off while I go on to think about the next design iteration. I currently send every single prompt to Claude, Codex, Qwen and Ge…

I agree, and my flow is similar

I've made great use of AI by keeping my boundaries clear and my requirements tight, and by rigorously ensuring I understand _every_ line of code I commit

I believe software development will transition to a role closer to director/reviewer/editor, where knowledge of programming paradigms are just as important as now, but also where _communication_ skills separate the good devs from the _great_ devs

The difference between a 1x dev and a 10x dev in future will be the latter knows how to clearly and concisely describe a problem or a requirement to laymen, peers, and LLMs alike. Something I've seen many devs struggle with today (myself included)

Re: Potential issues in curl found using AI assisted tools

#106

Earlier quoted context omitted.

To me, it's the natural result of gaining popularity that enough people have started to use after the hype train rolled through and are now giving honest feedback. Real honest feedback can feel like a slap in the face when all you have had is overwhelming positive feedback from those aboard the hype train. The writing has been on the wall with so called hallucinations where LLMs just make stuff up that the hype was w…

I saw an article today from the BBC where travellers are using LLMs to plan their vacations and getting into trouble going places (sometimes dangerously remote ones) to visit landmarks that don't even exist: https://www.bbc.com/travel/article/20250926-the-perils-of-le... I'm mildly bearish on the human capacity to learn from its mistakes and have a feeling in my gut that we've taken a massive step backwards as civili…

People have blindly followed GPS routes into lakes and rivers, but that should hardly be a point against GPS

With 8 billion people on the planet, you could write a "man bites dog" story about any invention popular enough

"You never read about a plane that did not crash"

Re: Potential issues in curl found using AI assisted tools

#107

This is exactly what I'd want from an 'AI coding companion'. Don't write or fix the code for me (thanks but I can manage that on my own with much less hassle), but instead tell me which places in the code look suspicious and where I need to have a closer look. When I ask Claude to find bugs in my 20kloc C library it more or less just splits the file(s) into smaller chunks and greps for specific code patterns and in t…

> When I ask Claude to find bugs in my 20kloc C library it more or less just splits the file(s) into smaller chunks and greps for specific code patterns and in the end just gives me a list of my own FIXME comments (lol), which tbh is quite underwhelming - a simple bash script could do that too. Here's a technique that often works well for me: When you get unexpectedly poor results, ask the LLM what it thinks an effec…

I have also had some success with this method

I asked ChatGPT to analyze its weaknesses and give me a pre-prompt to best help mitigate them and it gave me this: https://pastebin.com/raw/yU87FCKp

I've found it very useful to avoid sycophancy and increase skepticism / precision in the replies it gives me

Re: Potential issues in curl found using AI assisted tools

#108
post #23

Something sounds fishy in this. Has these bugs really been found by AI? (I don't think they were). If you read Corgea's (one of the products used) "whitepaper", it seems that AI is not the main show: > BLAST addresses this problem by using its AI engine to filter out irrelevant findings based on the context of the application. It seems that AI is being used to post-process the findings of traditional analyzers. It re…

Hi there, I'm Ahmad, CEO at Corgea, and the author of the white paper. We do actually use LLMs to find the vulnerabilities AND triage findings. For the majority of our scanning, we don't use traditional static analysis. At the core of our engine is the LLM reading the line of code to find CWEs in them.

Re: Potential issues in curl found using AI assisted tools

#109

Earlier quoted context omitted.

I saw an article today from the BBC where travellers are using LLMs to plan their vacations and getting into trouble going places (sometimes dangerously remote ones) to visit landmarks that don't even exist: https://www.bbc.com/travel/article/20250926-the-perils-of-le... I'm mildly bearish on the human capacity to learn from its mistakes and have a feeling in my gut that we've taken a massive step backwards as civili…

I could almost understand a lawyer working late the night before a brief is due and just run out of time to review the output of the LLM. How do you not look up travel destinations before heading out? That's just something I can't wrap my head around in any way of trying to be kind and seeing the other side of something

because people have had their entire lives to get used to the idea that computers are reliable (sans Microsoft software)

no-one wants stochastic computers

Re: Potential issues in curl found using AI assisted tools

#110
post #23

Something sounds fishy in this. Has these bugs really been found by AI? (I don't think they were). If you read Corgea's (one of the products used) "whitepaper", it seems that AI is not the main show: > BLAST addresses this problem by using its AI engine to filter out irrelevant findings based on the context of the application. It seems that AI is being used to post-process the findings of traditional analyzers. It re…

Hi, I'm Etienne, one of the cofounders @ ZeroPath.

We do not use traditional static analyzers; our engine was built from the ground up to use LLMs as a primitive. The issues ZeroPath identified in Joshua's post were indeed surfaced and triaged by AI.

If you're interested in how it works under the hood, some of the techniques are outlined here: https://zeropath.com/blog/how-zeropath-works

Post reply on HN