AI Coding Without the Vibes
peterbloem.nl
peterbloem.nl
Code review can go much deeper now if you use AI to aggressively attack a PR combined with your human insight. Same for planning a feature:
Can I consolidate this logic to a shared function? Does the error surface to the user and are there any gaps? What preexisting functionality is affected by this PR? Can this query be made more efficient?
LLMs are great with focused questions, up and down abstraction layers and across all kinds of concerns. Stack up these focused concerns into a rich understanding of what you are doing or writing.
Understanding is the real output, code is the byproduct.
> You code and you have the AI check your work. Treat it like a reviewer. That’s my advice in a sentence.
Bro you're giving the same advice as the article
Well, I can't ask it for an overview of a system it can't see.
also
> I don’t follow all these religiously.
So if you need an overview of a system, you can and should provide access to the entire codebase. Even the rule itself says "preferably", not "don't ever". If you have different needs, you can always just look at it as a useful guideline. It's just a blog post by some rando on the internet, not the epiphany of AI coding's Ten Commandments.
Do I understand when I just let AI regurgitate the function and behavior of the code?
I agree. This is much better advice than what the article tries to do, which is to give best practices around how to use or not use AI to code.
This only applies to bad code. A formal programmic language beats an informal language anytime. Why on earth would you translate an unambiguous formal language to English?
> Is there a risk of data leaking here?
> Are permissions enforced downstream of this function?
If you trust AI to give you that answer, you are going to run into serious issues.
Why on earth are all the books about programming, science and math written in English (and other natural languages) instead of a formal one then?
Why on earth did comments even got invented?
Luckily genius programmer who understands formal programmic language and does not need weak comments to clarify why the world is not perfect, fixes the stupid looking code to be beautiful, opening company up to some really super neat, seemingly random bugs in one browser that nobody will understand for several months.
tldr: one important reason comments exist is to clarify why code you might expect to look another way looks the way it does, of course if the only reason it looks the way it does is this is the way the AI wrote it I guess I agree the comment is unnecessary.
I wasn’t talking about code comments, but why this commenter who professed the superiority of formal languages could only get his argument across in an informal language.
You still have to check the work and shouldn't trust it blindly, but in my experience it's pretty damn good.
Happy to share the implementation or package it up if anyone is interested.
Like, sure, there are some wildly different paradigms that can be difficult to switch between, especially if you don't have any prior exposure to that paradigm. But there are way more programming languages than there are paradigms, so odds are high that using another language will primarily use a paradigm you're familiar with. So the main difficulties are in using a new standard library (where "using a new library" is a skill software engineers exercise every time they pull in a new library as a dependency), and some syntax quirks (of which tend to be extremely minor differences in the scope of languages used for industry).
It's hard for me to see "I'm not an X language engineer" as anything other than directly rejecting the task that using X language would enable. Especially now, when we can directly ask "what does this line / block of code do?" and get a detailed breakdown of exactly what's going on, on demand.
This is how you wind up with code riddled with vulnerabilities and anti-patterns, with extremely bad performance imo
It's so easy to say "I know Java and C# is basically the same" and then wind up using built ins that are deprecated, using libraries that contain vulnerabilities, or whatever other mistakes
Maybe that's "good enough" for your usecases, but I've never found that it's a good idea to just assume I can switch languages for anything reasonably complex without some growing pains. Sometimes very big ones
If students of the 70s or today pretended they didn’t exist up to a certain point when they needed them to move forward, like bioinformatics or something, they 100% would be better off. There is plenty of research on off loading thinning providing a worse understanding of the material - eg side rules proving a better understanding than calculators.
I think AI might be more of a problem, at least for some skills because it is not just doing a small unit of work. its more like the problem of doing more complex calculations. An example I have come across with calculators is students learning statistics without knowing how to calculate a variance, because they just put the numbers into a calculator. There is a failure there to learn the concept - they do not really know what a variance or SD is. I can imagine AI doing a lot of that.
You learn stuff by heart, so that when you mess up with the calculator you have a feel that stuff has gone wrong
This is, of course, after years of learning without cheatsheets and calculators, where you learned to intuit if a number actually made sense when spat out by the calculator, and when you learned when and how you're supposed to use a certain formula. For example when doing any kind of Physics or Chemistry you're working with numbers that don't make intuitive sense (and often are quite literally imaginary!), like things that are to the ^32 or ^-28, but you still learn to intuit whether the relative scales of the numbers make sense with what you'd expect to see given similar prior experience.
As for the formulae, even with the cheatsheets if you didn't know why or how some of the formulae were supposed to be used, well good luck to you because just knowing the formula isn't even half the picture. I just dug up an example formula reference sheet and despite definitely knowing a lot of the stuff there, I haven't practiced a lot of the maths involved here in years so I wouldn't be able to get anywhere close to answering some of these questions despite my access to the formulae.
AI takes all of this to an extreme. People simply plug in their question into their chat interface of choice and don't even bother reading the output even slightly. It'd be like seeing that the mass of a planet is x^-27 and not realizing you must've input something wrong because you simply trust the calculator without any understanding of what numbers you're plugging in.
[1] - As an example of what I had - https://pmt.physicsandmathstutor.com/download/Maths/A-level/...
> the term “vibe-coding” suggests a kind of laissez-faire attitude where you don’t really care about the outcome and you’re just having fun. That’s what the phrase meant when it was coined, but the world has moved on. In many companies professional programmers are using AI in such a way that it’s impossible to imagine that they are also reading the resulting code in detail. This is what modern vibe-coding is. Deferring to the AI, not worrying about the individual lines of code, and keeping an eye on whether the code passes its tests and throws up any problems in production.
