7 ms·
What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script
by appplication 3y ago
What was most surprising about this is not the fact that there is a group of people exploiting Stripe’s payments, but that the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks. And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves.
This author is jumping out of the frying pan and into the fire. ChatGPT is cool and all, but the fact that they’re trusting it to write critical code for handling their customers money speaks volumes. They’re incredulous at how they feel Stripe violated their trust in it to manage fraud, but then go ahead and blindly place it in another technology they don’t understand. The problem isn’t Stripe (though, yes, they should fix this), it’s the fact that they are just giving away trust and hoping for the best.
- pimpl 3y agoArticle author here. I carefully reviewed and tested the ChatGPT scripts before executing them. It helped me save a lot of time manually writing these scripts! I wouldn't say I lack technical expertise in this area, I'm just trying to use my time as efficiently as possible.
- BaseballPhysics 3y agoGenuinely curious: How much time would you say you saved prompting for and then carefully reviewing and testing those scripts for bugs, versus writing them yourself? And for context what's the average line count we're talking about here? Tens of lines? Hundreds?
- pimpl 3y agoI'd estimate it that it saved me a couple of hours tops. They were simple, self-contained scripts with at most 150 LOC.
- BaseballPhysics 3y agoInteresting! Thanks for the insight!
- appplication 3y agoGlad to see you active here in the comments. Apologies if my comment comes off harshly, my intent is not to tear you down. I think there is a lot of gray space when it comes to using LLMs for generating code. Your usage here is certainly interesting, and I appreciate the additional context and discussion you’ve been providing.
- pimpl 3y agoNo worries at all! I agree that there's probably lots of people blindly copying and running code from LLMs without any reflection. Just like it often happened with StackOverflow snippets before ChatGPT (to the point it became a meme). I'm definitely not one of them.
- kykeonaut 3y ago> I created a restricted key in Stripe with lowest possible permissions, and prompted ChatGPT to create a script to accept the chargebacks. From my understanding, it also seems that the author submitted a Stripe API key alongside the prompt to create the scripts. This is pretty much a big security no no regardless of the permissions of the key.
- hn_throwaway_99 3y agoI don't know why I see this type of invalid speculation so often. The author already responded that they reviewed the script and didn't post any sensitive data, so won't add more to that. I'd just state that tons of us use ChatGPT effectively and never blindly trust the outputs - for me ChatGPT is a starting point, not the final product. We're not all so daft as that lawyer who cut and pasted hallucinated case references into a legal brief without verifying them first.
- pimpl 3y ago100% agreed, this is how I always treat it and working on the problem from the article was not an exception from this rule. I share minimum input, and never trust the output blindly. It gets 50-60% of work done, and a really good basis for me to work on it. Especially when working with one-off, end-to-end relatively short scripts.
- hn_throwaway_99 3y agoThis has been my primary use case as well (usually for writing some scripts or where I need to solve an operational task quickly), and ChatGPT has saved me a ton of time with those tasks.
- flutas 3y ago> the author had ChatGPT write a script to automatically handle payments processing, specifically for chargebacks Feels like a mischaracterization tbh. He had it make a script to go through and accept the chargebacks for these accounts, not handle payment processing or do anything to the chargebacks other than click "accept" essentially. > And based on the context in the article, the author sounds like they lacked the technical skill to write or validate these scripts themselves. I also don't really get where you're getting that from. The author even said > I reviewed all of the scripts carefully, and also never shared any customer data, IDs, or API keys. I think I saved at least a couple hours compared to hand-rolling these tools manually!
- appplication 3y agoChatGPT is not capable of writing production quality code. Many (most) companies have internal policies against deploying any code written by an LLM. The point isn’t to slow devs down, but to mitigate risk. This is especially important in the customer/payments stack. This is not the right place to “save a couple hours”. Maybe if this was for some one-off offline analysis, sure. The fact that it works is insufficient proof that it was the right thing to do. Building a habit of relying on LLM generated code is an inherently risky practice, and ChatGPT will literally warn you against trusting its outputs. Sure, it lets you growth hack your way through sort term problems, but in the long term I’m not convinced this is responsible decision making at the current levels of LLM technology. Or maybe I’m just a Luddite, stuck in my old ways.
