4 ms·

The featured blog post where one of their senior engineering PMs presented an allegedly "production grade" Matrix implementation, in which authentication was st

by jsheard 8mo ago

The featured blog post where one of their senior engineering PMs presented an allegedly "production grade" Matrix implementation, in which authentication was stubbed out as a TODO, says it all really. I'm glad a quarter of the internet is in such responsible hands.

dana321 8mo ago
Thats a classic claude move, even the new sonnet 4.6 still does this.
- brutalc 8mo ago
  [dead]
- bonesss 8mo ago
  It’s almost as classic as just short circuiting tests in lightly obfuscated ways. I could be quite the kernel developer if making the test green was the only criteria.
- allovertheworld 8mo ago
  Wait till you get AI to write unit tests and tell it the test must pass. After a few rounds it will make the test “assert(true)” when the code cant get the test to pass
blibble 8mo ago
there was also a post here where an engineer was parading around a vibe-coded oauth library he'd made as a demonstration of how great LLMs were at which point the CVEs started to fly in
gtowey 8mo ago
It's spreading and only going to get worse. Management thinks AI tools should make everyone 10x as productive, so they're all trying to run lean teams and load up the remaining engineers with all the work. This will end about as well as the great offshoring of the early 2000s.
ranger_danger 8mo ago
Matrix doesn't actually define how one should do authentication though... every homeserver software is free to implement it however they want.
- Arathorn 8mo ago
  the main bit of auth which was left unimplemented on matrix-workers was the critical logic which authorizes traffic over federation: https://spec.matrix.org/latest/server-server-api/#authorization-rules https://spec.matrix.org/latest/server-server-api/#authorizat... Auth for clients is also specified in the spec - there is some scope for homeservers to freestyle, but nowadays they have to implement OIDC: https://spec.matrix.org/latest/client-server-api/#client-authentication https://spec.matrix.org/latest/client-server-api/#client-aut...

by jsheard 8mo ago

dana321 8mo ago

Thats a classic claude move, even the new sonnet 4.6 still does this.

brutalc 8mo ago
[dead]
bonesss 8mo ago
It’s almost as classic as just short circuiting tests in lightly obfuscated ways. I could be quite the kernel developer if making the test green was the only criteria.
allovertheworld 8mo ago
Wait till you get AI to write unit tests and tell it the test must pass. After a few rounds it will make the test “assert(true)” when the code cant get the test to pass

blibble 8mo ago

there was also a post here where an engineer was parading around a vibe-coded oauth library he'd made as a demonstration of how great LLMs were at which point the CVEs started to fly in

gtowey 8mo ago

It's spreading and only going to get worse. Management thinks AI tools should make everyone 10x as productive, so they're all trying to run lean teams and load up the remaining engineers with all the work. This will end about as well as the great offshoring of the early 2000s.

ranger_danger 8mo ago

Matrix doesn't actually define how one should do authentication though... every homeserver software is free to implement it however they want.

Arathorn 8mo ago
the main bit of auth which was left unimplemented on matrix-workers was the critical logic which authorizes traffic over federation: https://spec.matrix.org/latest/server-server-api/#authorization-rules https://spec.matrix.org/latest/server-server-api/#authorizat... Auth for clients is also specified in the spec - there is some scope for homeservers to freestyle, but nowadays they have to implement OIDC: https://spec.matrix.org/latest/client-server-api/#client-authentication https://spec.matrix.org/latest/client-server-api/#client-aut...