Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudlflare builds OAuth with Claude and publishes all the prompts

github.com

Post reply on HN
Print view View original

431–440 of 552 posts

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#431

Post by lapcat »

chii wrote: post #430
lapcat wrote: post #414

If my future career consists of constantly prompting and code-reviewing a semi-competent, nonhuman coder in order to eventually produce something decent, then I want no part in that future, even if it's more "efficient" in the sense of taking less time overall. That sounds extremely frustrating, personally unrewarding, alienating. I've read the prompts and the commit messages, and to be honest, I don't have the patie…

> They want to turn artists and craftsmen into assembly line supervisors. the same was uttered by blacksmiths and other craftsman who has been displaced by technology. Yet they are mercilessly crushed. Your enjoyment of a job is not a consideration to those paying you to do it; and if there's a more efficient way, it will be adopted. The idea that your job is your identity may be at fault here - and when someone's id…

> the same was uttered by blacksmiths and other craftsman who has been displaced by technology. Yet they are mercilessly crushed.

This is misleading. The job of blacksmith wasn't automated away. There's just no demand for their services anymore, because we no longer have knights wearing armor, brandishing swords, and riding horses. In contrast, computer software is not disappearing; if anything, it's becoming ubiquitous.

> Your enjoyment of a job is not a consideration to those paying you to do it

But it is a consideration to me in offering my services. And everyone admits that even with LLMs and agents, experienced senior developers are crucial to keep the whole process from falling into utter crap and failure. Claude can't supervise itself.

> The idea that your job is your identity may be at fault here

No, it's just about not wanting to spend a large portion of my waking hours doing something I hate.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#432

Post by blueflow »

b112 wrote: post #426
blueflow wrote: post #421

Earlier quoted context omitted.

When you form a mental model and then write code from that, thats a very lossy transformation. You can write comments and documentation to make it less lossy, but there will be information that is lost to an reviewer, who has to spend great effort to recreate it. If it is unknown how code is supposed to behave, then it becomes physically impossible to verify it for correctness. This is less a matter of "mindset", but…

Whether reviewer or creator, if the start conditions / problem is known, both start with the same info. "code base must do X with Y conditions" The reviewer is at no disadvantage, other than the ability to walk the problem without coding.

This is the ideal case where the produced code is well readable and commented so its intent is obvious.

The worst case is an intern or LLM having generated some code where the intent is not obvious and them not being able to explain the intent behind it. "How is that even related to the ticket"-style code.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#433

Post by ambicapter »

azemetre wrote: post #407
Culonavirus wrote: post #403

Earlier quoted context omitted.

Depends on what you're doing. For example when you're writing something like React components and using something like Tailwind for styling, I find the speedup is close to 10X.

Isn’t this because the LLMs had like a million+ react tutorials/articles/books/repos to train on? I mean I try to use them for svelte or vue and it still recommends react snippets sometimes.

Yes, definitely. Act accordingly.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#434

Post by kortilla »

i5heu wrote: post #363
rienbdj wrote: post #351

The commits are revealing. Look at this one: > Ask Claude to remove the "backup" encryption key. Clearly it is still important to security-review Claude's code! > prompt: I noticed you are storing a "backup" of the encryption key as `encryptionKeyJwk`. Doesn't this backup defeat the end-to-end encryption, because the key is available in the grant record without needing any token to unwrap it? I don’t think a non-expe…

Revealing against what? If you look at the README it is completely revealed... so i would argue there is nothing to "reveal" in the first place. > I started this project on a lark, fully expecting the AI to produce terrible code for me to laugh at. And then, uh... the code actually looked pretty good. Not perfect, but I just told the AI to fix things, and it did. I was shocked. > To emphasize, this is not "vibe coded…

Revealing the types of critical mistakes LLMs make. In particular someone that didn’t already understand OAuth likely would not have caught this and ended up with a vulnerable system.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#435

Post by mattgreenrocks »

lapcat wrote: post #414

If my future career consists of constantly prompting and code-reviewing a semi-competent, nonhuman coder in order to eventually produce something decent, then I want no part in that future, even if it's more "efficient" in the sense of taking less time overall. That sounds extremely frustrating, personally unrewarding, alienating. I've read the prompts and the commit messages, and to be honest, I don't have the patie…

I deeply resent the notion that we engineers should let non-engineers tell us how to achieve agreed-upon objectives (e.g. "use LLMs more!"). I'm happy to use LLMs when they are useful. If I have to babysit them excessively, then it's a double loss: I'm not accruing domain knowledge, and I'm wasting time. The contract of work I was sold in the early 2000s: decision makers specify what should be be built, and what the time constraints are. This bounds the space of possibilities along with the local engineering culture. I bear the responsibility of execution, clarifying requirements, and bringing up potential issues sooner rather than later.

