Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudlflare builds OAuth with Claude and publishes all the prompts

github.com

Post reply on HN
Print view View original

231–240 of 552 posts

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#231

Post by giantrobot »

philipwhiuk wrote: post #109
kentonv wrote: post #105

Earlier quoted context omitted.

It took me a few days to build the library with AI. I estimate it would have taken a few weeks, maybe months to write by hand. That said, this is a pretty ideal use case: implementing a well-known standard on a well-known platform with a clear API spec. In my attempts to make changes to the Workers Runtime itself using AI, I've generally not felt like it saved much time. Though, people who don't know the codebase as…

> Though, people who don't know the codebase as well as I do have reported it helped them a lot. My problem I guess is that maybe this is just Dunning-Kruger esq. When you don't know what you don't know you get the impression it's smart. When you do, you think it's rubbish. Like when you see a media report on a subject you know about and you see it's inaccurate but then somehow still trust the media on a subject you'…

> Like when you see a media report on a subject you know about and you see it's inaccurate but then somehow still trust the media on a subject you're a non-expert on.

Gell-Mann Amnesia https://en.m.wikipedia.org/wiki/Gell-Mann_amnesia_effect

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#232

Post by fxnn »

arendtio wrote: post #199
infinitebattery wrote: post #23

From this commit: https://github.com/cloudflare/workers-oauth-provider/commit/... === "Fix Claude's bug manually. Claude had a bug in the previous commit. I prompted it multiple times to fix the bug but it kept doing the wrong thing. So this change is manually written by a human. I also extended the README to discuss the OAuth 2.1 spec problem." === This is super relatable to my experience trying to use these AI tool…

One way to mitigate the issue is to use tests or specifications and let the AI find a solution to the spec. A few months ago, solving such a spec riddle could take a while, and most of the time, the solutions that were produced by long run times were worse than the quick solutions. However, recently the models have become significantly better at solving such riddles, making it fun (depending on how well your use case…

That's one thing where I love Golang. I just tell Aider to `/run go doc github.com/some/package`, and it includes the full signatures in the chat history.

It's true: often enough AI struggles to use libraries, and doesn't remember the usage correctly. Simply adding the go doc fixed that often.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#233

Post by eikenberry »

throwaway314155 wrote: post #168
eikenberry wrote: post #102

Earlier quoted context omitted.

I thought Claude still has a problem generating the same output for the same input? That you can't just rewind and rerun and get to the same point again.

> can't just rewind and rerun and get to the same point again Why would you want to? The whole point of a retry is that your previous conversation attempt went poorly.

Good engineering? You want automated steps to be repeatable so you know your tweak to the previous conversation have the effect you desire. Though using an AI for coding is probably closer in spirit the the art of writing code than the engineering of writing code and art is pretty much unrepeatable by definition.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#234

Post by kentonv »

sitharus wrote: post #230
cpursley wrote: post #204

Earlier quoted context omitted.

That’s one perspective, but it’s wrong and typical gatekeeping (do you have a software degree by any chance?). People had the same attitude towards open source tooling and low code frameworks - god forbid someone not certified and ordained build a solution in something other than Java... AI code tools are allowing people to build things they couldn't before due to lack of skillset, time or budget. I’ve seen all sorts…

The problem isn't that people can quickly prototype an idea that they've had without contracting an expensive professional, I think this is great. This will give ideas that would never see the light of day a chance. Plus this gives a much better talking point if they do choose to get a professional onboard. The problem is that it's sold as a complete solution. Use the LLM and you'll get a fully working product. Howev…

> However if you're not an experienced programmer you won't know what's missing, if it's using outdated and insecure options, or is just badly written. This still needs a professional.

I think a lot of this could be solved by a platform that implements appropriate guardrails so that the application code literally cannot screw up the security. Not every conceivable type of software would fit in such a platform, but a lot of what people want to do to automate their day-to-day lives could.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#235

Post by ZiiS »

kentonv wrote: post #208
ZiiS wrote: post #200

Earlier quoted context omitted.

I am not confident enough in this area to to report a vunrability, the networking alone probably makes timing impractical. I thought it was now practical to generate known prefix Sha256, so some information could be extracted? Not enough to compromise but the function is right there.

Learning a prefix of the hash doesn't really get you anywhere. The hash itself isn't a secret -- it could be published publicly without breaking the security model. You still need to derive a token that hashes to that value in full, and if you can do that then you've broken the hash algorithm by definition.

