4 ms·

The author goes into great detail about how he looked at my commit log[0] where I used AI, and he found it "nauseating" and concluded he'd never want to work th

The author goes into great detail about how he looked at my commit log[0] where I used AI, and he found it "nauseating" and concluded he'd never want to work that way. I'm certainly not going to tell anyone that they're wrong if they try AI and don't like it! But this guy... did not try it? He looked at a commit log, tried to imagine what my experience was like, and then decided he didn't like that? And then he wrote about it? Folks, it's really not that hard to actually try it. There is no learning curve. You just run the terminal app in your repo and you ask it to do things. Please, I beg you, before you go write walls of text about how much you hate the thing, actually try it, so that you actually have some idea what you're talking about. Six months ago, I myself imagined that I would hate AI-assisted coding! Then I tried it. I found out a lot of things that surprised me, and it turns out I don't hate it as much as I thought. [0] https://github.com/cloudflare/workers-oauth-provider/commits/main/?after=a6e3e06c2642e0fd4c185374753201cffc21ce8a+104 https://github.com/cloudflare/workers-oauth-provider/commits... (link to oldest commits so you can browse in order; newer commits are not as interesting)

mwcampbell 1y ago
He explained why he hasn't tried it in the section "The Challenge". Also see footnote 21, which says that what he called his "quirky constraints" in the main text are really bedrock ethical concerns. I respect him a great deal for not compromising on these. Edit to add: Full disclosure: I've been a fan of his writing and work for a long time anyway, and am a supporter on Patreon.
- kentonv 1y ago
  Yes, the ethical debate is fair and worth having, and I don't think someone necessarily has to try it to be able to debate the ethics. I obviously don't quite agree with his opinions here but I respect them. (Though I would say, before I really tried it, I had believed that AI does a lot more "plagiarism" -- lifting of entire passages or snippets. Actually using it has made clearer to me that it really is more like someone who has learned by reading, and then applies those learnings, at least most of the time.) I just don't like it when people argue that it doesn't work or doesn't do what they want without having actually tried it... There's too much echo chamber of people who don't want AI to work, and so convince each other that it doesn't, and repeat each other's arguments, all without ever taking a step outside their comfort zones. (Again... this was me, 6 months ago.)
glyph 1y ago
I haven't personally tried the specific tool that you have, but I have tried a variety of other tools and have had pretty negative experiences with them. I have received a lot of feedback telling me that if I tried out an agentic tool (or a different model, or etc etc etc, as I covered in the post, the goal posts are endlessly moving) I would like it, because the workflow is different. I was deliberately vague about my direct experiences because I didn't want anyone to do… well, basically this exact reply, "but you didn't try my preferred XYZ workflow, if you did, you'd like it". What I saw reflected in your repo history was the same unpleasantness that I'd experienced previously, scaled up into a production workflow to be even more unpleasant than I would have predicted. I'd assumed that the "agentic" stuff I keep hearing about would have reduced this sort of "no you screwed up" back-and-forth. Made particularly jarring was that it was from someone for whom I have a lot of respect (I was a BIG fan of Sandstorm, and really appreciated the design aesthetic of Cap'n Proto, although I've never used it). As a brutally ironic coda about the capacity of these tools for automated self-delusion at scale, I believed the line "Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs.", and in the post, I accepted the premise that it worked. You're not a novice here, you're on a short list of folks with world-class appsec chops that I would select for a dream team in that area. And yet, as others pointed out to me post-publication, CVE-2025-4143 and CVE-2025-4144 call into question the efficacy of "thorough review" as a mechanism to spot the sort of common errors likely to be generated by this sort of workflow, that 0xabad1dea called out 4 years ago now: https://gist.github.com/0xabad1dea/be18e11beb2e12433d93475d72016902 https://gist.github.com/0xabad1dea/be18e11beb2e12433d93475d7... Having hand-crafted a few embarrassing CVEs myself with no help from an LLM, I want to be sure to contextualize the degree to which this is a "gotcha" that proves anything. The main thrust of the post is that it is grindingly tedious to conclusively prove anything at all in this field right now. And even experts make dumb mistakes, this is why the CVE system exists. But it does very little to disprove my general model of the likely consequences of scaled-up LLM use for coding, either.
- kentonv 1y ago
  I do feel that the agentic thing is what made all the difference to me. The stuff I tried before that seemed pretty lame. Sorry, I know you were trying to avoid that exact comment, but it is true in my case. To be clear, I am not saying that I think you will like it. Many people don't, and that's fine. I am just saying that I didn't think I would like it, and I turned out wrong. So it might be worth trying. The CVE is indeed embarrassing, particularly because the specific bug was on my list of things to check for... and somehow I didn't. I don't know what happened. And now it's undermining the whole story. Sigh.

