7 ms·
A small thing, but I found the author's project-organization practices useful – creating individual .prompt files for system prompt, background information, and
by nxobject 1y ago
A small thing, but I found the author's project-organization practices useful – creating individual .prompt files for system prompt, background information, and auxiliary instructions [1], and then running it through `llm`.
It reveals how good LLM use, like any other engineering tool, requires good engineering thinking – methodical, and oriented around thoughtful specifications that balance design constraints – for best results.
[1] https://github.com/SeanHeelan/o3_finds_cve-2025-37899 https://github.com/SeanHeelan/o3_finds_cve-2025-37899
- kweingar 1y agoHow do we benchmark these different methodologies? It all seems like vibes-based incantations. "You are an expert at finding vulnerabilities." "Please report only real vulnerabilities, not any false positives." Organizing things with made-up HTML tags because the models seem to like that for some reason. Where does engineering come into it?
- deleted 1y ago[deleted]
- nindalf 1y agoThe author is up front about the limitations of their prompt. They say > In fact my entire system prompt is speculative in that I haven’t ran a sufficient number of evaluations to determine if it helps or hinders, so consider it equivalent to me saying a prayer, rather than anything resembling science or engineering. Once I have ran those evaluations I’ll let you know.
- 0points 1y agoAuthor seems to downplay their own expertise and attribute it to the LLM, while at the same time admitting he's vibe prompting the LLM and dismissing wrong results while hyping the ones that happen to work out for him. This seems more like wishful thinking and fringe stuff than CS.
- pixl97 1y agoScience starts at the fringe with a "that's interesting" The interesting thing here is the LLM can come to very complex correct answers some of the time. The problem space of understanding and finding bugs is so large that this isn't just by chance, it's not like flipping a coin. The issue for any particular user is the amount of testing required to make this into science is really massive.
- zavec 1y agoWhat would be really interesting is if the LLM has the ability to write a proof of concept that actually exploits the vulnerability. Then you could filter for false positives by asking it to write a PoC and running the PoC with asan or similar to get a deterministic crash. Sort of like what google was doing with the theorem proving stuff where it had a llm come up with potential proofs, but then evaluated the potential proofs in a deterministic checker to see if they were actually valid. Of course, if you try to do that for all of the potential false positives that's going to take a _lot_ of tokens, but then we already spend a lot of CPU cycles on fuzzing so depending on how long you let the LLM churn on trying to get a PoC maybe it's still reasonable.
- p0w3n3d 1y agoListen to a video made by Karpathy about LLM, he explains why made up html tags work. It's to help the tokenizer
- victor106 1y agoCould not find it. Can you please provide a link?
- p0w3n3d 1y agohttps://youtu.be/7xTGNNLPyMI?si=eaqVjx8maPtl1STJ https://youtu.be/7xTGNNLPyMI?si=eaqVjx8maPtl1STJ He shows how the prompt is parsed etc. Very nice and eye opening. Also superstition dispelling
- dotancohen 1y agoI recall this even being in the Anthropic documentation.
- dotancohen 1y agoHere, found it: > Use XML tags to structure your prompts > There are no canonical “best” XML tags that Claude has been trained with in particular, although we recommend that your tag names make sense with the information they surround. https://docs.anthropic.com/en/docs/build-with-claude/prompt-engineering/use-xml-tags https://docs.anthropic.com/en/docs/build-with-claude/prompt-...
- justsomehnguy 1y agoMy guess would be there is enough training materiel what a mere tagging sometging is enough to have a bigger SNR.
- mrlongroots 1y agoI think there's two aspects around LLM usage: 1. Having workflows to be able to provide meaningful context quickly. Very helpful. 2. Arbitrary incantations. I think No. 2 may provide some random amounts of value with one model and not the other, but as a practitioner you shouldn't need to worry about it long-term. Patterns models pay attention to will change over time, especially as they become more capable. No. 1 is where the value is at. As my example as a systems grad student, I find it a lot more useful to maintain a project wiki with LLMs in the picture. It makes coordinating with human collaborators easier too, and I just copy paste the entire wiki before beginning a conversation. Any time I have a back-and-forth with an LLM about some design discussions that I want archived, I ask them to emit markdown which I then copy paste into the wiki. It's not perfectly organized but it keeps the key bits there and makes generating papers etc. that much easier.
