Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudlflare builds OAuth with Claude and publishes all the prompts

github.com

Post reply on HN
Print view View original

191–200 of 552 posts

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#191

Post by euiq »

kentonv wrote: post #134
rethab wrote: post #122

Earlier quoted context omitted.

Fancy! Why are the first twenty commits or so created in the same minute though? Surely you can’t be that fast if you need to prompt for each commit

That's weird! It must be due to a history rewrite I did later on to clean up the repo, removing some files that weren't really part of the project. I didn't realize when I first started the experiment that we'd actually end up releasing the code so I had to go back and clean it up later. I am surprised though that this messed up the timestamps -- usually rebases retain timestamps. I think I used `git filter-branch`,…

I know that `git rebase` changes the committer date while keeping the author date the same, so I'm assuming something similar happened here. For example, many of the early commits have this committer date with varying author dates:

    $ git show --format=fuller 3dafc8f5de6ffe46fb223a75a46a6bd848b6daf8
    commit 3dafc8f5de6ffe46fb223a75a46a6bd848b6daf8
    Author:     Kenton Varda 
    AuthorDate: Thu Feb 27 17:15:37 2025 -0600
    Commit:     Kenton Varda 
    CommitDate: Tue Mar 4 14:48:59 2025 -0600
    
        Add storage schema by Claude.
GitHub uses the committer date for its history, which is annoying if you rebase frequently; I like to run a non-interactive `git rebase` with `--commmiter-date-is-author-date` in such cases.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#192

Post by mysterydip »

diggan wrote: post #51
mysterydip wrote: post #46

Earlier quoted context omitted.

This to me is why I think these tools don't have actual understanding, and are instead producing emergent output from pooling an incomprehensibly large set of pattern-recognized data.

> these tools don't have actual understanding, and are instead producing emergent output from pooling an incomprehensibly large set of pattern-recognized data I mean, bypassing the fact that "actual understanding" doesn't have any consensus about what it is, does it matter if it's "actual understanding" or "kind of understanding", or even "barely understanding", as long as it produces the results you expect?

No, I was not making a critique on its effectiveness at generating usable results. I was responding to what I've seen in several other articles here arguing towards anthropomorphism.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#193

Post by subarctic »

multimoon wrote: post #74

I think this reinforces that “vibecoding” is silly and won’t survive. It still needed immensely skilled programmers to work with it and check its output, and fix several bugs it refused to fix. Like anything else it will be a tool to speed up a task, but never do the task on its own without supervision or someone who can already do the task themselves, since at a minimum they have to already understand how the servic…

I get the sense that "vibecoding" is used like a strawman these days, something people keep moving the goal posts on so they can keep saying it's silly. Getting an LLM to write code for you that mostly works with some tweaks is vibe coding, isn't it?

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#194

Post by mysterydip »

Powdering7082 wrote: post #149
dingnuts wrote: post #145

Earlier quoted context omitted.

if you give an LLM a spec with a new language and no examples, it can't write the new language. until someone does that, I think we've demonstrated that they do not have understanding or abstract thought. they NEED examples in a way humans do not.

https://openreview.net/pdf?id=GTHD2UnDIb

Interesting paper, thanks for sharing. I assume the effectiveness depends greatly on the syntax of the language to be learned (c-like, etc).

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#195

Post by jakeydus »

steveklabnik wrote: post #174
qsort wrote: post #9

Earlier quoted context omitted.

Probably unrelated to the broader discussion, but I don't think the "skeptic vs pro-AI" distinction even makes that much sense. For example, I usually come off as being relatively skeptic within the HN crowd, but I'm actually pushing for more usage at work. This kind of "opinion arbitrage" is common with new technologies.

One recent post I read about improving the discourse (which I seem to have lost the link...) agrees, but in a different way: adding a "capable vs not" axis. that is, "I believe AI is good enough to replace humans, and I am pro" is different than "I believe AI is good enough to replace humans, and I am against" and while "I believe AI is not good enough to replace humans, and I am pro" is a weird position to take, "I…

> "I believe AI is not good enough to replace humans, and I am pro" is a weird position to take

I think that's just the opinion of someone who doesn't think AI currently lives up to the hype but is optimistic about developing it further, not really that weird of a position in my opinion.

Personally I'm moving more into the "I think AI is good enough to replace humans, and I am against" category.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#196

Post by butlike »

diggan wrote: post #130
stego-tech wrote: post #53

On the one hand, I would expect LLMs to be able to crank out such code when prompted by skilled engineers who also understand prompting these tools correctly. OAuth isn’t new, has tons of working examples to steal as training data from public projects, and in a variety of existing languages to suit most use cases or needs. On the other hand, where I remain a skeptic is this constant banging-on that somehow this will…

> On the other hand, where I remain a skeptic is this constant banging-on that somehow this will translate into entirely new things - research, materials science, economies, inventions, etc Does it even have to be able to do so? Just the ability to speed up exploration and validation based on what a human tells it to do is already enormously useful, depending on how much you can speed up those things, and how accurat…

So isn't the heuristic that if your job is easily digestible by an LLM, you're probably replaceable, but if the strong slowdown factor presents itself, you're probably doing novel work and have job security?