mwcampbell 1y ago

He explained why he hasn't tried it in the section "The Challenge". Also see footnote 21, which says that what he called his "quirky constraints" in the main text are really bedrock ethical concerns. I respect him a great deal for not compromising on these. Edit to add: Full disclosure: I've been a fan of his writing and work for a long time anyway, and am a supporter on Patreon.

kentonv 1y ago
Yes, the ethical debate is fair and worth having, and I don't think someone necessarily has to try it to be able to debate the ethics. I obviously don't quite agree with his opinions here but I respect them. (Though I would say, before I really tried it, I had believed that AI does a lot more "plagiarism" -- lifting of entire passages or snippets. Actually using it has made clearer to me that it really is more like someone who has learned by reading, and then applies those learnings, at least most of the time.) I just don't like it when people argue that it doesn't work or doesn't do what they want without having actually tried it... There's too much echo chamber of people who don't want AI to work, and so convince each other that it doesn't, and repeat each other's arguments, all without ever taking a step outside their comfort zones. (Again... this was me, 6 months ago.)

glyph 1y ago

I haven't personally tried the specific tool that you have, but I have tried a variety of other tools and have had pretty negative experiences with them. I have received a lot of feedback telling me that if I tried out an agentic tool (or a different model, or etc etc etc, as I covered in the post, the goal posts are endlessly moving) I would like it, because the workflow is different. I was deliberately vague about my direct experiences because I didn't want anyone to do… well, basically this exact reply, "but you didn't try my preferred XYZ workflow, if you did, you'd like it". What I saw reflected in your repo history was the same unpleasantness that I'd experienced previously, scaled up into a production workflow to be even more unpleasant than I would have predicted. I'd assumed that the "agentic" stuff I keep hearing about would have reduced this sort of "no you screwed up" back-and-forth. Made particularly jarring was that it was from someone for whom I have a lot of respect (I was a BIG fan of Sandstorm, and really appreciated the design aesthetic of Cap'n Proto, although I've never used it). As a brutally ironic coda about the capacity of these tools for automated self-delusion at scale, I believed the line "Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs.", and in the post, I accepted the premise that it worked. You're not a novice here, you're on a short list of folks with world-class appsec chops that I would select for a dream team in that area. And yet, as others pointed out to me post-publication, CVE-2025-4143 and CVE-2025-4144 call into question the efficacy of "thorough review" as a mechanism to spot the sort of common errors likely to be generated by this sort of workflow, that 0xabad1dea called out 4 years ago now: https://gist.github.com/0xabad1dea/be18e11beb2e12433d93475d72016902 https://gist.github.com/0xabad1dea/be18e11beb2e12433d93475d7... Having hand-crafted a few embarrassing CVEs myself with no help from an LLM, I want to be sure to contextualize the degree to which this is a "gotcha" that proves anything. The main thrust of the post is that it is grindingly tedious to conclusively prove anything at all in this field right now. And even experts make dumb mistakes, this is why the CVE system exists. But it does very little to disprove my general model of the likely consequences of scaled-up LLM use for coding, either.

kentonv 1y ago
I do feel that the agentic thing is what made all the difference to me. The stuff I tried before that seemed pretty lame. Sorry, I know you were trying to avoid that exact comment, but it is true in my case. To be clear, I am not saying that I think you will like it. Many people don't, and that's fine. I am just saying that I didn't think I would like it, and I turned out wrong. So it might be worth trying. The CVE is indeed embarrassing, particularly because the specific bug was on my list of things to check for... and somehow I didn't. I don't know what happened. And now it's undermining the whole story. Sigh.