However, at no point was the exact technical approach prescribed to me. It'd be asinine if someone came to me and said, "you need to be using VSCode, not vim." It's irrelevant to execution. Yet, that's exactly what's happening with LLMs.

The denial of agency to devs via prescriptive LLM edicts will only end badly.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#436

Post by vaidhy »

I think the discussions are also missing another key element. The time in takes to read someone else code is way more mentally tiring.

When I am writing the code, my mind tracks what I have done and the new pieces flow. When I am reading code written by someone else, there is no flow.. I have to track individual pieces and go back and forth on what was done before.

I can see myself using LLMs for short snippets rather than start something top down.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#437

Post by jstummbillig »

paxys wrote: post #10

This is exactly the direction I expect AI-assisted coding to go in. Not software engineers being kicked out and some business person pressing a few buttons to have a fully functional app (as is playing out in a lot of fantasies on LinkedIn & X), but rather experienced engineers using AI to generate bits of code and then meticulously reviewing and testing them. The million dollar (perhaps literally) question is – coul…

This is not where AI-assisted coding is going. Where it is going is: The AI will quickly become better at avoiding these types of mistakes than humans ever were (and are ever going to be), because they can and thus will be RL'ed away. What will be left standing longest is providing the vision wrt what the actual problem is, you want to solve.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#438

Post by hn_throwaway_99 »

kentonv wrote: post #418
rienbdj wrote: post #351

The commits are revealing. Look at this one: > Ask Claude to remove the "backup" encryption key. Clearly it is still important to security-review Claude's code! > prompt: I noticed you are storing a "backup" of the encryption key as `encryptionKeyJwk`. Doesn't this backup defeat the end-to-end encryption, because the key is available in the grant record without needing any token to unwrap it? I don’t think a non-expe…

Yeah I was disappointed in that one. I hate to say, though, but I have reviewed a lot of human code in my time, and I've definitely caught many humans making similar-magnitude mistakes. :/

I just wanted to say thanks so much publishing this, and especially your comments here - I found them really helpful and insightful. I think it's interesting (though not unexpected) that many of the other commenters' comments here show what a Rorschach test this is. I think that's kind of unfortunate, because your experience clearly showed some of the benefits and limitations/pitfalls of coding like this in an objective manner.

I am curious, did you find the work of reviewing Claude's output more mentally tiring/draining than writing it yourself? Like some other folks mentioned, I generally find reviewing code more mentally tiring than writing it, but I get a lot of personal satisfaction by mentoring junior developers and collaborating with my (human) colleagues (most of them anyway...) Since I don't get that feeling when reviewing AI code, I find it more draining. I'm curious how you felt reviewing this code.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#439

Post by ActionHank »

rienbdj wrote: post #351

The commits are revealing. Look at this one: > Ask Claude to remove the "backup" encryption key. Clearly it is still important to security-review Claude's code! > prompt: I noticed you are storing a "backup" of the encryption key as `encryptionKeyJwk`. Doesn't this backup defeat the end-to-end encryption, because the key is available in the grant record without needing any token to unwrap it? I don’t think a non-expe…

But AIbros will be running around telling everyone that Claude invented OAuth for Cloudflare all on its own and then opensourced it.

Re: Cloudlflare builds OAuth with Claude and publishes all the prompts

#440

Post by hn_throwaway_99 »

bananapub wrote: post #398
rienbdj wrote: post #351

The commits are revealing. Look at this one: > Ask Claude to remove the "backup" encryption key. Clearly it is still important to security-review Claude's code! > prompt: I noticed you are storing a "backup" of the encryption key as `encryptionKeyJwk`. Doesn't this backup defeat the end-to-end encryption, because the key is available in the grant record without needing any token to unwrap it? I don’t think a non-expe…

this seems like a true but pointless observation? if you're producing security-sensitive code then experts need to be involved, whether that's me unwisely getting a junior to do something, or receiving a PR from my cat, or using an LLM. removing expert humans from the loop is the deeply stupid thing the Tech Elite Who Want To Crush Their Own Workforces / former-NFT fanboys keep pushing, just letting an LLM generate c…

I think it's a critically important observation.

I thought this experience was so helpful as it gave an objective, evidence-based sample on both the pros and cons of AI-assisted coding, where so many of the loudest voices on this topic are so one-sided ("AI is useless" or "developers will be obsolete in a year"). You say "removing expert humans from the loop is the deeply stupid thing the Tech Elite Who Want To Crush Their Own Workforces / former-NFT fanboys keep pushing", but the fact is many people with the power to push AI onto their workers are going to be more receptive to actual data and evidence than developers just complaining that AI is stupid.

Post reply on HN