Hacker News Reader

Comment by bko | Hacker News Reader

> I feel like if you can’t be bothered to write the code, at least document it yourself and write the marketing copy so I know you understand the product.

Do you not understand it?

This person doesn't owe you any work. He's providing a product for free and this is a reasonable enough description of the product.

> Did the LLM generate some amazing rm -rf somewhere, or another blunder that wrecks data I might care about?

I'm pretty sure at this point hand-crafted code is more likely to contain security bugs. The mythical "rm -rf" random LLM insertion is not a real threat. Every time I see stories about this kind of issue, it's almost always preceded by basically prompt poisoning.

View on HN

> The mythical "rm -rf" random LLM insertion is not a real threat. Every time I see stories about this kind of issue, it's almost always preceded by basically prompt poisoning.

It is real, typically happening when dumber models (haven't personally seen any of the SOTA ones on reasonable thinking/reasoning level do this) try to clean up stuff via bash and forget to assign a variable. Things like "rm -rf sessions/$id" without double-checking $id is actually defined, would do "rm -rf sessions/" and remove the entire directory. Add in more variables in a path like "rm -rf $HOME/projects/$user/$repo/$tmpdir" and the dumb models people think they can use for local coding, promptly removes a lot more than expected.

Not sure how people aren't already running these agents in an environment/sandbox where stuff like this wouldn't matter, locally or not, but some LLMs do truly accidentally delete stuff for people, without "prompt poisoning", I had it happen myself while testing Qwen3.8-27B (BF16) locally just a week or two ago, exactly as described above.

Just recently, Opus 4.8 almost deleted a bunch of important files (I caught the issue before) because it failed to consider that two-way-sync would delete files from my NAS if deleted locally.

Fable has done similar for me because it assumed intent that I wanted permanent deletion after moving folders. The bash script it wrote failed to copy the files and then deleted the originals. Not catastrophic in my case though

> This person doesn't owe you any work. He's providing a product for free

A product being free doesn’t make it exempt from criticism. It’s not about “owing” anybody work.

> and this is a reasonable enough description of the product.

It’s not a great idea to signal a lack of effort, nor is it wrong for users to pick up on that signal. This is the post-llm equivalent to spelling or grammatical errors.

> I'm pretty sure at this point hand-crafted code is more likely to contain security bugs.

LLMs produce code which is fairly ‘locally optimal’, so in good hands they can absolutely be used to build correct software. They also allow those with little to no experience* to cobble something together very quickly and easily while creating a ton of security holes. I think you might be underestimating how common the latter is.

* not to suggest this applies to the OP necessarily. Rather some extra wariness is necessary nowadays since the floor has been lowered so much.

> A product being free doesn’t make it exempt from criticism. It’s not about “owing” anybody work.

You can criticize it but your criticism is hallow

> It’s not a great idea to signal a lack of effort, nor is it wrong for users to pick up on that signal. This is the post-llm equivalent to spelling or grammatical errors.

Why should you put in effort to something that should be effortless? Why should I waste my time writing some inferior copy by hand?

> LLMs produce code which is fairly ‘locally optimal’, so in good hands they can absolutely be used to build correct software.

Humans produce code which is fairly ‘locally optimal’

Also, interesting you use ‘ as a quote rather than '. I notice these quotes are used with LLM generated text, as I can't find this on my keyboard.

> Why should you put in effort to something that should be effortless?

Why should it be effortless?

> Why should I waste my time writing some inferior copy by hand?

Have some faith in yourself :) If the LLM writing was superior then surely nobody would’ve noticed?

And to the question: because lack of care in one area implies that that the same approach might extend to other areas. Nobody’s forcing you, but it definitely sends a particular message.

> Humans produce code which is fairly ‘locally optimal’

I’m taking this to mean you find the phrasing vague. LLMs are good at avoiding the sort of fine-grained security bugs that you see in some human written code.

> Also, interesting you use ‘ as a quote rather than '. I notice these quotes are used with LLM generated text, as I can't find this on my keyboard.

Funny, but FYI a fair few mobile keyboards use non-ascii punctuation

Reply on news.ycombinator.com