Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A look at Cloudflare's AI-coded OAuth library

neilmadden.blog

Post reply on HN
Print view View original

141–150 of 170 posts

Re: A look at Cloudflare's AI-coded OAuth library

#141

Post by sarchertech »

kypro wrote: post #78
sarchertech wrote: post #61

Earlier quoted context omitted.

My prediction is that for that to happen we’ll need to figure out a way to measure software quality in the way we can measure a chess game, so that we can use synthetic data to continue improving the models. I don’t think we are anywhere close to doing that.

Not really... If you're an average company you're not concerned about producing perfect software, but optimising for some balance between cost and quality. At some point companies via capitalist forces will naturally realise that it's more productive to not have humans in the loop. A good analogy might be how machines gradually replaced textile workers in the 19th century. Were the machines better? Or was there a was…

Almost none of what you said about the past is true. Automated looms, and all of the other automated machinery that replaced artisans over the course of the industrial revolution produced items of much better quality than what human craftsman could produce by the time it started to be used commercially because of precision and repeatability. They did have quantitative measurements of quality for textiles and other goods and the automated processes exceeded human craftsman at those metrics.

Software is also not remotely similar to textiles. A subtle bug in the textile output itself won’t cause potentially millions of dollars in damages, they way a bug in an automated loom itself or software can.

No current technology is anywhere close to being able to automate 50% of PRs on any non trivial application (that’s not close to the same as saying that 50% of PRs merged at your startup happens to have an agent as author). To assume that current models will be able to get near 100% without massive model improvements is just that—an assumption.

My point about synthetic data is that we need orders of magnitude more data with current technology and the only way we will get there is with synthetic data. Which is much much harder to do with software applications than with chess games.

The point isn’t that we need a quantitative measure of software in order for AI to be useful, but that we need a quantitative measure in order for synthetic data to be useful to give us our orders of magnitude more training data.

Re: A look at Cloudflare's AI-coded OAuth library

#142

Post by kentonv »

lapcat wrote: post #136
kentonv wrote: post #98

Hi, I'm the author of the library. (Or at least, the author of the prompts that generated it.) > I’m also an expert in OAuth I'll admin I think Neil is significantly more of an expert than me, so I'm delighted he took a pass at reviewing the code! :) I'd like to respond to a couple of the points though. > The first thing that stuck out for me was what I like to call “YOLO CORS”, and is not that unusual to see: settin…

Does Cloudflare intend to put this library into production?

Yes, it's part of our MCP framework:

https://blog.cloudflare.com/remote-model-context-protocol-se...

Re: A look at Cloudflare's AI-coded OAuth library

#143

Post by sarchertech »

LgWoodenBadger wrote: post #87
sarchertech wrote: post #51

I just finished writing a Kafka consumer to migrate data with heavy AI help. This was basically best case a scenario for AI. It’s throw away greenfield code in a language I know pretty well (go) but haven’t used daily in a decade. For complicated reasons the whole database is coming through on 1 topic, so I’m doing some fairly complicated parallelization to squeeze out enough performance. I’d say overall the AI was c…

Complicated parallelization? That’s what partitions and consumers/consumer-groups are for!

Of course they are, but I’m not controlling the producer.

Re: A look at Cloudflare's AI-coded OAuth library

#144

Post by sarchertech »

murukesh_s wrote: post #93
sarchertech wrote: post #51

I just finished writing a Kafka consumer to migrate data with heavy AI help. This was basically best case a scenario for AI. It’s throw away greenfield code in a language I know pretty well (go) but haven’t used daily in a decade. For complicated reasons the whole database is coming through on 1 topic, so I’m doing some fairly complicated parallelization to squeeze out enough performance. I’d say overall the AI was c…

What about generating testable code? I mean you mentioned detecting subtle bugs in generated code - I too have seen similar - but what if that was found via generated test cases than found by a human reviewers? Of course the test code could have bugs, but I can see a scenario in the future where all we do is review the tests output instead of scrutinising the generated code...

And the AI is trained to write plausible output and pass test cases.

Have you ever tried to generate test cases that were immune to a malicious actor trying to pass your test cases? For example if you are trying to automate homework grading?

The AI writing tests needs to understand the likely problem well enough to know to write a test case for it, but there are an infinite amount of subtle bugs for an AI writing code to choose from.

Re: A look at Cloudflare's AI-coded OAuth library

#145

Post by SparkyMcUnicorn »

wslh wrote: post #119
loandbehold wrote: post #109

Earlier quoted context omitted.

Over time AI coding tools will be able to research domain knowledge. Current "AI Research" tools are already very good at it but they are not integrated with coding tools yet. The research could look at both public Internet as well as company documents that contain internal domain knowledge. Some of the domain knowledge is only in people's heads. That would need to be provided by the user.

