Hacker News Reader

Comment by plastic041 | Hacker News Reader

The comments are horrifying. They do everything they can to avoid reading the code they are responsible for.

You must read the code before shipping it to production.

"But I don't have time!" That's not even an excuse. At least one person in your company should be able to explain the code! How would you answer when reviewer asks why did you use this very algorithm?

"We have tests." They could help. But don't rely on them entirely because there's a high possibility that the tests are wrong.

I can't believe how many people proudly admit that they don't read code. I'm not entirely against using LLMs to write or review code, but not even trying to read it should be prohibited. Someone responsible have to review it.

Edit: I know that LLMs are very good at writing code these days. My point is that this is less a matter of quality and more a matter of responsibility.

View on HN

> You must read the code before shipping it to production.

No you don't. You just need to be reasonably certain it works to specification. That was always the case, with or without LLM generated code. If anything I now have a lot more confidence in some of the code produced because the lower bound has become the LLM.

This profession really needs to be shaken up by regulators.

Releasing something to customers which hasn’t been reviewed by any human is gross negligence.

What makes you think people aren't "reviewing" what they ship to customers just because they don't read the code? If the testing goes well that may be all the "review" required.

https://i.imgur.com/HvzIZ6v.png

This is "Preview" — Apple's document viewer on macOS 27. Do you think the testing went well?

Personally if I had to look back at the rate of bugs of a similar severity my own company produced I think it was higher pre-llm coding and testing.

You want to regulate an industry 90% of whose output is just a bunch non-critical CRUD apps? You haven’t thought out the macroeconomics of that, you’d go hungry faster than you’re being obsoleted in the age of AI

To be fair, while the threads don’t show it, majority of companies that survive by processing payments. Shopify, Airlines, Rental Car companies, Banks, etc. are still doing and generally can prove at anytime 2 party review is happening on any PCI related code. It’s just that many people don’t work on that, and regulating a new feature for the ESPN Fantasy Football service seems silly.

> everything they can to avoid reading the code

The reason is simple. It's extremely morally taxing to read the AI code and realize this is a mess that has to be scrapped.

Much, much more comfortable solution is to join the church of "I don't read code anymore":

1. You can ship fast

2. You can feel good about yourself

3. You avoid facing the uncomfortable truth

4. You get support from fellow believers

youve succinctly described something ive sensed in ai evangelist coworkers in 1, 2, and 4. my tiny dev team of 4 is split between vibe coders and those who review every line, and im in the latter. i have a sinking feeling were the ones practicing point #3

I never hear anyone address the addiction-forming variable reward from pulling the LLM handle and sometimes getting what you want, sometimes getting garbage, and sometimes being thrilled. It's like opening loot boxes for a living. Highly addictive.

Slowing down to review the code feels like drudgery in comparison.

I'm in the review every line camp. I don't trust things that are addictive without a virtuous loop (like exercise). I have to interact with addictive things like video games, loot boxes, gambling, and alcohol in moderation. LLM use fits that perfectly. I'd rather use it throughout the day but still pause and feel the discomfort of reviewing the code, often throwing it out and having it try again when it inevitably makes a hot mess.

5. You do whatever works to Meets Expectations

This depends heavily on your product. There is certain software where I agree with you. But for the usual business CRUD app, why would I need to know my code? It's vastly cheaper to understand code on demand, than digging into every single line of code preemptively.

In my products I definitely take care of architecture, interfaces and data, as they have a high cost of failure. Anything else doesn't matter. If an user finds a rare edge condition, asking an agent to fix it costs less than 10€. Properly reviewing a big PR costs somewhere between 100-1.000€. I would be completely irresponsible to my business to review the code in-depth.

If it was just CRUD then you were wasting your time "coding" it before anyway. There are loads of no/low-code solutions for CRUD.

But the reason people use real code and frameworks like Django or Rails etc is because it's never just CRUD. You always end up needing some business rule somewhere, or you end with some performance problem leading you to think about async tasks and cached result layers and the like. You need to understand it because you're responsible for giving the correct results to your business and/or customers.

Because your slop-coded "delete this record" method can skip `WHERE` in the SQL statement because you have prioritized performance in your prompt. LLMs have no clue.

LLMs do know this. Try getting claude to code dangerously like that and you'll get significant pushback from the agent.

Oh there is no need to push claude in that direction, it will happily go this way on its own.

Then you have bad tests and didn’t consider all cases in your prompt. That’s on you.

"This thing is intelligent."

"But it did something stupid."

"That's because you treated it like it was intelligent, you have to treat it like it's stupid."

why does someone have to read it?

we don't read the assembly code produced by the compiler, nor do we read the code of all open source dependencies, yet we can successfully build software

Yeah, that's because those things are either deterministic output, or produced by someone that was actually good at programming. LLMs are neither. If you don't read every line of code they produce, you are committing professional malpractice.

LLMs, natively, are better at programming than nearly every professional software engineer, full stop. There are a lot of meta tasks (not programming, software engineering) that they are worse at, but the actual programming part, they've transcended human potential.

You have to treat them like an ignorant junior engineer in nearly every respect, but trying to match with them at programming per se is a fool's errand.

The reason to read the code is not because you can catch their errors in programming. It's because they may have missed the forest for the trees at the operational or strategic level, and so that you can learn from them to understand better. It's like trying to beat the engine in chess now.

no you're not lol. You're managing a team of ever improving engineers. Opus 5.5 is almost paranoid about testing literally all its assumptions. It's already a better coder than me and I've been doing this for 30 years.

I don't understand why so many people bring up compilers. The reason we don't have to* read the code of compilers or oss libraries is because the developers who created them have reviewed it to ensure that it works. But if you don't review your own code, who will?

* As long as it works

code review isn't why programs are correct. careful testing is

Code review __and__ testing.

many open source projects do not have code review

besides, there was a time before code review was the norm

Code review done properly plays a very big role in ensuring programs are correct. Everybody knows how hard it is to get complete test coverage. You need layers.

we don't read the assembly code produced by the compiler, nor do we read the code of all open source dependencies

When you actually have to debug, you sometimes need to.

And when something the LLM wrote goes off the rails sometimes you have to look at code to debug too. But you don't need to make reviewing the code standard practice anymore than reviewing assembly code before shipping.

"we have tests"

spoiler alert: any test that was written by an LLM as part of the same task that created the feature is less than worthless.

especially if no human reads AND fully understands the tests.

Right? "Oh, as long as I understand what it's doing on a high level, it's fine". Good thing the devil's never in the fucking details, then.

But the code always "looks" correct.. its a hard job!

Reading code is no longer the right level of abstraction to focus on with our limited brainpower everyday. Your reading of code is primarily to increase your feelings of conviction, code correctness is secondary. Welcome to the future.

not possible in this year and age

Do you read all libraries and basal low level code beneath your projects? Do you understand fully the entire stack from you to silicon? If not this is just more layers of abstraction.

Reply on news.ycombinator.com