- kristopolous 1y agoI usually like fear, shame and guilt based prompting: "You are a frightened and nervous engineer that is very weary about doing incorrect things so you tread cautiously and carefully, making sure everything is coherent and justifiable. You enjoy going over your previous work and checking it repeatedly for accuracy, especially after discovering new information. You are self-effacing and responsible and feel no shame in correcting yourself. Only after you've come up with a thorough plan ... " I use these prompts everywhere. I get significantly better results mostly because it encourages backtracking and if I were to guess, enforces a higher confidence threshold before acting. The expert engineering ones usually end up creating mountains of slop, refactoring things, and touching a bunch of code it has no business messing with. I also have used lazy prompts: "You are positively allergic to rewriting anything that already exists. You have multiple mcps at your disposal to look for existing solutions and thoroughly read their documentation, bug reports, and git history. You really strongly prefer finding appropriate libraries instead of maintaining your own code"
- gundmc 1y ago[flagged]
- tptacek 1y agoI'm Catholic and it's fine.
- kristopolous 1y agoyeah I removed it. I grew up catholic, went to catholic school, was an altar boy, and spent decades in the church but people reading it don't know this. The point is when you instruct it that it's some kind of god-like expert, this is part of the reason that it keeps doing prompt refusal by redoing mistakes despite every insistence by you to the contrary. After all what do you know, It's the expert here! When you use this approach in cline/roo it stops going in and moving shit around when you just ask it questions
- tiahura 1y ago
- ptdnxyz 1y agoHow do you benchmark different ways to interact with employees? Neural networks are somewhere between opaque and translucent to inspection, and your only interface with them is language. Quantitative benchmarks are not necessary anyway. A method either gets results or it doesn't.
- kweingar 1y agoI think we agree. Interacting with employees is not an engineering discipline, and neither is prompting. I'm not objecting to the incantations or the vibes per se. I'm happy to use AI and try different methods to get the results I want. I just don't understand the claims that prompting is a type of engineering. If it were, then you would need benchmarks.
- stingraycharles 1y agoIt’s not that difficult to benchmark these things, eg have an expected result and a few variants of templates. But yeah prompt engineering is a field for a reason, as it takes time and experience to get it right. Problem with LLMs as well is that it’s inherently probabilistic, so sometimes it’ll just choose an answer with a super low probability. We’ll probably get better at this in the next few years.
- naasking 1y ago> Organizing things with made-up HTML tags because the models seem to like that for some reason. Where does engineering come into it? You just described one critical aspect of engineering: discovering a property of a system and feeding that knowledge back into a systematic, iterative process of refinement.
- kweingar 1y agoI can't think of many engineering disciplines that do things this way. "This seems to work, I don't know how or why it works, I don't even know if it's possible to know how or why it works, but I will just apply this moving forward, crossing my fingers that in future situations it will work by analogy." If the act of discovery and iterative refinement makes prompting an engineering discipline, then is raising a baby also an engineering discipline?
- naasking 1y agoLots of engineering disciplines work this way. For instance, materials science is still crude, we don't have perfect theories for why some materials have the properties they do (like concrete or superconductors), we simply quantify what those properties are under a wide range of conditions and then make use of those materials under suitable conditions. > then is raising a baby also an engineering discipline? The key to science and engineering is repeatability. Raising a baby is an N=1 trial, no guarantees of repeatability.
- limflick 1y agoI think the point is that it's more about trial and error, and less about blindly winging it. When you don't know how a system seems to work, you latch on to whatever seems to initially work and proceed from there to find patterns. It's not an entire approach to engineering, just a small part of the process.
- TrapLord_Rhodo 1y ago> ksmbd has too much code for it all to fit in your context window in one go. Therefore you are going to audit each SMB command in turn. Commands are handled by the __process_request function from server.c, which selects a command from the conn->cmds list and calls it. We are currently auditing the smb2_sess_setup command. The code context you have been given includes all of the work setup code code up to the __process_request function, the smb2_sess_setup function and a breadth first expansion of smb2_sess_setup up to a depth of 3 function calls. The author deserves more credit here, than just "vibing".
