Hacker News Reader

Comment by zenoprax | Hacker News Reader

> witr is successful if users trust it during incidents.

> This project was developed with assistance from AI/LLMs [...] supervised by a human who occasionally knew what he was doing.

This seems contradictory to me.

View on HN

The last bit

> supervised by a human who occasionally knew what he was doing.

seems in jest but I could be wrong. If omitted or flagged as actual sarcasm I would feel a lot better about the project overall. As long as you’re auditing the LLM’s outputs and doing a decent code review I think it’s reasonable to trust this tool during incidents.

I’ll admit I did go straight to the end of the readme to look for this exact statement. I appreciate they chose to disclose.

If you're capable of auditing the LLM’s outputs and doing a decent code review then you don't need an LLM.

Nobody who was writing code before LLMs existed "needs" an LLM, but they can still be handy. Procfs parsing trivialities are the kind of thing LLMs are good at, although apparently it still takes a human to say "why not using an existing library that solves this, like https://pkg.go.dev/github.com/prometheus/procfs"

> Procfs parsing trivialities are the kind of thing LLMs are good at

Have you tried it? Procfs trivialities is exactly the kind of thing where an LLM will hallucinate something plausible-looking.

Fixing LLM hallucinations takes more work and time than just reading manpages and writing code yourself.

Claude code can read manpages too

It cant "read" anything. It can include the man page in the prompt, but it can never "read" it.

If the output is working code I don't really care whether it's reading, "reading", or """reading"""

If I'd ever feel the urge to misengineer a rube goldberg contraption to manage my vibe coder LLM output I'll get back to you.

But at the moment I feel like all that sounds suspiciously like actual work.

Sometimes LLMs will give a "why not..." or just mention something related, that's how I found out about https://recoll.org/ and https://www.ventoy.net/ But people should probably more often explicitly prompt them to suggest alternatives before diving in to produce something new...

Neither do you need and IDE, syntax highlighting or third party libraries, yet you use all of them.

There's nothing wrong for a software engineer about using LLMs as an additional tool in his toolbox. The problem arises when people stops doing software engineering because they believe the LLM is doing the engineering for them.

I don't use IDEs that require more time and effort investment than they save.

You mileage may vary, though. Lots of software engineers love those time and effort tarpits.

I don't know what “tarpit” you're talking about.

Every IDE I've used just worked out of the box, be it Visual Studio, Eclipse, or anything using the language server protocol.

Having the ability to have things like method auto-completion, go-to-definition and symbol renaming is a net productivity gain from the minute you start using it and I couldn't imagine this being a controversial take in 2025…

> I don't know what “tarpit” you're talking about.

Really? You don't know software developers that would rather futz around with editor configs and tooling and libraries and etc, etc, all day every day instead of actually shipping the boring code?

You must be working in a different industry.

need and can use are different things.

right, we don't need a lot of things, yet here we are

Thank you, yes I added it in jest and still keeping it for sometime. It was always meant to be removed in future.

I'd not trust any app that parses /proc to obtain process information (for reasons [0]), specially if the machine has been compromised (unless by "incident", the author means another thing):

https://github.com/pranshuparmar/witr/tree/main/internal/lin...

It should be the last option.

[0] https://news.ycombinator.com/item?id=46364057

I’m struggling with the utility of this logic. The argument seems to be "because malware can intercept /proc output, any tool relying on it is inherently unreliable."

While that’s theoretically true in a security context, it feels like a 'perfect is the enemy of the good' situation. Unless the author is discussing high-stakes incident response on a compromised system, discarding /proc-based tools for debugging and troubleshooting seems like throwing the baby out with the bathwater. If your environment is so compromised that /proc is lying to you, you've likely moved past standard tooling anyway.

Fair enough! That line was meant tongue‑in‑cheek, and to be transparent about LLM usage. Rest assured, they were assistants, not authorities.

No to me. It just has to demonstrate to work well, which is plenty possible with a developer focused on outcome rather than process (though hopefully they cared a bit about process/architecture too).

Regardless of code correctness, it's easy enough for malware to spoof process relationships.

I agree, the LLM probably has a much better idea of what's happening than any human

Reply on news.ycombinator.com