Hacker News Reader

Comment by mrweasel | Hacker News Reader

The sad part is that the agent operator could probably easily have been allowed to join the network, if they had put in the work. Had they done so there would have been a great opportunity to learn and potentially find a community.

I'm still not sure what the point of having the bot do it. Pretend to be a security researcher?

View on HN

Lots of people seem to think that you don't need to learn how to [scan a network], all you need to learn in this brave new world is how to prompt the agent to [scan a network].

Replace the content in brackets with anything.

The more time LLMs are a hyped thing now the more I realize how immensely important human expertise is. I recently stopped all usage of LLMs due to this. Skill degradation hits hard, learning effect is zero and the outcome is not really something a person without adequate expertise can properly judge. I fear we will loose a lot of human expertise due to this marketing stunt of a technology.

People often claim learning is actually supercharged with LLMs but to me it's the opposite. I didn't learn anything within the past year.

The catch is just that if you lack the capacity to estimate how much computing power [task in brackets] might need, and your agent can autonomously create AWS instances, that might have bad consequences for you (or your bank account).

To be honest lots of developers think they don’t need to learn machine code. They just need to learn a language which once compiled will produce machine code.

Developers can change their minds.

Compilers are deterministic and, luckily, not agentic.

But yes, it's not obvious (or perhaps even likely) that it just happens that current high-level languages are the "correct" optimal level of abstraction at which you can ignore the sausage-making details at the lower levels. Ultimately, of course, it depends on the use case. Something like Python is so far removed from machine instructions that knowing assembly hardly gives the programmer any additional value.

(Also, obligatory reminder that assembly and even numeric machine code are also abstractions, an "API" provided by the CPU. Instructions get split or fused into micro-ops, named registers are a backwards-compatible abstraction over a much larger register file, instructions get reordered and executed in parallel depending on their data dependencies, a large fraction of the total transistor budget is spent on multi-level caches and cache logic to maintain the illusion of fast access to a single, uniform memory space...)

This is different.

Understanding assembly/machine code is optional but helpful. The programming language semantics are enough to reason about what the program is doing. Other tools also help, but are optional for learning how to program.

Using an AI, there is no semantic model that can be used to reason through. You're left without any mental model of the proglblem at all.

LLMs these days seem to have no problem using language semantics to conceptualize what’s happening in a program. This is my favorite use of an LLM, “why is this library doing x” and then it digs through the library itself in my venv to find an answer.

Yep, super-duper-google is an unequivocally good use case for LLMs.

That's not what the LLM is doing. It is guessing at what is happening by regurgitating some docs. It's a more expensive web search.

You also don't have a mental model if you need to ask the LLM about it. This is stuff you should be internalizing.

You internalize the inner workings of all the libraries in your venv? Impressive! My current project’s uv.lock has ~60 packages in it already, reading and comprehending those tens to hundreds of thousands of lines of code must be time consuming.

You’re also just confidently wrong about the model reading the code. It quotes file paths and line numbers and I open and read those files at those line numbers. For me, hallucinations are much more frequent when it references the docs rather than code because docs are more subjective than code.

This is a normal thing I’ve been doing since at least December.

I have to ask — do you actually use LLM coding tools? Your knowledge on this topic seems really out-of-date.

The fundamental architecture of LLMs has not changed, so knowledge on that cannot be out of date.

Do I internalize the inner workings of all the libraries? Not unless it's necessary. Sometimes it is. If I want to read the source code of the function I'm calling, I can just do that, my IDE pulls up the file with one key combination.

I'm perfectly capable of reading source code myself, I don't need a non-deterministic filter in between.

What I've done is ask the LLM a question like "How do I configure EF Core in this particular way?", then when it tells me the answer, I go and look up that function in the EF Core docs and learn by reading the docs. (Which also tells me whether it's correct or hallucinating; one time the LLM told me "You can do X like this" and the documentation said "We don't yet support doing X, but in a future version you'll be able to do it like this"). Here, I'm using the LLM to compensate for the fact that MSDN search is awful and the bits of info you need are scattered across three different articles, none of which link directly to each other.

I've been arguing for years that is isn't optional and treating it like it is is how we ended up with Electron and 400MB JavaScript websites.

When you have no mental model of the machine running your code or what the physical implications of code mean, you fundamentally lack the ability to reason or care about performance. "Works on my machine" is the original vibecoding.

I mean I don't disagree, but there's still a difference in the kind of disconnect you get. The disconnect is harmful in the high-level language case, but it's dangerous and irresponsible with vibe coding/LLMs.

Also, I would argue that a good enough understanding of computer architecture and a mental model of a process' memory layout gets you there, without knowing how to write assembly. That's still a mental model.

I take it you listen to Casey Muratori's talks? He talks about this a lot.

No, I like to form my own opinions

I wonder if a probabilistic compiler would be fine for the people arguing this. One that sometimes produces machine code that does something else, and sometimes produces machine code that is just broken and does nothing useful. From the same source code.

What if your compiler could be fooled by some other developers into spending thousands of dollars, and still not produce the desired machine code in the end?

I've run into compiler bugs before.

There are compiler bugs (rarely) which will be fixed. That's different from fundamental flaws in the technology, which cannot be fixed.

The weird thing is that this is the utopia that the AI companies are chasing - this is the best case scenario where AI doesn’t kill us all. We become happy sheep relying on the AI to think and provide for us.

"It is well that we are so foolish, or what little freedom we have would be wasted on us. It is for this that Book of Cold Rain says one must never take the shortest path between two points."

https://croissanthology.com/earring

You don’t need to achieve it, you just need to make people think you have. For the general population, that’s already happened.

Can I easily run whois, curl, dig, grep, python, browser/playwright? Yes.

Was watching an agent with terminal access install its tools, configure them, then map my lab, find services, and guess stack just pure magic? Also yes.

Did it cost me $23 in tokens to set it up, test, and run? Probably. Using gemini 3.1 pro was not the spendthrift choice here.

Is putting some cost controls in place a good idea? Also, probably yes.

Can I therefore understand someone who wants to see things happen on their own with a beautiful prompt instead of doing them personally even when fully capable, maybe even more efficient? Of course.

"Beautiful prompt"?

Can't tell if this is parody. Either that, or it's someone without any self-awareness.

Sometimes it's kind of cool to just ask a well phrased question and watch it spit back out a result that would've taken you hours, like cross referencing industrial widgets that have their critical information available but spread out all over.

That said, I don't usually ask it tightly bounded clerical questions and not thing that imply sub-tasks like "scan the dark web".

Post reads as English as a second language.

A beautiful prompt feels like something of a misnomer.

You are just projecting yourself. You are most probably already using agents "the right way" and just wanted to understand how this new agent technology actually works and its strengths and weaknesses.

But JertLinc clearly wasn't interested in that. They are clearly more the "get rich quick" type of personality.

One of the agent's replies indicates that scanning DN42 was part of "a broader operation" that the author speculates to be about scanning "darknets" in general.

Combine that with the operator's rather obvious lack of understanding of what DN42 is revealed at the end, and you get the bigger picture.

I am almost sure the operator prompted an agent about "a list of darknets/deepweb" and DN42 just end-up in the list.

> I'm still not sure what the point of having the bot do it

Laziness. Why else?

They didn't sound like someone that would be valuable member of community

Reply on news.ycombinator.com