6 ms·
> I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even
by winstonwinston 5mo ago
> I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even if it isn't perfect, it is easily worth the cost IMHO.
So, how is that supposed to work? Claude Code generates security bugs, then Claude Security finds them, then Claude Code generate fix, spend tokens, profit?
- jimmy2times 5mo agoThe AIs have already figured out how to succeed in a software job: 1. Ship bugs 2. Fix them 3. You're the hero!
- genghisjahn 5mo agoI thought we were all doing that already?
- flir 5mo agoJesus, dude. There are managers reading this.
- genghisjahn 5mo ago>_<
- OtomotO 5mo agoTake them out of the loop. Unless they are not human.
- josh-sematic 5mo agoI’m guessing you wouldn’t really rather be managed by a bot..,
- OtomotO 5mo agoI am not managed by anyone:p
- joquarky 5mo agoThey became obsolete when they stopped clearing obstacles, stopped masking politics, and started acting as a proxy for JIRA. But it's just they way it has always been done, so they get paid to meddle.
- TeMPOraL 5mo agoWhat do you think they do all day? The larger pattern is not unique to writing code. Think of it next time a reorg comes, or some random thing gets "improved" in the name of "efficiency" only management seems to see.
- pjmlp 5mo agoThe idea is to take the human out of the loop.
- mindcrime 5mo ago> But in 30 days we could put in electronic relays. Get the men out of the loop. > Gentlemen... > I wouldn't trust this overgrown pile of microchips further than I could throw it. I don't know if > you wanna trust the safety of our country to some... silicon diode...
- jimbokun 5mo agoDilbert beat you to it: https://english.stackexchange.com/questions/488178/what-does-it-mean-writing-a-minivan https://english.stackexchange.com/questions/488178/what-does...
- dingaling 5mo agoThe non-programmer decomposition of that joke was painful to read. Particularly from those outside the domain who criticised it as a 'not a very good joke' because they didn't understand it, which I think summarises the entitled mindset of many people these days.
- SecretDreams 5mo agoMeanwhile, experienced humans learned to succeed by not overachieving every second of the day to keep a steady flow of work going. Then a junior rolls up who wants to kill themselves to climb the ladder - but, problem solved, sub the AI in for the juniors to protect the seniors.
- siva7 5mo agoSo? That's how a business works. We sold you landmines and now you need them removed? Lucky you we also have mine clearance products.
- 382hi 5mo agoExactly!
- ygjb 5mo agoYeah, with a budget assigned. This is actually just software development and security right? Developers create software, which has bugs. Users (including bad guys, pen testers, QA folks, automated scans etc, etc, etc) find bugs, including security bugs, Developers fix bugs and maybe make more. It's an OODA loop, and continues until the developers decide to stop supporting the software. Whether that fits into the business model, or the value proposition of spending tokens instead of engineer hours or user hours is fundamentally a risk management decision and whether or not the developer (whether OSS contributor, employee, business owner, etc) wants to invest their resources into maintaining the project. While not evenly distributed, and not perfect, the currently available and behind embargoed tools are absolutely impactful, and yes, they are expensive to operate right now - it may not always be the case, but the "Attacks always get better" adage applies here. The models will get cheaper to run, and if you don't want to pay for engineers or reward volunteers to do the work, then you've got to pay for tokens, or spend some other resource to get the work done.
- sandeepkd 5mo agoSomehow this reminded me of the historical efforts of some government bounty collections for mouse tails which were discontinued due to fraud (such as hunters breeding mice to collect the reward). There is a reason why/how devs and QA keep each other in check. Guess in case of LLM writing code, one has to use different models for dev and security checks. On other hand, in real world, the developers learn from mistakes and avoid them in the future. However there is no feedback loop with enterprises using LLM with the agreement that the LLM would not use the enterprise code for training purposes
- ygjb 5mo ago> the developers learn from mistakes and avoid them in the future No. Humans learn from mistakes and try to avoid them in the future, but there is a whole pile of other stuff in the bag of neurons between our ears that prevent us from avoiding repetition of errors. I have seen extremely talented engineers write trivial to avoid memory corruption bugs because they were thinking about the problem they were trying to solve, and not the pitfalls they could fall into. I would argue that the vast majority of software defects in released code are written by people that know better, but the bug introduced was orthogonal to the problem they were trying to solve, or was for an edge case that was not considered in the requirements. Unless you are writing a software component specifically to be resilient against memory corruption, preventing memory corruption issues aren't top of mind when writing code, and that is ok since humans, like the machines we build, have a limit to the amount of context/content/problem space that we can hold and evaluate at once. Separately, you don't necessarily need to use different models to generate code vs conduct security checks, but you should be using different prompts, steering, specs, skills and agents for the two tasks because of how the model and agents interpret the instructions given.