This way of working is the only one that justifies the trillion-dollar bet on the AI industry. I agree, this method should be called vibe-coding.
I don't care which words we use, but they should separate this sort of empirically-minded work (versus the rationalism of typical development) from just dropping a few sentences into the prompt and crossing your fingers.
Yeah, I understand that this testing-oriented constraint method is what AI coding enthusiasts are pitching. Sure, it's different from pure vibe-coding as originally defined, but nobody is seriously suggesting professionals should do pure vibe-coding anyway. It's a strawman. The word fits.
My current approach is "ask for very small diffs" + "review them very carefully".
I'm not working a job though, I'm working on a multiplayer game.
Main findings: The frontier models can't reliably modify Pong without breaking it, so their skill appears to be quite domain-specific. (OK, to be fair, neither can I half the time!) This is probably because they are "time blind". I had one model try to test a game by running it at 0.1 frames per second and shoving each frame in the vision API...
If you leave any room for a misunderstanding, they will laser in on do it and do the stupidest thing possible. If you're not checking everything carefully, you will discover this later, and you will cry.
Formal proofs, oddly enough, do not improve the situation: they will simply prove mathematically that the absurd and pointless and backwards implementation is completely without defects. (It obviously does help within an implementation, though.)
They can't formally prove what the hell you meant when you told them to build something. That job remains frustratingly human!
Current dissatisfaction: (1) Harnesses are designed for super bloated codebases (i.e. designed to load as little context as possible) which make them pretty clunky for small repos and small edits. (I had a Surgical Edit Tool I need to bring back...), (2) Current LLMs are anal about verifying the most trivial change, even without prompting, even if it's impossible for them to verify it because they're blind so they start measuring pixel data in Python... Both of which eat up Speed and Cost, taking the work even further from Realtime/Interactive to Tedious/Sad.
I wonder if that trick about prompting it to write like a 5th grader* would help here. Keep it simple!
*A trick which allows it to pass for human 70% of the time...
I've made a half-dozen or so DSLs with LLM tools over the last couple of years. I've learned a lot about the architecture of parsers, semantic analysis, editor services, LSPs, DAP, etc. I have a new set of skills! I'm able to focus more on the syntax and semantics languages themselves and the overall developer experience. This would have taken literal man-years of development to do otherwise.
For my hand-rolled craft I'd much rather sit down at the piano or pick up my guitar!
Numerous attempts have been made in past 70 years, but we landed on the compromise that is high level programming languages with their (mostly) well-defined syntax and semantic rules.
If you look outside of the world of programming you'll find that the same is true for every craft and profession that requires precision and unambiguity. Cooking, logistics, military, carpentry, mechanical engineering, law, medicine, etc. all have their own domain specific languages for describing tasks, procedures, and tools. Heck, even sufficiently large organisations have their own internal languages and terms for that reason.
SQL is the worst offender here: LLMs are very good at remembering its awful syntax, but very bad at writing nontrivial queries.
However, I think the points about not allowing the AI to run anything take it too far. A good code reviewer, in my mind, will check out your PR branch, run your tests, and ideally try to break them. An agent can run your code in its own sandbox, try variations to see what breaks, etc.
Software quality has far more extrinsic reasons for mattering than bread does. Bread is not my only interface for interacting with many government services. It cannot leak personal information. It is never makes life-or-death decisions. Etc.
Core modules: Coded by myself, AI reviews and AI to discover/learn.
Stuff I don't care about Craft: API layer, CLI layer, Smoke tests, Integ tests - Dial AI heavy, and lighter human reviews accordingly
Also, with AI the coding process converges on developing a good spec and discussing the architecture tradeoffs first. It often doesn't see architectural opportunities to get the best performance, so that's still your own job.
50 years ago the main barrier was access to hardware - computers were big, expensive, and not easy to come by for average people.
30 years ago, the biggest hurdle was access to resources: you had to spend a fortune on books that quickly became obsolete or had to wait for your local library to get them for you.
Today, you basically have everything - up-to-date free reference material on pretty much everything in an instant, cheap and accessible hardware (no need for high-end stuff), great online tutorials and interactive courses, message boards, the works.
But then you also have a machine that completely removes the need to put in the effort required to actually learn and hone your skills. Human psychology always seeks shortcuts and more discipline than ever is needed to not give up and have the machine do the thinking for you instead.
Proficient developers are getting pressured into outsourcing their craft and skills to the machine, thus deskilling quickly. Juniors never get the chance to become proficient in the first place - either because they're not getting hired to begin with, or because they succumb to the siren song of the machine...
I've recently settled on Deepseek4 for one of my projects, and had it review other code generated by other models, and .. yeah, that was quite eye-opening. Someone in the frontier-models part of the world is definitely paying attention to the AI slop generated by the other models, because having one AI checking the results of another AI has been quite fruitful, lately.
The security argument is the strongest part of the post, and I don't disagree with it, but what it buys you is the review, and a review catches what you missed, whoever typed the characters. None of the ten dogmas follow from that.
My general approach is to design beforehand, do an adversarial review with AI, socialize it with humans (if needed), generate a plan, and start working item by item. Always keeping me, the human, in the loop (not that `/loop`), going through the steps generating code. Finally, a manual review and one AI adversarial review of the feature branch in a clean context, going section by section manually and discussing anything relevant, and off you go.
Writing code by hand feels great, but even local models can generate fine code. Deterministic linters and quality checks are what keep the quality in line. You can always modify things as long as you're in the process, but at the end of the day, you'll review more than you write. We're closer to being the assembly line's inspector than the crafters we once thought we were.