Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code can debug low-level cryptography

words.filippo.io

Post reply on HN
Print view View original

171–180 of 217 posts

Re: Claude Code can debug low-level cryptography

#171

Post by jeltz »

simonw wrote: post #126
krackers wrote: post #121

Earlier quoted context omitted.

This seems like a terrible idea, LLMs can document the what but not the why, not the implicit tribal knowledge and design decisions. Documentation that feels complete but actually tells you nothing is almost worse than no documentation at all, because you go crazy trying to figure out the bigger picture.

Have you tried it? It's absurdly useful. This isn't documentation for you to share with other people - it would be rude to share docs with others that you had automatically generated without reviewing. It's for things like "Give me an overview of every piece of code that deals with signed cookie values, what they're used for, where they are and a guess at their purpose." My experience is that it gets the details 95%…

Yes, I have. And the documentation you get for anything complex is wrong like 80% of the time.

Re: Claude Code can debug low-level cryptography

#172

Post by cube00 »

simonw wrote: post #41
pton_xd wrote: post #33

> Full disclosure: Anthropic gave me a few months of Claude Max for free. They reached out one day and told me they were giving it away to some open source maintainers. Related, lately I've been getting tons of Anthropic Instagram ads; they must be near a quarter of all the sponsored content I see for the last month or so. Various people vibe coding random apps and whatnot using different incarnations of Claude. Or j…

I think it might be that they've hit product-market fit. Developers find Claude Code extremely useful (once they figure out how to use it). Many developers subscribe to their $200/month plan. Assuming that's profitable (and I expect it is, since even for that much money it cuts off at a certain point to avoid over-use) Anthropic would be wise to spend a lot of money on marketing to try and grow their paying subscribe…

> Many developers subscribe to their $200/month plan.

There's no way "many developers" are paying $2,400 annually for the benefit of their employers.

There's no way companies are paying when they won't even fork out $700 a year for IntelliJ instead pushing us all onto VSCode.

Re: Claude Code can debug low-level cryptography

#173

Post by crazygringo »

ulrikrasmussen wrote: post #138
simonw wrote: post #11

Using coding agents to track down the root cause of bugs like this works really well: > Three out of three one-shot debugging hits with no help is extremely impressive. Importantly, there is no need to trust the LLM or review its output when its job is just saving me an hour or two by telling me where the bug is, for me to reason about it and fix it. The approach described here could also be a good way for LLM-skepti…

I know this is not an argument against LLM's being useful to increase productivity, but of all tasks in my job as software developer, hunting for and fixing obscure bugs is actually one of the most intellectually rewarding. I would miss that if it were to be taken over by a machine. Also, hunting for bugs is often a very good way to get intimately familiar with the architecture of a system which you don't know well,…

> hunting for and fixing obscure bugs is actually one of the most intellectually rewarding. I would miss that if it were to be taken over by a machine.

That's fascinating to me. It's the thing I literally hate the most.

When I'm writing new code, I feel like I'm delivering value. When I'm fixing bugs, I feel like it's a frustrating waste of time caused by badly written code in the first place, making it a necessary evil. (Even when I was the one who wrote the original code.)

Re: Claude Code can debug low-level cryptography

#174

Post by pron »

simonw wrote: post #11

Using coding agents to track down the root cause of bugs like this works really well: > Three out of three one-shot debugging hits with no help is extremely impressive. Importantly, there is no need to trust the LLM or review its output when its job is just saving me an hour or two by telling me where the bug is, for me to reason about it and fix it. The approach described here could also be a good way for LLM-skepti…

I'm only an "AI sceptic" in the sense that I think that today's LLM models cannot regularly and substantially reduce my workload, not because they aren't able to perform interesting programming tasks (they are!), but because they don't do so reliably, and for a regular and substantial reduction in effort, I think a tool needs to be reliable and therefore trustworthy.

Now, this story is a perfect use case, because Filippo Valsorda put very little effort into communicating with the agent. If it worked - great; if it didn't - no harm done. And it worked!

The thing is that I already know that these tools are capable of truly amazing feats, and this is, no doubt, one of them. But it's been a while since I had a bug in a single-file library implementing a well-known algorithm, so it still doesn't amount to a regular and substantial increase in productivity for me, but "only" to yet another amazing feat by LLMs (something I'm not sceptical of).

Next time I have such a situation, I'll definitely use an LLM to debug it, because I enjoy seeing such results first-hand (plus, it would be real help). But I'm not sure that it supports the claim that these tools can today offer a regular and substantial productivity boost.

Re: Claude Code can debug low-level cryptography

#175

Post by [deleted] »

johnisgood wrote: post #160
ori_b wrote: post #143

Earlier quoted context omitted.

I don't use calculators for most math because punching it in is slower than doing it in my head -- especially for fermi calculations. I will reach for a calculator when it makes sense, but because I don't use a calculator for everything, the number of places where I'm faster than a calculator grows over time. It's not particularly intentional, it just shook out that way. And I hated mental math exercises as a kid.

I do not trust myself, so even if I know how to do mental math, I still use my computer or a calculator just to be sure I got it correct. OCD? Lack of self-trust? No clue.

