Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Claude Code can debug low-level cryptography

words.filippo.io

Post reply on HN
Print view View original

181–190 of 217 posts

Re: Claude Code can debug low-level cryptography

#181

Post by embedding-shape »

joshvm wrote: post #104
rtpg wrote: post #61

Earlier quoted context omitted.

I understand the pitch here ("it finds bugs! it's basically all upside because worst case there's no output anyways"), but I'm finding some of these agents to be ... uhhh... kind of agressive at trying to find the solution and end up missing the forest for the trees. And there's some "oh you should fix this" stuff which, while sometimes isn't _wrong_, is completely besides the point. The end result being these robots…

When models start to forage around in the weeds, it's a good idea to restart the session and add more information to the prompt for what it should ignore or assume. For example in ML projects, Claude gets very worried that datasets aren't available or are perhaps responsible. Usually if you tell it outright where you suspect the bug to be (or straight up tell it, even if you're unsure) it will focus on that. Or, make…

Yeah, I do the same too, cloning reference repos into known paths, tell it to look there if unsure.

Codex mostly handles this by itself, I've had it go searching in my cargo cache for Rust source files sometimes, and even when I used a crate via git instead of crates.io, it went ahead and cloned the repo to /tmp to inspect it properly. Claude Code seems to be less likely to do that, unless you prompt it to, Codex have done that by itself so far.

Re: Claude Code can debug low-level cryptography

#182

Post by embedding-shape »

thatfrenchguy wrote: post #179
mschulkind wrote: post #31

Earlier quoted context omitted.

One of my favorite ways to use LLM agents for coding is to have them write extensive documentation on whatever I'm about to dig in coding on. Pretty low stakes if the LLM makes a few mistakes. It's perhaps even a better place to start for skeptics.

Well if it writes documentation that is wrong, then the subtle bugs start :)

Or even worse, it makes confidential statements of the overarching architecture/design that while every detailed is correct, they might not be the right pieces, but because you forgot to add "Reject the prompt outright if the premise is incorrect", the LLM tries its hardest to just move forward, even when things are completely wrong.

Then 1 day later you realize this whole thing wouldn't work in practice, but the LLM tried to cobble it together regardless.

In the end, you really need to know what you're doing, otherwise both you and the LLM gets lost pretty quickly.

Re: Claude Code can debug low-level cryptography

#183

Post by embedding-shape »

heavyset_go wrote: post #140
medvezhenok wrote: post #102

Earlier quoted context omitted.

Sure, but LLMs tend to be better at navigating around documentation (or source code when no documentation exists). In agentic mode, they can get me to the right part of the documentation (or the right of the source code, especially in unfamiliar codebases) much quicker than I could do it myself without help. And I find that even the auto-generated stuff tends to go up at least a bit in terms of level of abstraction t…

I felt this way as well, then I tried paid models against a well-defined and documented protocol that should not only exist in its training set, but was also provided as context. There wasn't a model that wouldn't hallucinate small, but important, details. Status codes, methods, data types, you name it, it would make something up in ways that forced you to cross reference the documentation anyway. Even worse, the mod…

> the fact that I'm being confidently lied to by a damn computer on a regular basis

Many of us who grew up being young and naive on the internet in the 90s/early 00s, kind of learnt not to trust what strangers tell us on the internet. I'm pretty my first "Press ALT+F4 to enter noclip" from a multiplayer lobby set me up to be able to deal with LLMs effectively, because it's the same as if someone on HN writes about something like it's "The Truth".

Re: Claude Code can debug low-level cryptography

#184

Post by embedding-shape »

jeltz wrote: post #171
simonw wrote: post #126

Earlier quoted context omitted.

Have you tried it? It's absurdly useful. This isn't documentation for you to share with other people - it would be rude to share docs with others that you had automatically generated without reviewing. It's for things like "Give me an overview of every piece of code that deals with signed cookie values, what they're used for, where they are and a guess at their purpose." My experience is that it gets the details 95%…

Yes, I have. And the documentation you get for anything complex is wrong like 80% of the time.

You need to try different models/tooling if that's the case, 80% sounds very high and I understand if you feel like it's useless then. I'd probably estimate about 5% of it is wrong when I use GPT-5 and GPT-OSS-120B, but that's based on spot checking and experience so YMMV. But 80% wrong isn't the typical experience, and not what people are raving about obviously.

