Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toward automated verification of unreviewed AI-generated code

peterlavigne.com

Post reply on HN
Print view View original

61–70 of 100 posts

Re: Toward automated verification of unreviewed AI-generated code

#61

Post by Andrei_dev »

The testing angle keeps coming up but it's sort of missing the point. I spent a few weeks poking through public repos built with AI tools — about 100 projects. 41% had secrets sitting raw in the source. Not in env files. In the code itself. Supabase service_role keys committed to GitHub, .env.example files with actual credentials, API keys hardcoded in client-side fetch calls.

No test catches any of that. Code works, tests pass, database is wide open.

It's not even a correctness problem. It's that the LLM never thought about rate limiting, CORS headers, CSRF tokens, a sane .gitignore — because nobody asked it to. Those are things devs add from muscle memory, from getting burned. The AI has no scars.

Re: Toward automated verification of unreviewed AI-generated code

#62

Post by mattdeboard »

eggbrain wrote: post #60

I find people over-rotate on whether we should be reviewing AI-produced code. "What if bad code gets into production!" some programmers gasp, as if they themselves have never pushed bad code, or had coworkers do the same. I've worked at places where I've trusted everyone on my team to the extent that most PRs got only a quick glance before getting a "LGTM". On the flipside, I've also worked on teams where every perso…

Do you not review junior developers' code? I don't understand your point

Re: Toward automated verification of unreviewed AI-generated code

#65

Post by Gigachad »

duskdozer wrote: post #20

So are we finally past the stage where people pretend they're actually reading any of the code their LLMs are dumping out?

I don't believe the junior devs on my team even run the code they are generating, let alone read it. Feeling like I'm doing 5x the work reviewing and testing that the person submitting has.

Re: Toward automated verification of unreviewed AI-generated code

#67

Post by fcatalan »

A couple weeks ago on a lark I asked Claude/Gemini/Codex to hallucinate a language they would like to program in and they always agreed on strong types, contracts, verification, proving and testing. So they ended up brainstorming a weird Forth-like with all those on top. I then kept prodding for an implementation and burned my weekly token budget until a lot of the language worked. They called it Cairn.

So now I prompted this: "can you generate a fizzbuzz implementation in Cairn that showcases as much as possible the TEST/PROVE/VERIFY characteristics of the language? "

Producing this (working) monstrosity (can't paste here, it's 200+ lines of crazy): https://gist.github.com/cairnlang/a7589de126b14e50a53b9bdc28...

Re: Toward automated verification of unreviewed AI-generated code

#68

Post by eggbrain »

mattdeboard wrote: post #62
eggbrain wrote: post #60

I find people over-rotate on whether we should be reviewing AI-produced code. "What if bad code gets into production!" some programmers gasp, as if they themselves have never pushed bad code, or had coworkers do the same. I've worked at places where I've trusted everyone on my team to the extent that most PRs got only a quick glance before getting a "LGTM". On the flipside, I've also worked on teams where every perso…

Do you not review junior developers' code? I don't understand your point

Your comment seems to imply AI is currently at a junior developer's level -- 12 months ago I would have agreed (like I mentioned in my parent comment, both near the end and about the "latter" team I was a part of), but it's gotten quite good over the past few months.

When even Linus Torvalds compliments AI code (ref: https://www.reddit.com/media?url=https%3A%2F%2Fi.redd.it%2Fa...) I think we can say he wouldn't have said that about any junior engineer.

That's not to say it won't ship bugs, but so does any engineer (junior or senior). It's up to you as to what level of tooling you surround the AI with (automated testing / linting / etc), but at the very least it doesn't also hurt to have that set up anyways (automated tests have helped prevent senior devs from shipping bad code too).

Re: Toward automated verification of unreviewed AI-generated code

#69

Post by lielcohen »

pron wrote: post #22

> The code must pass property-based tests Who writes the tests? It can be ok to trust code that passes tests if you can trust the tests. There are, however, other problems. I frequently see agents write code that's functionally correct but that they won't be able to evolve for long. That's also what happened with Anthropic's failed attempt to have agents write a C compiler (not a trivial task, but far from an excepti…

[flagged]

Re: Toward automated verification of unreviewed AI-generated code

#70

Post by flir »

jghn wrote: post #2

I do think that GenAI will lead to a rise in mutation testing, property testing, and fuzzing. But it's worth people keeping in mind that there are reasons why these aren't already ubiquitous. Among other issues, they can be computationally expensive, especially mutation testing.

Can't be more expensive than GenAI itself, can it?
Post reply on HN