Claude is not mentioned in the 'contributors' section.
Cloudlflare builds OAuth with Claude and publishes all the prompts
531–540 of 552 posts
Re: Cloudlflare builds OAuth with Claude and publishes all the prompts
#532The commits are revealing. Look at this one: > Ask Claude to remove the "backup" encryption key. Clearly it is still important to security-review Claude's code! > prompt: I noticed you are storing a "backup" of the encryption key as `encryptionKeyJwk`. Doesn't this backup defeat the end-to-end encryption, because the key is available in the grant record without needing any token to unwrap it? I don’t think a non-expe…
That is how LLM:s should be used today. An expert prompts it and checks the code. Still saves a lot of time vs typing everything from scratch. Just the other day I was working on a prototype and let claude write code for a auth flow. Everything was good until the last step where it was just sending the user id as a string with the valid token. So if you got a valid token you could just pass in any user id and become…
For me, it’s not the typing - it’s the understanding. If I’m typing code, I have a mental model already or am building one as I type, whereas if I have an LLM generate the code then it’s “somebody else’s code” and I have to take the time to understand it anyway in order to usefully review it. Given that’s the case, I find it’s often quicker for me to just key the code myself, and come away with a better intuition for how it works at the end.
Re: Cloudlflare builds OAuth with Claude and publishes all the prompts
#533Earlier quoted context omitted.
At least for me, I'm fairly sure that I'm better at not adding security flaws to my code (which I'm already not perfect at!) than I am at spotting them in code that I didn't write, unfortunately.
They're different mindsets. Some folks are better editors, inspectors, auditors, etc, whereas some are better builders, creators, and drafters. So what you're saying makes sense. And I'm definitely on the other side of that fence.
You don't become a good editor, inspector, what have you, by having other people/machines write all the code for you. To become and, perhaps more relevant, to stay a good reviewer, you need to regularly write code from scratch to see how it works. On top of that, languages, frameworks and libraries change constantly and you need to write and execute and experiment with new code to see exactly how it behaves so that you can eventually review the code that uses these features. Good reviewers are not born good reviewers!
Re: Cloudlflare builds OAuth with Claude and publishes all the prompts
#534Earlier quoted context omitted.
I am not confident enough in this area to to report a vunrability, the networking alone probably makes timing impractical. I thought it was now practical to generate known prefix Sha256, so some information could be extracted? Not enough to compromise but the function is right there.
Learning a prefix of the hash doesn't really get you anywhere. The hash itself isn't a secret -- it could be published publicly without breaking the security model. You still need to derive a token that hashes to that value in full, and if you can do that then you've broken the hash algorithm by definition.
Say I got a memory dump from the client system. I don't know what is what but the secret is in their somewhere.
Filtering it down by the hash prefix locally is much leas likly to be detected then spamming the servers.
Re: Cloudlflare builds OAuth with Claude and publishes all the prompts
#535Re: Cloudlflare builds OAuth with Claude and publishes all the prompts
#536Earlier quoted context omitted.
Time spent typing is statistically 0% of overall time spent in developing/implementing/shipping a feature or product or whatever. There's literally no reason to try to optimize that irrelevant detail.
No it's not. It's close to 50%.
If that's the case for you, then let me tell you, you're doing something wrong. It might not be you, it might be your team, or organization, but this is definitely not a normal experience.
Re: Cloudlflare builds OAuth with Claude and publishes all the prompts
#537The commits are revealing. Look at this one: > Ask Claude to remove the "backup" encryption key. Clearly it is still important to security-review Claude's code! > prompt: I noticed you are storing a "backup" of the encryption key as `encryptionKeyJwk`. Doesn't this backup defeat the end-to-end encryption, because the key is available in the grant record without needing any token to unwrap it? I don’t think a non-expe…
I know I'm preaching to the masses here, but isn't this why PR are so important?
Re: Cloudlflare builds OAuth with Claude and publishes all the prompts
#538Earlier quoted context omitted.
It took me a few days to build the library with AI. I estimate it would have taken a few weeks, maybe months to write by hand. That said, this is a pretty ideal use case: implementing a well-known standard on a well-known platform with a clear API spec. In my attempts to make changes to the Workers Runtime itself using AI, I've generally not felt like it saved much time. Though, people who don't know the codebase as…
>I have found AI incredibly useful when I jump into other people's complex codebases, that I'm not familiar with. I now feel like I'm comfortable doing that This makes sense. Are there codebases where you find this doesn't work as well, either from the codebase's min required context size or the code patterns not being in the training data?
In haven’t seen that as a limitation because the agents also are able to grep for keywords to find files to explain things. So they don’t necessarily have to ingest the whole codebase into context.
Re: Cloudlflare builds OAuth with Claude and publishes all the prompts
#539Earlier quoted context omitted.
Of course they are. Force has a strong correlation with mass times acceleration. Objects at rest have a high chance of being observed to remain at rest. And so on.
Statistic is not the same as constant equations.
The equations were discovered by experiment and curve-fitting.