Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A look at Cloudflare's AI-coded OAuth library

neilmadden.blog

Post reply on HN
Print view View original

131–140 of 170 posts

Re: A look at Cloudflare's AI-coded OAuth library

#131

Post by svara »

skeeter2020 wrote: post #81
svara wrote: post #68

Earlier quoted context omitted.

I don't know, this sounds a lot like in the late 90s when we heard a lot about how anyone could put information on the internet and that you shouldn't trust what you read online. Well it turns out you can manage just fine. You shouldn't blindly trust anything. Not what you read, not what people say. Using LLMs effectively is a skill too, and that does involve deciding when and how to verify information.

>> Well it turns out you can manage just fine. You missed the full context: you would never be able to trust a bunch of amateur randos self-policing their content. Turns out it's not perfect but better than a very small set of professionals; usually there's enough expertise out there, it's just widely distributed. The challenge this time is 1. the scale, 2. the rate of growth, 3. the decline in expertise. >> Using LL…

> How do you verify when ALL the sources are share the same AI-generated root,

Why would that happen? There's demand for high quality, trustworthy information and that's not going away.

When asking an LLM coding questions, for example, you can ask for sources and it'll point you to documentation. It won't always be the correct link, but you can prod it more and usually get it, or fall back to searching the docs the old fashioned way.

Re: A look at Cloudflare's AI-coded OAuth library

#132

Post by svara »

a13n wrote: post #125
svara wrote: post #32

Earlier quoted context omitted.

LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. The maximalists and skeptics both are confusing the debate by setting up this straw man that people will be delegating to LLMs blindly. The idea that someone clueless about OAuth should develop an OAuth lib with LLM support without learning a lot about the topic is... Just wrong. Don…

If the hypothesis is that we still need knowledgeable people to run LLMs, but the way you become knowledgeable is by talking to LLMs, then I don’t think the hypothesis will be correct for long..

You inserted a hidden "only" there to make it into a logical sounding dismissive quip.

You don't get knowledge by ONLY talking to LLMs, but they're a great tool.

Re: A look at Cloudflare's AI-coded OAuth library

#134

Post by wslh »

svara wrote: post #32
donatj wrote: post #24

Earlier quoted context omitted.

My question is kind of in this brave new world, where do the domain experts come from? Whose going to know this stuff?

LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. The maximalists and skeptics both are confusing the debate by setting up this straw man that people will be delegating to LLMs blindly. The idea that someone clueless about OAuth should develop an OAuth lib with LLM support without learning a lot about the topic is... Just wrong. Don…

Another limitation of LLMs lies in their inability to stay in sync with novel topics or recently introduced methods, especially when these are not yet part of their training data or can't be inferred from existing patterns.

It's important to remember that these models depend not only on ML breakthroughs but also on the breadth and freshness of the data used to train them.

That said, the "next-door" model could very well incorporate lessons from the recent Cloudflare OAuth Library issues, thanks to the ongoing discussions and community problem-solving efforts.

Re: A look at Cloudflare's AI-coded OAuth library

#135

Post by vohk »

andersa wrote: post #75
svara wrote: post #68

Earlier quoted context omitted.

I don't know, this sounds a lot like in the late 90s when we heard a lot about how anyone could put information on the internet and that you shouldn't trust what you read online. Well it turns out you can manage just fine. You shouldn't blindly trust anything. Not what you read, not what people say. Using LLMs effectively is a skill too, and that does involve deciding when and how to verify information.

The difference is in scale. Back then, only humans were sometimes putting up false information, and other humans had a chance to correct it. Now, machines are writing infinitely more garbage than humans can ever read. Search engines like Google are already effectively unusable.

I think there will be solutions, although I don't think getting there will be pretty.

Google's case (and Meta and spam calls and others) is at least in part an incentives problem. Google hasn't been about delivering excellent search to users for a very long time. They're an ad company and their search engine is a tool to better deliver ads. Once they had an effective monopoly, they just had to stay good enough not to lose it.

I've been using Kagi for a few years now and while SEO spam and AI garbage is still an issue, it is far less of one than with Google or Bing. My conclusion is these problems are at least somewhat addressable if doing so is what gets the business paid.