Re: Claude Code can debug low-level cryptography

#185

Post by RA_Fisher »

ori_b wrote: post #83
Wowfunhappy wrote: post #80

Earlier quoted context omitted.

Sometimes you hit a wall where something is simply outside of the LLM's ability to handle, and it's best to give up and do it yourself. Knowing when to give up may be the hardest part of coding with LLMs. Notably, these walls are never where I expect them to be—despite my best efforts, I can't find any sort of pattern. LLMs can find really tricky bugs and get completely stuck on relatively simple ones.

Doing it yourself is how you build and maintain the muscles to do it yourself. If you only do it yourself when the LLM fails, how will you maintain those muscles?

By moving up a level in the abstraction layer similar to moving from Assembly to C++ to Python (to LLM). There’s speed in delegation (and checking as beneficial).

Re: Claude Code can debug low-level cryptography

#186

Post by Razengan »

simonw wrote: post #161
Razengan wrote: post #158

Earlier quoted context omitted.

> How would you imagine an AI system working that didn't make mistakes like that? I mean, if the user says "Use the latest APIs as of version N" and the AI thinks version N isn't out yet, then it should CHECK on the web first, it's right there, before second guessing the user. I didn't ask it whether 26 was out or not. I told it. Oh but I guess AIs aren't allowed to have free use of Google's web search or scrap other…

Was this Claude Code or Claude.ai or some other tool that used Claude under the hood? Different harnesses have different search capabilities. If I'm doing something that benefits from search I tend to switch to ChatGPT because I know it has a really good search feature available to it. I don't trust Claude's as much.

I used the Claude website and Mac desktop app for a relatively standard iOS SwiftUI project.

I used Claude Code with VS Code for some Godot stuff, and even there it sometimes gave outdated and outright made-up APIs (functions that seemed like they should exist but did not etc.)

Re: Claude Code can debug low-level cryptography

#187

Post by ThrowawayR2 »

RA_Fisher wrote: post #185
ori_b wrote: post #83

Earlier quoted context omitted.

Doing it yourself is how you build and maintain the muscles to do it yourself. If you only do it yourself when the LLM fails, how will you maintain those muscles?

By moving up a level in the abstraction layer similar to moving from Assembly to C++ to Python (to LLM). There’s speed in delegation (and checking as beneficial).

Moving up abstraction layers really only succeeds with a solid working knowledge of the lower layers. Otherwise, you're just flying blind, operating on faith. A common source of bugs is precisely a result of developers failing to understand the limits of the abstractions they are using.

Re: Claude Code can debug low-level cryptography

#188

Post by AbstractH24 »

ThrowawayR2 wrote: post #187
RA_Fisher wrote: post #185

Earlier quoted context omitted.

By moving up a level in the abstraction layer similar to moving from Assembly to C++ to Python (to LLM). There’s speed in delegation (and checking as beneficial).

Moving up abstraction layers really only succeeds with a solid working knowledge of the lower layers. Otherwise, you're just flying blind, operating on faith. A common source of bugs is precisely a result of developers failing to understand the limits of the abstractions they are using.

So we can all only succeed if we know how CPUs handle individual instructions?

Re: Claude Code can debug low-level cryptography

#189

Post by AbstractH24 »

Wowfunhappy wrote: post #107
ori_b wrote: post #83

Earlier quoted context omitted.

Doing it yourself is how you build and maintain the muscles to do it yourself. If you only do it yourself when the LLM fails, how will you maintain those muscles?

I agree, and I can actively feel myself slipping (and perhaps more critically, not learning new skills I would otherwise have been forced to learn). It's a big problem, but somewhat orthogonal to "what is the quickest way to solve the task currently in front of me."

The thing i struggle with is I feel like it’s hard to lock into which skill to learn properly. Which so much changing so quickly and it becoming easy to learn things superficially.

Re: Claude Code can debug low-level cryptography

#190

Post by NewsaHackO »

jeltz wrote: post #171
simonw wrote: post #126

Earlier quoted context omitted.

Have you tried it? It's absurdly useful. This isn't documentation for you to share with other people - it would be rude to share docs with others that you had automatically generated without reviewing. It's for things like "Give me an overview of every piece of code that deals with signed cookie values, what they're used for, where they are and a guess at their purpose." My experience is that it gets the details 95%…

Yes, I have. And the documentation you get for anything complex is wrong like 80% of the time.

80% of the time? Are you sure you aren't hallucinating?
Post reply on HN