[deleted]

Re: Claude Code can debug low-level cryptography

#176

Post by Thorrez »

>so I checked out the old version of the change with the bugs (yay Jujutsu!) and kicked off a fresh Claude Code session

There's a risk there that the AI could find the solution by looking through your history to find it, instead of discovering it directly in the checked-out code. AI has done that in the past:

https://news.ycombinator.com/item?id=45214670

Re: Claude Code can debug low-level cryptography

#177

Post by mwigdahl »

cube00 wrote: post #172
simonw wrote: post #41

Earlier quoted context omitted.

I think it might be that they've hit product-market fit. Developers find Claude Code extremely useful (once they figure out how to use it). Many developers subscribe to their $200/month plan. Assuming that's profitable (and I expect it is, since even for that much money it cuts off at a certain point to avoid over-use) Anthropic would be wise to spend a lot of money on marketing to try and grow their paying subscribe…

> Many developers subscribe to their $200/month plan. There's no way "many developers" are paying $2,400 annually for the benefit of their employers. There's no way companies are paying when they won't even fork out $700 a year for IntelliJ instead pushing us all onto VSCode.

My company is paying for Claude Max for me and a dozen other developers. The others are using the API. If their API usage cost hits a level where it's cheaper to move them to Max, they're moved to Max.

There's no hard mandate to use Claude Code, but the value for us is clear to exec management and they are willing to foot the bill.

Re: Claude Code can debug low-level cryptography

#178

Post by simonw »

cube00 wrote: post #172
simonw wrote: post #41

Earlier quoted context omitted.

I think it might be that they've hit product-market fit. Developers find Claude Code extremely useful (once they figure out how to use it). Many developers subscribe to their $200/month plan. Assuming that's profitable (and I expect it is, since even for that much money it cuts off at a certain point to avoid over-use) Anthropic would be wise to spend a lot of money on marketing to try and grow their paying subscribe…

> Many developers subscribe to their $200/month plan. There's no way "many developers" are paying $2,400 annually for the benefit of their employers. There's no way companies are paying when they won't even fork out $700 a year for IntelliJ instead pushing us all onto VSCode.

https://www.anthropic.com/news/anthropic-raises-series-f-at-...

> At the beginning of 2025, less than two years after launch, Anthropic’s run-rate revenue had grown to approximately $1 billion. By August 2025, just eight months later, our run-rate revenue reached over $5 billion.

Claude Code launched in February 2025. Anthropic's annual run-rate revenue grew from $1bn to $5bn by August.

They haven't published a breakdown of this but I suspect a significant portion of that revenue growth came from their $200/month plan.

It would help explain why seemingly every other LLM company has pivoted to focus on "LLMs for code".

Re: Claude Code can debug low-level cryptography

#179

Post by thatfrenchguy »

mschulkind wrote: post #31
simonw wrote: post #11

Using coding agents to track down the root cause of bugs like this works really well: > Three out of three one-shot debugging hits with no help is extremely impressive. Importantly, there is no need to trust the LLM or review its output when its job is just saving me an hour or two by telling me where the bug is, for me to reason about it and fix it. The approach described here could also be a good way for LLM-skepti…

One of my favorite ways to use LLM agents for coding is to have them write extensive documentation on whatever I'm about to dig in coding on. Pretty low stakes if the LLM makes a few mistakes. It's perhaps even a better place to start for skeptics.

Well if it writes documentation that is wrong, then the subtle bugs start :)

Re: Claude Code can debug low-level cryptography

#180

Post by embedding-shape »

rtpg wrote: post #61
simonw wrote: post #11

Using coding agents to track down the root cause of bugs like this works really well: > Three out of three one-shot debugging hits with no help is extremely impressive. Importantly, there is no need to trust the LLM or review its output when its job is just saving me an hour or two by telling me where the bug is, for me to reason about it and fix it. The approach described here could also be a good way for LLM-skepti…

I understand the pitch here ("it finds bugs! it's basically all upside because worst case there's no output anyways"), but I'm finding some of these agents to be ... uhhh... kind of agressive at trying to find the solution and end up missing the forest for the trees. And there's some "oh you should fix this" stuff which, while sometimes isn't _wrong_, is completely besides the point. The end result being these robots…

> I understand the pitch here ("it finds bugs! it's basically all upside because worst case there's no output anyways"), but I'm finding some of these agents to be ... uhhh... kind of agressive at trying to find the solution and end up missing the forest for the trees. And there's some "oh you should fix this" stuff which, while sometimes isn't _wrong_, is completely besides the point.

How long/big do your system/developer/user prompts end up being typically?

The times people seem to be getting "less than ideal" responses from LLMs tend to be when they're not spending enough time setting up a general prompt they can reuse, describing exactly what they want and do not want.

So in your case, you need to steer it to do less outside of what you've told it. Adding things like "Don't do anything outside of what I've just told you" or "Focus only on the things inside " for example, would fix those particular problems, as long as you're not using models that are less good at following instructions (some of Google's models are borderline impossible to prevent adding comments all over the place, as one example).

So prompt it to not care about solutions, and only care about finding the root cause, and you'll find that you can mostly avoid the annoying parts by either prescribing what you'd want instead, or just straight up tell it not to do those things.

Then you iterate on this reusable prompt across projects, and it builds up so eventually 99% of the times the models do exactly what you expect.

Post reply on HN