But I think a real long term solution will have to involved a federated trust model. It won't be viable to index everything dumped on the web; there will need to be a component prioritizing trust in the author or publisher. If that follows the same patterns as email (ex: owned by Google and Microsoft), then we're really screwed.

Re: A look at Cloudflare's AI-coded OAuth library

#136

Post by lapcat »

kentonv wrote: post #98

Hi, I'm the author of the library. (Or at least, the author of the prompts that generated it.) > I’m also an expert in OAuth I'll admin I think Neil is significantly more of an expert than me, so I'm delighted he took a pass at reviewing the code! :) I'd like to respond to a couple of the points though. > The first thing that stuck out for me was what I like to call “YOLO CORS”, and is not that unusual to see: settin…

Does Cloudflare intend to put this library into production?

Re: A look at Cloudflare's AI-coded OAuth library

#137

Post by kentonv »

sulam wrote: post #62
elvis10ten wrote: post #55

Earlier quoted context omitted.

> LLMs make learning new material easier than ever. I use them a lot and I am learning new things at an insane pace in different domains. With learning, aren’t you exposed to the same risks? Such that if there was a typical blind spot for the LLM, it would show up in the learning assistance and in the development assistance, thus canceling out (i.e unknown unknowns)? Or am I thinking about it wrongly?

If you trust everything the LLM tells you, and you learn from code, then yes the same exact risks apply. But this is not how you use (or should use) LLMs when you’re learning a topic. Instead you should use high quality sources, then ask the LLM to summarize them for you to start with (NotebookLM does this very well for instance, but so can others). Then you ask it to build you a study plan, with quizzes and exercise…

I did actually use the LLM to write tests, and was pleased to see the results, which I thought were pretty good and thorough, though clearly the author of this blog post has a different opinion.

But TDD is not the way I think. I've never been able to work that way (LLM-assisted or otherwise). I find it very hard to write tests for software that isn't implemented yet, because I always find that a lot of the details about how it should work are discovered as part of the implementation process. This both means that any API I come up with before implementing is likely to change, and also it's not clear exactly what details need to be tested until I've fully explored how the thing works.

This is just me, other people may approach things totally differently and I can certainly understand how TDD works well for some people.

Re: A look at Cloudflare's AI-coded OAuth library

#138

Post by kentonv »

diogocp wrote: post #111
threeseed wrote: post #82

Earlier quoted context omitted.

Learning from LLMs is akin to learning from Joe Rogan. You are getting a stylised view of a topic from an entity who lacks the deep understanding needed to be able to fully distill the information. But it is enough to gain enough knowledge for you to feel confident which is still valuable but also dangerous. And I assure you that many, many people are delegating to LLMs blindly e.g. it's a huge problem in the UK lega…

> You are getting a stylised view of a topic from an entity who lacks the deep understanding Isn't this how every child learns? Unless his father happens to be king of Macedonia, of course.

I can think of books I used to learn software engineering when I was younger which, in retrospect, I realize were not very good, and taught me some practices I now disagree with. Nevertheless, the book did help me learn, and got me to a point where I could think about it myself, and eventually develop my own understanding.

Re: A look at Cloudflare's AI-coded OAuth library

#139

Post by mplanchard »

kentonv wrote: post #121
max2he wrote: post #106

Interesting to have people submit their promts to git. Do you think it'll be generally an accepted thing or was this just a showcase of how they promt?

I included the prompts because I personally found it extremely illuminating to see what the LLM was able to produce based on those prompts, and I figured other people would be interested to. Seems I was right. But to be clear, I had no idea how to write good prompts. I basically just wrote like I would write to a human. That seemed to work.

This is tangential to the discussion at hand, but a point I haven’t seen much in these conversations is the odd impedance mismatch between knowing you’re interacting with a tool but being asked to interact with it like a human.

I personally am much less patient and forgiving of tools that I use regularly than I am of my colleagues (as I would hope is true for most of us), but it would make me uncomfortable to “treat” an LLM with the same expectations of consistency and “get out of my way” as I treat vim or emacs, even though I intellectually know it is also a non-thinking machine.

I wonder about the psychological effects on myself and others long term of this kind of language-based machine interaction: will it affect our interactions with other people, or influence how we think about and what we expect from our tools?

Would be curious if your experience gives you any insight into this.

Post reply on HN