Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudlflare builds OAuth with Claude and publishes all the prompts

github.com

Post reply on HN
Print view View original

421–430 of 552 posts

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#421

Post by blueflow »

bryant wrote: post #417
Vinnl wrote: post #393

Earlier quoted context omitted.

At least for me, I'm fairly sure that I'm better at not adding security flaws to my code (which I'm already not perfect at!) than I am at spotting them in code that I didn't write, unfortunately.

They're different mindsets. Some folks are better editors, inspectors, auditors, etc, whereas some are better builders, creators, and drafters. So what you're saying makes sense. And I'm definitely on the other side of that fence.

When you form a mental model and then write code from that, thats a very lossy transformation. You can write comments and documentation to make it less lossy, but there will be information that is lost to an reviewer, who has to spend great effort to recreate it. If it is unknown how code is supposed to behave, then it becomes physically impossible to verify it for correctness.

This is less a matter of "mindset", but more a general problem of information.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#422

Post by weird-eye-issue »

vjerancrnjak wrote: post #131

I like how it is just 1 file. Wonder how well incremental editing works with such a big file. I keep pushing for 1 file implementations, yet people split it up into bazillion files because it works better with AI.

Unfortunately Claude Code falls apart as soon as you hit 25k tokens in a single file. It's a hard coded limit where they will no longer put the full file into the prompt so it's up to the model to read it chunk by chunk or by using search tools

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#423

Post by kentonv »

Luker88 wrote: post #357

Hello Cloudflare, impressive result, I did not think things were this advanced. Still, legal question where I'd like to be wrong: AFAIK (and IANAL) if I use AI to generate images, I can't attach copyright to it. But the code here is clearly copyrighted to you. Is that possible because you manually modify the code? How does it work in examples like this one where you try to have close to all code generated by AI?

I am also not a lawyer, but I believe the law here is yet to be fully settled. Here in the US, there have been lower-court rulings but surely it will go to the supreme court.

There are parts of the library that I did write by hand, which are presumably copyright Cloudflare either way. As for whether the AI-generated parts are, I guess we'll see.

But given the thing is MIT-licensed, it doesn't seem like it matters much in this case?

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#424

Post by Culonavirus »

azemetre wrote: post #407
Culonavirus wrote: post #403

Earlier quoted context omitted.

Depends on what you're doing. For example when you're writing something like React components and using something like Tailwind for styling, I find the speedup is close to 10X.

Isn’t this because the LLMs had like a million+ react tutorials/articles/books/repos to train on? I mean I try to use them for svelte or vue and it still recommends react snippets sometimes.

Generally speaking, "LLMs" that I use are always the latest thinking versions of the flagship models (Grok 3/Gemini 2.5/...). GPT4o (and equivalent) are a mess.

But you're correct, when you use more exotic and/or quite new libraries, the outputs can be of mixed quality. For my current stack (Typescript, Node, Express, React 19, React Router 7, Drizzle and Tailwind 4) both Grok 3 (the paid one with 100k+ context) and Gemini 2.5 are pretty damn good. But I use them for prototyping, i.e. quickly putting together new stuff, for types, refactorings... I would never trust their output verbatim. (YET.) "Build an app that ..." would be a nightmare, but React-like UI code at sufficiently granular level is pretty much the best case scenario for LLMs as your components should be relatively isolated from the rest of the app and not too big anyways.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#425

Post by james_marks »

motorest wrote: post #339
dkdcio wrote: post #16

Earlier quoted context omitted.

> The million dollar (perhaps literally) question is – could @kentonv have written this library quicker by himself without any AI help? I *think* the answer to this is clearly no: or at least, given what we can accomplish today with the tools we have now, and that we are still collectively learning how to effectively use this, there's no way it won't be faster (with effective use) in another 3-6 months to fully-code…

> I think the answer to this is clearly no: or at least, given what we can accomplish today with the tools we have now, and that we are still collectively learning how to effectively use this, there's no way it won't be faster (with effective use) in another 3-6 months to fully-code new solutions with AI. I think these discussions need to start from another point. The techniques changed radically, and so did the way…

Exactly this

> Another critical aspect is that LLMs help you explore options faster, and iterate over them. This allows you to figure out what approach works best for your scenario and adapt to emerging requirements without having to even chat with anyone. This means that, within the timeframe you would deliver the first iteration of a MVP, you can very easily deliver a much more stable project

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#426

Post by b112 »

blueflow wrote: post #421
bryant wrote: post #417

Earlier quoted context omitted.