- mrdatawolf 3y agoMy current suggestion is to consider it the work of a just on-boarded intern. It will save you some time but you still need to walk thru the code to make sure it will work as intended.
- b112 3y agoMy experience has been it's faster to write code yourself, than via a just on boarded intern + review + fixes.
- wpietri 3y agoI'm a huge LLM skeptic, but I'd disagree with you here. I think using ChatGPT to write long-lived code for a serious application is a bad idea. But I think it's fine for somebody knowledgeable to use it for throwaway and first-draft stuff in areas that aren't their daily work. Here's the author in question: [edit: wrong Piotr Mierzejewski in tech, see below] He looks perfectly competent to me to evaluate the effects of some one-shot scripting code, so I think "giving away trust and hoping for the best" is a wild exaggeration of what actually went on.
- itscodingtime 3y agoI find it odd Chatgpt was mentioned at all. It was almost like an advertisement. I have read post linked here similar to this one, but I can’t recall another instance in which the author abruptly said they relied on stackoverflow to code something unless the content was a meta commentary on coding and debugging itself.
- pimpl 3y agoAuthor here. My intention was to show that you can use it to help you get going quickly for a very practical, one-off, and self-contained use cases. As I mentioned in other comments already, I did not trust it blindly and did not share any sensitive data with it. Definitely not an ad!
- TechBro8615 3y agoI can empathize with the author. The first time you write some code collaboratively with GPT and it actually works, you feel a burning need to shout about it. Because it's one of those moments where something "clicks" and you suddenly feel like you've discovered fire. Once you figure out how to work with them, it makes you excited for the future and you can clearly see where LLMs will fit permanently into your toolbelt. They're far from perfect now, and sometimes the time savings is a wash - you get instant specialized expertise that can produce code like a senior engineer, but you need to goad and coax it like it's a high maintenance intern. But the thinking power expended is still somehow lower - it's a new way of working with technology and deferring some of the grueling parts to the machine. This becomes especially obvious when the code requirements depend on an esoteric API or conventions that you'd normally need to spend time researching and manually enumerating.
- systems_glitch 3y agoSame initial reaction when I read that part :/ Let's see what the next level of voodoo programming looks like...
- TechBro8615 3y agoThis guy is operating a profitable business, creating value for customers, shipping features, and openly publishing details and learnings about the threats he mitigated. He used ChatGPT to generate scripts to help him throughout this process. I don't know if he's non-technical or if he just wanted to save some time, but frankly he should be commended for his hustle and get-shit-done attitude. These scripts were not determining life or death, or even making business critical decisions - they were filtering bulk data and making his life easier by producing results that are easily manually checkable, but save tons of time either coding the scripts or hiring a programmer to write them. To me it reads like a great example of where ChatGPT is most useful: as a force multiplier for time-constrained entrepreneurs who have a specific goal and need specialized knowledge for short periods of time (e.g. to write a script). It's now basically free and instant to produce what would previously require a multi-week process of sourcing, hiring and communicating with contractors to write a script that leads to the same end result. The kneejerk reaction to call this "surprising" or irresponsible, while understandable, gives major "get off my lawn" energy. This is the future and as coders we should support the increased self-sufficiency of non-technical people. If you want to adapt to the change then maybe think about how to improve the process for entrepreneurs of asking ChatGPT to write a script.
- chankstein38 3y agoThey really wanted us to know they used ChatGPT too. It felt unnecessary how often they mentioned "I got ChatGPT to write a script that did this" like.. ok?
- headsupftw 3y agoWhat are you even talking about? Read the blog post one more time, please.