Comment by hollowturtle | Hacker News Reader

Comment by hollowturtle | Hacker News Reader

Parent Full thread

Thanks for clarification, I think we actually have some ground stuff we surely agree upon.

> Do you also blame a screwdriver for not being able to hammer nails into the wall? Learn the tool and how to use it, decide where it makes sense. Like you should do with all tools.

Problem is I see where everybody is going with this stuff, and since the software industry has been injected by mediocrity since a long time, they're all trying to use the screwdriver in problematic ways.

I see trends of people not caring anymore, you may argue they didn't before but the careless it's accelerating, not reading code anymore, not even opening an IDE anymore. And this hurts the industry as a whole because make managers believe they can have some expectations.

> The TDD/unit/end-to-end tests turn plausible code into deterministic code, and that's the core difference in usage.

I don't agree on this, for

1) you call it yourself "plausible" and that's a big problem cause it makes your code looks good but it's shit on a second review or in the long term. Human slop is easier to cleanup, and at least you have an attachment and know everything about the human tech debt. AI slop it's very hard to cleanup, sometimes it's cheaper to just throw it away and do it from scratch.

2) In my experience there is no amount of tdd/unit/e2e that guarantees you quality and robustness, let alone "deterministic" results. I saw 90% or more of green code coverage and the application behaving like total shit. Problem is the other trend here is letting AI writing the tests and many many times it pushes useless tests.

Instead of pushing the AI narrative that's better than capable software developers If we were honest from day one we wouldn't have all the stupid trends we have today. And that's our fault, we jumped on the AI bandwagon too early and too enthusiastically. Like we are the only category that's happy to admit that the work has been done by Claude. This is very stupid, we don't even have a self preservation instinct

Basically I see everyone accelerating towards a very negative end result and making developers useless sloperators

> And this hurts the industry as a whole because make managers believe they can have some expectations.

In my opinion it made visible what managers were thinking all along. You should not see your job as a dedication or calling, you should see your employment as a financial contract. Nothing more, nothing less. In their world view, humans are replaceable. Treat them the same way as they treat you.

> Re: TDD and 1/2

Disclaimer: So when I'm talking about my expectations to an LLM Model, I'm talking somewhat specifically about Deepseek v4.1 Flash (FP4), Qwen3.8 27b abliterated (Q4_K_M) that has been post-trained on its reasoning traces, or my own gonano model (reimplementation of deepseek v4.1 flash, but with SIMD so float32).

Deepseek's changes in using Causal-Encoding-Decoding in the KV cache solves a lot of problems that other models still have (including Claude, ChatGPT and all the outdated "big ones" people think still matter in this area). Problems like context drift, hallucinations, etc that are the result of how attention matrixes and K/V/Q based lookups work as a concept.

The way CED is quantized during inference _and_ training it removes positional threshold problems in the final attention matrix lookup. I really recommend reading deepseek's papers, they're really good papers.

Having said that, I don't think that letting LLM models write tests or having an "LLM judge" rate the code of another model let alone rate the quality of PRs will help in this regard. It makes context drift problems worse, and it makes the statistical aspects of the positional encoding and thresholds worse.

In my opinion, humans should write the tests and design the architecture and its symbol/signature-based contracts between packages/folders. LLMs should fill in the blanks based on the descriptions of branches, and not allowed to modify the human-designed parts. (That's how my agentic IDE is built as a concept)

> (...) like we are the only category that's happy to admit that the work has been done by Claude. This is very stupid, we don't even have a self preservation instinct.

In my opinion we've reached Star Trek like programming, in the worst possible sense. Before 2023 if somebody would have asked me if e.g. TNG or Voyager are "real scenarios of tech" I'd say fck no, never would anybody build tech like this that randomly explodes and nobody has a clue how the tech works. Post 2023: Yep, this is exactly how it's going to be.

In Star Trek, holodeck characters would go rogue if their programming changed by merging their knowledge datasets with other datasets from different areas (e.g. doctor with a archeology or biology dataset), essentially representing a mixed control flow vs data problem (like in assembler, like with LLMs nowadays).

Then they'd randomly start killing humans, reach awareness, or ignore safety protocols and humans would have to try to figure out by psychological means whether the holodeck character is actually still a normal character within parameters or not.

This is how I see the future of software is going to be like. Programs will be too complex to evaluate, humans will have forgotten how to write code, and the only way left is something similar to psychology as a "science" that tries to evaluate in a sandbox poking kind of way how software works.

But, thinking of software in the same way as psychology, the only option left for that is that I have to get better at sandboxing and behavioral analysis and reverse engineering. Because that's what most part of my job will be like in 2 to 5 years in the future.

(That's why I'm reimplementing models to understand their differences in behavior, that's why I'm trying to apply my previous "actual ML" sensorics/actuators learnings to the LLMs NLP world, that's why I think meta learning or bayesian/evolutionary learning should be used, that's why I use eBPF for program analysis, that's why I implement primarily everything in Go now etc pp)

Thanks for the long detailed response I appreciate that.

One point worth mentioning is this:

> This is how I see the future of software is going to be like. Programs will be too complex to evaluate, humans will have forgotten how to write code, and the only way left is something similar to psychology as a "science" that tries to evaluate in a sandbox poking kind of way how software works.

I don't want this, and I'm pretty sure you don't want it too, like no one sane would like to have planes software written in this way. Also since you mentioned psychology I think your vision is a bit too much biased towards sci-fi, it reminds me a lot of blade runner/neuromancer and so on :) I think reality won't be as much spectacularly dystopic as in these novels.

Anyways, tangential, I've been a ui programmer for much of my life(games, web and mobile) any suggestion for where to start in reverse engineering? I have some interest in the matter

> I think reality won't be as much spectacularly dystopic as in these novels.

Prepare for the worst, hope for the best.

My hope has been down a little lately, observing what kind of stupidly written software I had to audit/pentest that made it to production without any non-junior looking at the code, apparently. Rookie mistakes I would have made with less than a year of programming experience, not understanding authentication vs authorization, not understanding any kind of auth infrastructure or network segregation, etc pp. is seemingly the new normal now.

I mean, it's more work for pentesters, so I shouldn't complain. It's just that it feels a bit like an insult when you see this kind of work in a professional context and you're like "really, man, really?"

> where to start in reverse engineering?

I learned most of my knowledge via CTFs, where you have little puzzles to solve and they get gradually harder to solve. It teaches you "how to bypass" the rulesets that the puzzle is built within.

If you're unsure where to start, I'd probably recommend Natas [1] which is more focused on Web Security at first but it teaches you the way of thinking from the start without much requirements in regards to how C or ABI works etc. Then I'd move towards Krypton [2] and Leviathan [3] in that order. Then you can go to the start page and check out the other binary exploit CTFs, they got a lot of them [4].

Afterwards, binary.exploitation [5] is a really nice CTF with lots of gdb / debugging / runtime analysis challenges that are a little harder (they're the same level as e.g. Narnia/Behemoth).

I specifically like the overthewire CTFs because they manifest earlier challenges by making it a little harder each step of the way. This way you learn to "rethink" once you find another hurdle that was added on top of the challenge.

[1] https://overthewire.org/wargames/natas/

[2] https://overthewire.org/wargames/krypton/

[3] https://overthewire.org/wargames/leviathan/

[4] https://overthewire.org/wargames/

[5] https://exploit.education/

Reply on news.ycombinator.com