Hacker News Reader

Comment by anygivnthursday | Hacker News Reader

> Security-wise, I think the latest cyber models are better than me anyway at finding vulnerabilitates and pentesting such features.

I don't doubt that, but they are equally good in making mistakes, over-engineering, or adding things you never asked for. They have all sorts of patterns in their training data from excellent to inadequate and I find them challenging to guide them consistently in one direction. Also with questions and tests, they can add something extra you didnt need and you dont know about, so your scrutinizing questions and test cases could miss that.

At least for myself, I didnt find them reliable enough yet to do what you describe and just not look at the code at all.

View on HN

As someone who has an ide open with claude/codex running, I can never imagine leaving security up to models.

Models have found vulnerabilities that i wasnt aware of sure, but their fixes to the bugs they found often included "overengineering". In this case by "overengineering" i mean optimizing for passing test cases related to said vulnerability they found. eventually i have to step in to make things coherent and make sure that future agent can look at this part of my code and copy it to not introduce that particular class of vulnerability. Otherwise if i dont do that similar vulnerability and codesmell keep appearing throughtout the codebase.

I have increasingly automated encrypting and rotating secrets and setting permissions on them including better network level practices. Thanks to AI which helped me quickly implement those. So security wise i am better because of AI? But I also attribute it to my know how rather than the AI because I have never seen AI suggest robust but simple security postures.

This app[0] is entirely "vibe-coded", started on bolt.new which was like the OG way to vibe code and slowly improved over 1-2 years using various models.

I have no idea how the code looks like, and barely even tested the app entirely, because it is still not released yet, but I do think a lot about new features, tweaks, improvements, etc. Years of programming and game development did help, but I don't think anymore that code is relevant, as long as it looks ok and feels good.

[0]: https://ultimidi.com

>not released yet

>barely even tested

So the lowest stakes possible and you have absolutely no idea what bugs are waiting.

Sort of, it's more of a heurisric of bugs found so far. There are very rarely any bugs, most of the changes I request are for tweaks/logic changes, not bug fixes. Usually things just work.

Also, I barely tested and kept changing things simply because of this: whatever I ask for, seems to work as expected.

You rarely find bugs if you rarely test the code.

It's a heurisric though.

It's one thing to test once and find 10 bugs, and another to test 10 times and find 1 bug.

> I have no idea how the code looks like, and barely even tested the app entirely, because it is still not released yet

This is worded as if knowing how the code works and testing it is hinged on it being released.

No, it was about testing only. I will only do a full test of the app when it's ready to be released, otherwise it makes no sense, as the app/product/flow still changes a lot. It's like prototyping a game, you try it a few times, see what's fun, what's not, and keep iterating. Only once you think it's good enough, you can start fully testing and polishing it.

Even after release, I don't see reasons to check the code if everything works and people are happy with the app.

You know your app just immediately crashes to a blank screen the minute you enter a name, or finish a lesson right?

Firefox?

Firefox had an unsupported missing WebAudio. It should be fixed now, and I've updated my workflow to also test on Firefox. Let me know if the crash was in a different browser (not Firefox).

Right, I missed that context that this was about your own app still in getting the idea right/prototype phase. I was talking more in general and would be quite concerned if with today's LLMs it was my bank/government backend system, handling my financials and personal data, written without no one ever looking at the code.

It’s equally good at catching mistakes as it is at making them. So you put it in a loop, write code, make mistakes, catch mistakes, write code, make mistakes… etc. Eventually it converges and stabilizes. That process can take weeks. So the question is: when is it worth it versus not?

Reply on news.ycombinator.com