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#197

Post by thewebguyd »

kentonv wrote: post #132
thewebguyd wrote: post #75

Earlier quoted context omitted.

> But what if you only need 2 kentonv's instead of 20 at the end? Do you assume we'll find enough new tasks that will occupy the other 18? I think that's the question. This is likely where all this will end up. I have doubts that AI will replace all engineers, but I have no doubt in my mind that we'll certainly need a lot less engineers. A not so dissimilar thing happened in the sysadmin world (my career) when everyt…

I think there's a huge huge space of software to build that isn't being touched today because it's not cost-effective to have an engineer build them. But if the time it takes an engineer to build any one thing goes down, now there are a lot more things that are cost effective. Consider niche use cases. Every company tends to have custom processes and workflows. Think about being an accountant at one company vs. anoth…

> I think there's a huge huge space of software to build that isn't being touched today because it's not cost-effective to have an engineer build them.

That's definitely an interesting area, but I think we'll actually see (maybe) individual employees solving some of these problems on their own without involving IT/the dev team.

We kind of see it already - a lot of these problem spaces are being solved with complex Excel workflows, crappy Access databases, etc. because the team needed their problem solved now, and resources couldn't be given to them.

Maybe AI is the answer to that so that instead of building a house of cards on Excel, these non-tech teams can have something a little more robust.

It's interesting you mentioned accounting, because that's the one department/area I see taking off and running with it the most. They are already the department that's effectively programming already with Excel workflows & DSLs in whatever ERP du jour.

So it doesn't necessarily open up more dev jobs, but maybe fulfills the old the mantra of "everyone will become a programmer." and we see more advanced computing become a commodity thanks to AI - much like everyone can click their way through an office suite with little experience or training, everyone will be able to use AI to automate large chunks of their job or departmental processes.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#198

Post by [deleted] »

jes5199 wrote: post #21

I’ve been using Claude (via Cursor) on a greenfield project for the last couple months and my observation is: 1. I am much more productive/effective 2. It’s way more cognitively demanding than writing code the old-fashioned way 3. Even over this short timespan, the tools have improved significantly, amplifying both of the points above

[deleted]

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#199

Post by arendtio »

infinitebattery wrote: post #23

From this commit: https://github.com/cloudflare/workers-oauth-provider/commit/... === "Fix Claude's bug manually. Claude had a bug in the previous commit. I prompted it multiple times to fix the bug but it kept doing the wrong thing. So this change is manually written by a human. I also extended the README to discuss the OAuth 2.1 spec problem." === This is super relatable to my experience trying to use these AI tool…

One way to mitigate the issue is to use tests or specifications and let the AI find a solution to the spec.

A few months ago, solving such a spec riddle could take a while, and most of the time, the solutions that were produced by long run times were worse than the quick solutions. However, recently the models have become significantly better at solving such riddles, making it fun (depending on how well your use case can be put into specs).

In my experience, sonnet 3.7 represented a significant step forward compared to sonnet 3.5 in this discipline, and Gemini 2.5 Pro was even more impressive. Sonnet 4 makes even fewer mistakes, but it is still necessary to guide the AI through sound software engineering practices (obtaining requirements, discovering technical solutions, designing architecture, writing user stories and specifications, and writing code) to achieve good results.

Edit: And there is another trick: Provide good examples to the AI. Recently, I wanted to create an app with the OpenAI Realtime API and at first it failed miserably, but then I added the most important two pages of the documentation and one of the demo projects into my workspace and just like that it worked (even though für my use-case the API calls had to be use quite differently).

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#200

Post by ZiiS »

kentonv wrote: post #146
ZiiS wrote: post #77

Shouldn't they really have asked it to read https://developers.cloudflare.com/workers/examples/protect-a...

The secret token is hashed first, and it's the hash that is looked up in storage. In this arrangement, an attacker cannot use timing to determine the correct value byte-by-byte, because any change to the secret token is expected to randomize the whole hash. So, timing-safe equality is not needed. That said, if you have spotted a place in the code where you believe there is such a vulnerability, please do report it. D…

I am not confident enough in this area to to report a vunrability, the networking alone probably makes timing impractical. I thought it was now practical to generate known prefix Sha256, so some information could be extracted? Not enough to compromise but the function is right there.
Post reply on HN