Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudlflare builds OAuth with Claude and publishes all the prompts

github.com

Post reply on HN
Print view View original

351–360 of 552 posts

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#351

Post by rienbdj »

The commits are revealing.

Look at this one:

> Ask Claude to remove the "backup" encryption key. Clearly it is still important to security-review Claude's code!

> prompt: I noticed you are storing a "backup" of the encryption key as `encryptionKeyJwk`. Doesn't this backup defeat the end-to-end encryption, because the key is available in the grant record without needing any token to unwrap it?

I don’t think a non-expert would even know what this means, let alone spot the issue and direct the model to fix it.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#352

Post by motorest »

petersellers wrote: post #343
motorest wrote: post #341

Earlier quoted context omitted.

Right, but even the way you opted to frame this discussion is based on the idea that there is a drop in demand for software engineers. You need less engineers, not more. A few can get more done, but you need fewer to accomplish your tasks too.

I didn't frame it that way - perhaps you are thinking of the person you replied to? Nevertheless, I don't think they are trying to frame it that way, either. The point is that making software development easier can actually increase the demand of software engineers in some cases (where projects that were previously not considered due to budget constraints are now feasible).

> I didn't frame it that way - perhaps you are thinking of the person you replied to?

You did. You explicitly asserted the following.

> If a business has the budget for 1 or 2 engineers though, they might be able to task them with work that previously required 5-10 engineers (...).

In your own words, a project that would take 5-10 engineers is now feasible to be tackled with 1 or 2. Your own words.

> (...) The point is that making software development easier can actually increase the demand of software engineers in some cases (...)

I think that's somewhere between unrealistic and wishful thinking. Even in your problem statement, "making software development easier" lowers demand. Even if you argue that some positions might open where none existed before, the truth of the matter is that at the core of your scenario lies a drop in demand for software engineers. Shops who currently employ engineers won't need to retain as many to maintain their current level of productivity.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#353

Post by graeme »

kentonv wrote: post #105
paxys wrote: post #10

This is exactly the direction I expect AI-assisted coding to go in. Not software engineers being kicked out and some business person pressing a few buttons to have a fully functional app (as is playing out in a lot of fantasies on LinkedIn & X), but rather experienced engineers using AI to generate bits of code and then meticulously reviewing and testing them. The million dollar (perhaps literally) question is – coul…

It took me a few days to build the library with AI. I estimate it would have taken a few weeks, maybe months to write by hand. That said, this is a pretty ideal use case: implementing a well-known standard on a well-known platform with a clear API spec. In my attempts to make changes to the Workers Runtime itself using AI, I've generally not felt like it saved much time. Though, people who don't know the codebase as…

>I have found AI incredibly useful when I jump into other people's complex codebases, that I'm not familiar with. I now feel like I'm comfortable doing that

This makes sense. Are there codebases where you find this doesn't work as well, either from the codebase's min required context size or the code patterns not being in the training data?

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#354

Post by blharr »

hn_acc1 wrote: post #190
kentonv wrote: post #132

Earlier quoted context omitted.

I think there's a huge huge space of software to build that isn't being touched today because it's not cost-effective to have an engineer build them. But if the time it takes an engineer to build any one thing goes down, now there are a lot more things that are cost effective. Consider niche use cases. Every company tends to have custom processes and workflows. Think about being an accountant at one company vs. anoth…

After 30+ years in the software field, and a user for 40+, having at times heavily customized my desktop or editor, for example - I've concluded that the best thing for most apps is for me to learn to use them with stock settings. Why? Inevitably, I changed positions / jobs / platforms, and all that effort was lost / inapplicable, and I had to relearn to use the stock settings anyway. Now, I understand that some comp…

This just isn't true and will probably never be true. Using all the defaults is... probably optimal in the general sense and when things come to scale, but most companies (or just leadership) at some point want to leave the "standards" with custom design or additions. Also, any company providing payroll/accounting/ software has an inherent interest in going against standardization and providing features to promote lock-in.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#355

Post by bootsmann »

rienbdj wrote: post #351

The commits are revealing. Look at this one: > Ask Claude to remove the "backup" encryption key. Clearly it is still important to security-review Claude's code! > prompt: I noticed you are storing a "backup" of the encryption key as `encryptionKeyJwk`. Doesn't this backup defeat the end-to-end encryption, because the key is available in the grant record without needing any token to unwrap it? I don’t think a non-expe…

There is also one quite early in the repo where the dev has to tell Claude to store only the hashes of secrets

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#357

Post by Luker88 »

Hello Cloudflare, impressive result, I did not think things were this advanced.

Still, legal question where I'd like to be wrong: AFAIK (and IANAL) if I use AI to generate images, I can't attach copyright to it.

But the code here is clearly copyrighted to you.

Is that possible because you manually modify the code?

How does it work in examples like this one where you try to have close to all code generated by AI?

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#358

Post by throwaway2037 »

rienbdj wrote: post #351

The commits are revealing. Look at this one: > Ask Claude to remove the "backup" encryption key. Clearly it is still important to security-review Claude's code! > prompt: I noticed you are storing a "backup" of the encryption key as `encryptionKeyJwk`. Doesn't this backup defeat the end-to-end encryption, because the key is available in the grant record without needing any token to unwrap it? I don’t think a non-expe…

While I think this is a cool (public) experiment by Claude, asking an LLM to write security-sensitive code seems crazy at this point. Ad absurdum: Can you imagine asking Claude to implement new functionality in OpenSSL libs!?

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#359

Post by petersellers »

motorest wrote: post #352
petersellers wrote: post #343

Earlier quoted context omitted.

I didn't frame it that way - perhaps you are thinking of the person you replied to? Nevertheless, I don't think they are trying to frame it that way, either. The point is that making software development easier can actually increase the demand of software engineers in some cases (where projects that were previously not considered due to budget constraints are now feasible).

> I didn't frame it that way - perhaps you are thinking of the person you replied to? You did. You explicitly asserted the following. > If a business has the budget for 1 or 2 engineers though, they might be able to task them with work that previously required 5-10 engineers (...). In your own words, a project that would take 5-10 engineers is now feasible to be tackled with 1 or 2. Your own words. > (...) The point…

> In your own words, a project that would take 5-10 engineers is now feasible to be tackled with 1 or 2. Your own words.

That statement != lower demand for software engineers.

If a firm needs to perform project X that previously cost 10 engineers to do, but they only have the budget for 2, they will not tackle that project. Engineers used = 0.

However, if due to productivity enhancements with AI, the project can now be done with just 2 engineers, the company can now afford to tackle the project. Engineers used = 2.

That is the point that the person you were originally replying to was making.

> Even in your problem statement, "making software development easier" lowers demand.

Incorrect, as shown above.

> Even if you argue that some positions might open where none existed before, the truth of the matter is that at the core of your scenario lies a drop in demand for software engineers.

I see what you are trying to say, but it's not that clear cut. The fact is, no one knows what will actually happen to software engineering demand in the long run. Some scenarios will increase demand for engineers, others will decrease it. No one knows what the net demand will be, everyone is only guessing at this point.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#360

Post by dvrp »

Luker88 wrote: post #357

Hello Cloudflare, impressive result, I did not think things were this advanced. Still, legal question where I'd like to be wrong: AFAIK (and IANAL) if I use AI to generate images, I can't attach copyright to it. But the code here is clearly copyrighted to you. Is that possible because you manually modify the code? How does it work in examples like this one where you try to have close to all code generated by AI?

Did you check the latest documents from copyright.gov? They’re interesting exactly because of what you’re saying
Post reply on HN