Yes I guess if you trust the hash implementation completly; I just favour a bit more defence in depth.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#236

Post by manquer »

btown wrote: post #97
stego-tech wrote: post #53

On the one hand, I would expect LLMs to be able to crank out such code when prompted by skilled engineers who also understand prompting these tools correctly. OAuth isn’t new, has tons of working examples to steal as training data from public projects, and in a variety of existing languages to suit most use cases or needs. On the other hand, where I remain a skeptic is this constant banging-on that somehow this will…

It's said that much of research is data janitorial work, and from my experience that's not just limited to the machine learning space. Every research scientist wishes that they had an army of engineers to build bespoke tooling for their niche, so they could get back to trying ideas at the speed of thought rather than needing to spend a day writing utility functions for those tools and poring over tables to spot anoma…

> much of research is data janitorial work

In applied research perhaps, Fundamental research is nothing like that in any field including ML.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#237

Post by palata »

kentonv wrote: post #187
weinzierl wrote: post #175

"I thoughts LLMs were glorified Markov chain generators" "the code actually looked pretty good. Not perfect, but I just told the AI to fix things, and it did. I was shocked." These two views are by no means mutually exclusive. I find LLMs extremely useful and still believe they are glorified Markov generators. The take away should be that that is all you need and humans likely are nothing more than that.

I suppose it's all a continuum and we can each have different opinions on what the threshold for "glorified markov generator" is. But there have been many cases in my experience where the LLM could not possibly have been simply pattern-matching to something it had seen before. It really did "understand" the meaning of the code by any definition that makes sense to me.

> It really did "understand" the meaning of the code by any definition that makes sense to me.

I find it dangerous to say it "understands". People are fast to say it "is sentient by any definition that makes sense to them".

Also, would we say that a compiler "understands" the meaning of the code?

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#238

Post by manquer »

srhtftw wrote: post #227
kentonv wrote: post #105

Earlier quoted context omitted.

It took me a few days to build the library with AI. I estimate it would have taken a few weeks, maybe months to write by hand. That said, this is a pretty ideal use case: implementing a well-known standard on a well-known platform with a clear API spec. In my attempts to make changes to the Workers Runtime itself using AI, I've generally not felt like it saved much time. Though, people who don't know the codebase as…

> It took me a few days to build the library with AI. ... > I estimate it would have taken a few weeks, maybe months to write by hand. I don't think this is a fair assessment give the summary of the commit history https://pastebin.com/bG0j2ube shows your work started on 2025-02-27 and started trailing off at 2025-03-20 as others joined in. Minor changes continue to present. > That said, this is a pretty ideal use cas…

Is it though?

Would someone of author's caliber even be working on trivial slog item like Oauth2 implementation, if not for the novel development approach he wanted to attempt here ?

For the kind of regular jobs a engineer typically is expected to do, would it give 100% productivity jump ?

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#239

Post by immibis »

sitharus wrote: post #230
cpursley wrote: post #204

Earlier quoted context omitted.

That’s one perspective, but it’s wrong and typical gatekeeping (do you have a software degree by any chance?). People had the same attitude towards open source tooling and low code frameworks - god forbid someone not certified and ordained build a solution in something other than Java... AI code tools are allowing people to build things they couldn't before due to lack of skillset, time or budget. I’ve seen all sorts…

The problem isn't that people can quickly prototype an idea that they've had without contracting an expensive professional, I think this is great. This will give ideas that would never see the light of day a chance. Plus this gives a much better talking point if they do choose to get a professional onboard. The problem is that it's sold as a complete solution. Use the LLM and you'll get a fully working product. Howev…

You know the industry that will need a lot more professionals after this - cybersecurity.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#240

Post by immibis »

Flemlo wrote: post #181
weinzierl wrote: post #175

"I thoughts LLMs were glorified Markov chain generators" "the code actually looked pretty good. Not perfect, but I just told the AI to fix things, and it did. I was shocked." These two views are by no means mutually exclusive. I find LLMs extremely useful and still believe they are glorified Markov generators. The take away should be that that is all you need and humans likely are nothing more than that.

The way the input doesn't match the output should imply that it's not just statistics. As soon as compression happens, optimization happens which can lead to rules/learning of principles which got feed by statistics.

That's "just" more statistics though.
Post reply on HN