Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudlflare builds OAuth with Claude and publishes all the prompts

github.com

Post reply on HN
Print view View original

201–210 of 552 posts

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#201

Post by kentonv »

hn_acc1 wrote: post #190
kentonv wrote: post #132

Earlier quoted context omitted.

I think there's a huge huge space of software to build that isn't being touched today because it's not cost-effective to have an engineer build them. But if the time it takes an engineer to build any one thing goes down, now there are a lot more things that are cost effective. Consider niche use cases. Every company tends to have custom processes and workflows. Think about being an accountant at one company vs. anoth…

After 30+ years in the software field, and a user for 40+, having at times heavily customized my desktop or editor, for example - I've concluded that the best thing for most apps is for me to learn to use them with stock settings. Why? Inevitably, I changed positions / jobs / platforms, and all that effort was lost / inapplicable, and I had to relearn to use the stock settings anyway. Now, I understand that some comp…

There are good arguments to just conform. But it is in fact true nevertheless that many companies and teams continue to choose bespoke workflows over standardized ones. So I guess there must be something driving that.

I don't actually think this is going to take the form of LLMs implementing custom patches to off-the-shelf software. I think instead it's going to look like LLMs writing code that uses APIs offered by off-the-shelf software to script specific workflows.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#202

Post by bsder »

> Claude's output was thoroughly reviewed by Cloudflare engineers with careful attention paid to security and compliance with standards.

So, for those of us who are not OAuth experts, don't have a team of security engineers on call, and are likely to fall into all the security and compliance traps, how does this help?

I don't need AI to write my shitty code. I need AI to review and correct my shitty code.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#203

Post by kentonv »

thewebguyd wrote: post #197
kentonv wrote: post #132

Earlier quoted context omitted.

I think there's a huge huge space of software to build that isn't being touched today because it's not cost-effective to have an engineer build them. But if the time it takes an engineer to build any one thing goes down, now there are a lot more things that are cost effective. Consider niche use cases. Every company tends to have custom processes and workflows. Think about being an accountant at one company vs. anoth…

> I think there's a huge huge space of software to build that isn't being touched today because it's not cost-effective to have an engineer build them. That's definitely an interesting area, but I think we'll actually see (maybe) individual employees solving some of these problems on their own without involving IT/the dev team. We kind of see it already - a lot of these problem spaces are being solved with complex Ex…

> I think we'll actually see (maybe) individual employees solving some of these problems on their own without involving IT/the dev team.

I agree, but in my book, those employees are now developers. And so by that definition, there will be a lot more developers.

Will we see more or fewer people whose primary job is software development? That's harder to answer. I do think we'll see a lot more consultant-type roles, with experienced software developers helping other people write their own personal automations.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#204

Post by cpursley »

stego-tech wrote: post #110
btown wrote: post #97

Earlier quoted context omitted.

It's said that much of research is data janitorial work, and from my experience that's not just limited to the machine learning space. Every research scientist wishes that they had an army of engineers to build bespoke tooling for their niche, so they could get back to trying ideas at the speed of thought rather than needing to spend a day writing utility functions for those tools and poring over tables to spot anoma…

> Vibe-coding won't be a net creativity gain to a researcher affected by vibe-immigration-policy, vibe-grant-availability, and vibe-firings, for all of which the unpredictability is a punitive design goal. Quite literally this is what I’m trying to get at with my resistance to LLM adoption in the current environment. We’re not using it to do hard work, we’re throwing it everywhere in an intentional decision to dumb d…

That’s one perspective, but it’s wrong and typical gatekeeping (do you have a software degree by any chance?). People had the same attitude towards open source tooling and low code frameworks - god forbid someone not certified and ordained build a solution in something other than Java...

AI code tools are allowing people to build things they couldn't before due to lack of skillset, time or budget. I’ve seen all sorts of problems solved by semi technical and even non-technical people. My brother for example built a thing with Microsoft copilot that helped automate more in his manufacturing facility (used to be paper).

But yeah, keep yelling at that cloud - the rest of us will keep shipping cool things that we couldn’t before, and faster.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#205

Post by 9dev »

kentonv wrote: post #105
paxys wrote: post #10

This is exactly the direction I expect AI-assisted coding to go in. Not software engineers being kicked out and some business person pressing a few buttons to have a fully functional app (as is playing out in a lot of fantasies on LinkedIn & X), but rather experienced engineers using AI to generate bits of code and then meticulously reviewing and testing them. The million dollar (perhaps literally) question is – coul…

It took me a few days to build the library with AI. I estimate it would have taken a few weeks, maybe months to write by hand. That said, this is a pretty ideal use case: implementing a well-known standard on a well-known platform with a clear API spec. In my attempts to make changes to the Workers Runtime itself using AI, I've generally not felt like it saved much time. Though, people who don't know the codebase as…

Funny thing. I have built something similar recently, that is a 2.1-compliant authorisation server in TypeScript[0]. I did it by hand, with some LLM help on the documentation. I think it took me about two weeks full time, give or take, and there’s still work to do, especially on the testing side of things, so I would agree with your estimate.

I’m going to take a very close look at your code base :)

[0] https://github.com/colibri-hq/colibri/blob/next/packages/oau...

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#207

Post by hattmall »

rangerelf wrote: post #36
hattmall wrote: post #7

I guess for me the questions is, at what point do you feel it would be reasonable to this without the experts involved in your case? As an edit, after reading some of the prompts, what is the likelihood that a non-expert could even come up with those prompts? The really really interesting thing would be if an AI could actually generate the prompts.

> I guess for me the questions is, at what point do you feel it would be reasonable to this without the experts involved in your case? I don't know if it was the intent but these kind of questions bother me, the seem to hint at an agenda, "when can I have a farm of idiots with keyboards paid minimum wage churn out products indistinguishable from expertly designed applications". To me that's the danger of AI, not it's…

Yeah, I mean that is definitely the intent of the question and it's absolutely one of the factors that's driving money into AI.

Assisting competent engineers certainly has value, but it's not an easy calculation to assess that value compared to the actual non-subsidized cost of AI's current state.

On the other hand having a farm of idiots, or even no idiots at all, just computers, churning out high quality applications is a completely different value proposition.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#208

Post by kentonv »

ZiiS wrote: post #200
kentonv wrote: post #146

Earlier quoted context omitted.

The secret token is hashed first, and it's the hash that is looked up in storage. In this arrangement, an attacker cannot use timing to determine the correct value byte-by-byte, because any change to the secret token is expected to randomize the whole hash. So, timing-safe equality is not needed. That said, if you have spotted a place in the code where you believe there is such a vulnerability, please do report it. D…

I am not confident enough in this area to to report a vunrability, the networking alone probably makes timing impractical. I thought it was now practical to generate known prefix Sha256, so some information could be extracted? Not enough to compromise but the function is right there.

Learning a prefix of the hash doesn't really get you anywhere. The hash itself isn't a secret -- it could be published publicly without breaking the security model. You still need to derive a token that hashes to that value in full, and if you can do that then you've broken the hash algorithm by definition.
Post reply on HN