They're different mindsets. Some folks are better editors, inspectors, auditors, etc, whereas some are better builders, creators, and drafters. So what you're saying makes sense. And I'm definitely on the other side of that fence.

When you form a mental model and then write code from that, thats a very lossy transformation. You can write comments and documentation to make it less lossy, but there will be information that is lost to an reviewer, who has to spend great effort to recreate it. If it is unknown how code is supposed to behave, then it becomes physically impossible to verify it for correctness. This is less a matter of "mindset", but…

Whether reviewer or creator, if the start conditions / problem is known, both start with the same info.

"code base must do X with Y conditions"

The reviewer is at no disadvantage, other than the ability to walk the problem without coding.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#427

Post by chii »

pton_xd wrote: post #133
jes5199 wrote: post #21

I’ve been using Claude (via Cursor) on a greenfield project for the last couple months and my observation is: 1. I am much more productive/effective 2. It’s way more cognitively demanding than writing code the old-fashioned way 3. Even over this short timespan, the tools have improved significantly, amplifying both of the points above

This mirrors my experience and those I've talked to. LLM assisted coding is a way to get stuff done much faster, at a greatly increased mental cost / energy spent. Oddly enough.

> Oddly enough.

i actually dont find that outcome odd at all. The high cognative demand comes from the elimination of spurious busy work that would normally come with coding (things like syntax sugars, framework outline, and such). If an AI takes care of all of these things, and lets an author "code" at the speed of thought, you'd be running your engine at maximum.

Not to mention the need to also critically look at the generated code to ensure it's actual correctness (hopefully this can also be helped/offloaded by an ai in the future).

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#428

Post by fc417fc802 »

brailsafe wrote: post #390
0points wrote: post #385

Earlier quoted context omitted.

I really don't agree with the idea that expert time would just be spent typing, and I'd be really surprised if that's the common sentiment around here. An expert reasons, plans ahead, thinks and reasons a little bit more before even thinking about writing code. If you are measuring productivity by lines of code per hour then you don't understand what being a dev is.

> I really don't agree with the idea that expert time would just be spent typing, and I'd be really surprised if that's the common sentiment around here. They didn't suggest that at all, they merely suggested that the component of the expert's work that would otherwise be spent typing can be saved, while the rest of their utility comes from intense scrutiny, problem solving, decision making about what to build and wh…

It's not just time spent typing. Figuring out what needs to be typed can be both draining and time consuming. It's often (but not always) much easier to review someone else's solution to the problem than it is to solve it from scratch on your own.

Oddly enough security critical flows are likely to be one of the few exceptions because catching subtle reasoning errors that won't trip any unit tests when reviewing code that you didn't write is extremely difficult.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#429

Post by fc417fc802 »

827a wrote: post #419
victorbjorklund wrote: post #376

Earlier quoted context omitted.

That is how LLM:s should be used today. An expert prompts it and checks the code. Still saves a lot of time vs typing everything from scratch. Just the other day I was working on a prototype and let claude write code for a auth flow. Everything was good until the last step where it was just sending the user id as a string with the valid token. So if you got a valid token you could just pass in any user id and become…

I tend to disagree, but I don't know what my disagreement means for the future of being able to use AI when writing software. This workers-oauth-provider project is 1200 lines of code. An expert should be able to write that on the scale of an hour. The main value I've gotten out of AI writing software comes from the two extremes; not from the middle-ground you present. Vibe coding can be great and seriously productiv…

> An expert should be able to write that on the scale of an hour.

An expert in oauth, perhaps. Not your typical expert dev who doesn't specialize in auth but rather in whatever he's using the auth for. Navigating those sorts of standards is extremely time consuming.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#430

Post by chii »

lapcat wrote: post #414

If my future career consists of constantly prompting and code-reviewing a semi-competent, nonhuman coder in order to eventually produce something decent, then I want no part in that future, even if it's more "efficient" in the sense of taking less time overall. That sounds extremely frustrating, personally unrewarding, alienating. I've read the prompts and the commit messages, and to be honest, I don't have the patie…

> They want to turn artists and craftsmen into assembly line supervisors.

the same was uttered by blacksmiths and other craftsman who has been displaced by technology. Yet they are mercilessly crushed.

Your enjoyment of a job is not a consideration to those paying you to do it; and if there's a more efficient way, it will be adopted. The idea that your job is your identity may be at fault here - and when someone's identity is being threatened (as it very much is right now with these new AI tools), they respond very negatively.

Post reply on HN