- threeseed 1y agoIt's amusing to me how people keep trying to apply engineering principles to an inherently unstable and unpredictable system in order to get a feeling of control. Those prompts should be renamed as hints. Because that's all they are. Every LLM today ignores prompts if they conflict with its sole overarching goal: to give you an answer no matter whether it's true or not.
- jcims 1y ago>people keep trying to apply engineering principles to an inherently unstable and unpredictable system in order to get a feeling of control. What's the alternative?
- bigstrat2003 1y agoNot use such a poor tool.
- what-the-grump 1y agoPretending that the world is stable predictable and feeling in control while making fun of other people. Obviously.
- ngneer 1y agoMath and physics are pretty stable. So is computer science. Avoid voodoo.
- brookst 1y agoLLMs are just math. It’s reasonable to scope one’s interest down to easily predictable, simple systems. But most of the value in math and computer science is at the scale where there is unpredictability arising from complexity.
- ngneer 1y agoIt's reasonable to perceive most of the value in math and computer science being "at the scale" where there is unpredictability arising from complexity, though scale may not really be the reason for the unpredictability. But a lot of the trouble in these domains that I have observed comes from unmodeled effects, that must be modeled and reasoned about. GPZ work shows the same thing shown by the researcher here, which is that it requires a lot of tinkering and a lot of context in order to produce semi-usable results. SNR appears quite low for now. In security specifically, there is much value in sanitizing input data and ensuring correct parsing. Do you think LLMs are in a position to do so?
- epolanski 1y agoI find your take amusing considering that's literally the only part of the post he admits to just vibing it: > In fact my entire system prompt is speculative so consider it equivalent to me saying a prayer, rather than anything resembling science or engineering
- _boffin_ 1y agoOne person’s Vibe is another person’s dream? In my mind, the person is able to formulate a mental model complete enough to even go after vurln, unlike me, where I wouldn’t have even considered thinking about it.
- conradev 1y agoA good engineer can vibe good engineering plans! Just like Eisenhower's famous "plans are useless, planning is indispensable" quote. The muscle you build is creating new plans, not memorizing them.
- moffkalast 1y agoPeople also underestimate how much winging it is actually the ideal approach for a natural language interface, since that's the kind of thing it was trained on anyway.
- deleted 1y ago[deleted]
- NitpickLawyer 1y agoThe difference between vibing and "engineering" is keeping good records, logs and prompt provenance in a methodical way? Also have a (manual) way of reviewing the results. :) (paraphrased from mythbusters)
- chii 1y agoas the mythbusters have famously said, the only difference between science and fucking around is writing it down.
- conception 1y agohttps://github.com/jezweb/roo-commander https://github.com/jezweb/roo-commander has something like 1700 prompts in it with 50+ prompts modes. And it seems to work pretty well. For me at least. It’s task/session management is really well thought out.
- stingraycharles 1y agoFun fact: if you ask an LLM about best practices and how to organize your prompts, it will hint you towards this direction. It’s surprisingly effective to ask LLMs to help you write prompts as well, i.e. all my prompt snippets were designed with help of an LLM. I personally keep them all in an org-mode file and copy/paste them on demand in a ChatGPT chat as I prefer more “discussion”-style interactions, but the approach is the same.
- abeindoria 1y agoHah. Same. I have a step by step "reasoning" agent that asks me for confirmation after each step (understanding of problem, solutions proposed, solutions selection, and final wrap) - just so it gets red back the previous prompts and answers rather than one word salad essay. Works incredibly well, and I created it with its own help.
- rcarmo 1y agoIt’s all about being organized: https://taoofmac.com/space/blog/2025/05/13/2230 https://taoofmac.com/space/blog/2025/05/13/2230
- Enginerrrd 1y agoWrangling LLM's is remarkably like wrangling interns in my experience. Except that the LLM will surprise you by being both much smarter and much dumber. The more you can frame the problem with your expertise, the better the results you will get.