I'd like to add a practical observation, even assuming much more capable AI in the future: not all failures are due to model limitations, sometimes it's about external [world] changes. For instance, I used Next.js to build a simple login page with Google auth. It worked great, even though I only had basic knowledge of Node.js and a bit of React. Then I tried adding a database layer using Prisma to persist users. That…

Just close the loop and give it direct access to your console logs in chrome and node, then it can do the "full manual debugging" on its own.

It's not perfect, and it's not exactly cheap, but it works.

Re: A look at Cloudflare's AI-coded OAuth library

#146

Post by eastdakota »

kentonv wrote: post #116
aiono wrote: post #20

I agree with the last paragraph about doing this yourself. Humans have tendency to take shortcuts while thinking. If you see something resembling what you expect for the end product you will be much less critical of it. The looks/aesthetics matter a lot on finding problems with in a piece of code you are reading. You can verify this by injecting bugs in your code changes and see if reviewers can find them. On the oth…

I agree that most code reviewers are pretty bad at spotting subtle bugs in code that looks good superficially. I have a lot of experience reviewing code -- more than I ever really wanted. It has... turned me cynical and bitter, to the point that I never believe anything is right, no matter who wrote it or how nice it looks, because I've seen so many ways things can go wrong. So I tend to review every line, simulate i…

I agree with Kenton’s aside.

Re: A look at Cloudflare's AI-coded OAuth library

#147

Post by _heimdall »

marcusb wrote: post #124
_heimdall wrote: post #37

Earlier quoted context omitted.

That's why outsource most other things in our life though, why would it be different with LLMs? People don't learn how a car works before buying one, they just take it to a mechanic when it breaks. Most people don't know how to build a house, they have someone else build it and assume it was done well. I fully expect people to similarly have LLMs do what the person doesn't know how and assume the machine knew what to…

> why would it be different with LLMs? Because LLMs are not competent professionals to whom you might outsource tasks in your life. LLMs are statistical engines that make up answers all the time, even when the LLM “knows” the correct answer (i.e., has the correct answer hidden away in its weights.) I don’t know about you, but I’m able to validate something is true much more quickly and efficiently if it is a subject…

> competent professionals

That requires a lot of clarity and definition if you want to claim that LLMs aren't competent professionals. I assume we'd ultimately agree that LLMs aren't, but I'd add that many humans paid for a task aren't competent professionals either and, more importantly, that I can't distinguish the competent professionals from others without myself being competent enough in the topic.

My point was that people have a long history of outsourcing to someone else, often to someone they have never met and never will. We do it for things that we have no real idea about and trust that the person doing it must have known what they were doing. I fully expect people to end up taking the same view of LLMs.

Re: A look at Cloudflare's AI-coded OAuth library

#148

Post by kentonv »

kentonv wrote: post #98

Hi, I'm the author of the library. (Or at least, the author of the prompts that generated it.) > I’m also an expert in OAuth I'll admin I think Neil is significantly more of an expert than me, so I'm delighted he took a pass at reviewing the code! :) I'd like to respond to a couple of the points though. > The first thing that stuck out for me was what I like to call “YOLO CORS”, and is not that unusual to see: settin…

> We disable the CORS headers specifically for the OAuth API

Oops, I meant we set the CORS headers, to disable CORS rules. (Probably obvious in context but...)

Re: A look at Cloudflare's AI-coded OAuth library

#149

Post by kentonv »

mplanchard wrote: post #139
kentonv wrote: post #121

Earlier quoted context omitted.

I included the prompts because I personally found it extremely illuminating to see what the LLM was able to produce based on those prompts, and I figured other people would be interested to. Seems I was right. But to be clear, I had no idea how to write good prompts. I basically just wrote like I would write to a human. That seemed to work.

This is tangential to the discussion at hand, but a point I haven’t seen much in these conversations is the odd impedance mismatch between knowing you’re interacting with a tool but being asked to interact with it like a human. I personally am much less patient and forgiving of tools that I use regularly than I am of my colleagues (as I would hope is true for most of us), but it would make me uncomfortable to “treat”…

I have actually had that thought, too.

I feel bad being rude to an LLM even though it doesn't care, so I add words like "please" and sometimes even complement it on good work even though I know this is useless. Will I learn to stop doing that, and if so, will I also stop doing it to humans?

I'm hoping the answer is simply "no". Plenty of people are rude in some contexts and then polite in others (especially private vs. public, or when talking to underlings vs. superiors), so it should be no problem to learn to be polite to humans even if you aren't polite to LLMs, I think? But I guess we'll see.

Re: A look at Cloudflare's AI-coded OAuth library

#150

Post by LgWoodenBadger »

sarchertech wrote: post #143
LgWoodenBadger wrote: post #87

Earlier quoted context omitted.

Complicated parallelization? That’s what partitions and consumers/consumer-groups are for!

Of course they are, but I’m not controlling the producer.

Producer doesn’t care how many partitions there are, it doesn’t even know about them, unless it wants to use its own partitioning algorithm. You can change the number of partitions on the topic after the fact.
Post reply on HN