- raincole 5mo agoHumans work like that too. If you're not comfortable with Claude involves in every step (for whatever reason) then just use different providers for each.
- unethical_ban 5mo agoHow is this supposed to work? Humans generate security bugs, then humans find them, then humans generate the fix, profit? Yeah. Presumably as AI code generation gets better, the output gets better. As smaller portions of code are stitched together, human/AI systems analyze it holistically to make sure all its integrations are secure and bug free. In 2026, different models are better at different things. Cheap models can plan and do small/medium code projects well, more expensive models are even better at architecture and exploit discovery.
- jstummbillig 5mo agoNgl, watching folks getting irritated about normal employer-employee absurdities from the employer perspective through usage of agents and having to pay for tokens has been a little therapeutic for me.
- akoboldfrying 5mo agoAbsolutely. And not even making the connection. On a broader scale, the sheer face-eating-leopards-ness of programmers finally automating away our own jobs and then realising how much this sucks, after automating away so many other kinds of jobs, can feel darkly amusing to me too.
- dminik 5mo agoI keep reading this sort of comment quite a lot, but programming isn't always about automating jobs away. In my career I have not eliminated a single job. I don't consider that a failure on my part.
- akoboldfrying 5mo agoI didn't mean to imply that automation through programming is always bad. Like with any technology that increases productivity, there are many obvious benefits. We have all benefited enormously on the consumer side of the economy, for example. But I think it's recently become a lot clearer to many in the tech industry that automation can have downsides too, and those downsides are not evenly distributed. This truth was there all along, but because we were shielded from it for so long, we were able to look away. Not anymore. Any computational task done by a computer could in principle be done by a person, albeit billions of times slower and with a larger error rate. If computer programs could not automate certain practical tasks -- that is to say, do them much more reliably and efficiently than people do them -- they would be an academic curiosity studied by a handful of professors instead of a central part of modern infrastructure. So I'm sceptical of your claim not to have eliminated a single job. You might not have removed an existing job, but couldn't people be paid to do the work your code does?
- predkambrij 5mo agoMan, some people like conspiracies. I encourage you to replicate all that.
- idiotsecant 5mo agoYes. Up until this point the bottleneck was how many developers you could convince to help you. Now it's how much money you can dump into it. Like everything else, software is becoming a game where the winner is the organization most willing to spend money. It'll be like bombs or tanks - you need smart people to advance in the war, but you also need money and material, the material is just compute infra.
- yojo 5mo agoYou can hook traditional SAST into your coding tool, and get cheap-ish realtime detection for some classes of vulns while coding. You can optionally layer LLM diff scanning if you want to burn some tokens on your tokens. Modern tools can catch some impressively subtle issues.
- mordymoop 5mo agoThis also describes the work of software engineers.
- jzer0cool 5mo agoNew era of cat and mouse.
- koliber 5mo agoReplace “Claude code” with “programmers” and you get what we’ve had up until now. It’s all just moving quicker now.
- teiferer 5mo agoAll my sibling comments are missing the message here which is that if Claude can find security issues then it can avoid them right when writing the code, so it could just never commit anything containing a security issue.
- soraminazuki 5mo agoI wonder how many minivans Anthropic is going to code themselves.
- rco8786 5mo agoSoftware engineers generate security bugs, Software engineers find them, then Software engineers generate fix, collect salary, profit?
- junon 5mo agoThose are individual revenue streams, distributed at a very granular level across the world. LLMs are currently relegated to individual for-profit companies. They collect that money. There's no other choice to use them and to provide them that money.
- deleted 5mo ago[deleted]
- designerarvid 5mo agoJust refactor and rebrand all of it as Claude Code and see it as one process.
- joquarky 5mo agoI'm starting to think that those who are most aggressively expressive about low quality from these tools are the same who expect everything to be a one shot.
- JacobAsmuth 5mo agoEngineers generate security bugs, security researchers find them, then engineers generate the fix, all the while getting paid, raking in hundreds of thousands of dollars a year in profit per engineer.