8,073 karma · joined July 15, 2013
https://a.drien.com
https://github.com/drien
https://infosec.exchange/@adrien
If we review democracies through history that have at some point become less democratic, I think describing the process of how that actually happens as being a slippery slope is quite apt. I’d say it’s more of a fallacy to assume that democracy is a secure default state of being rather than an ideal that we must collectively support or lose entirely—that we can safely “slip” a little without risking a slide further down the slope.
Just in the past few weeks I can think of several instances where an AI assistant added sensitive API endpoints with no authentication whatsoever, updated API endpoints with methods that didn't follow my guidance on authorization or existing authorization patterns in the codebase, or created templates with brutal potential for XSS.
I'm all in on coding with LLMs and use them every single day, but I'm quite confident there will be plenty of work for security engineers as we explore this future.
That said, in the hands of someone who is competent at assembling a large app, I think these tools can be incredibly powerful. I have a business helping companies figure out how/if to leverage AI and have built a bunch of different production LLM-backed applications using LLMs to write the code over the past year, and my impression is that there is very much something there. Taking it step by step, file by file, like you might if you wrote the code yourself, describing your concept of the abstractions, having a few files describing the overall architecture that you can add to the chat as needed—little details make a big difference in the results.
aider --architect --model o1 --editor-model sonnet
Then you'll be in "architect" mode, which first prompts o1 to design the solution, then you can accept it and allow sonnet to actually create the diffs.Most of the time your way works well—I use sonnet alone 90% of the time, but the architect mode is really great at getting it unstuck when it can't seem to implement what I want correctly, or keeps fixing its mistakes by making things worse.
I think that every time I’ve worked on a large project with Emacs I’ve started trying to optimize the partial/fuzzy filename search, trying all of the different ways people suggest online to see which one feels natural until I realize I’ve spent an entire day on it.
Over time I’ve come to really value software that is customizable, but that comes with defaults that I really like, rather than software that’s even more customizable but that must be customized for it to feel right. God forbid I run Emacs somewhere without my conf and forget to disable electric indent mode and want to flip my desk when it does its terrible default behavior.
Spotify is also funny for maintaining the existence of their feature suggestion community boards while just utterly stonewalling for years while thousands of paying users beg for stuff like…being able to hide a section of the home screen, or not have long-standing playlists magically change.
1. It’s fun to use it to try unfamiliar languages and frameworks, but that exponentially increases the chance you get firmly stuck in a corner like OP’s deployment issue, where the AI can no longer figure it out and you find yourself needing to learn everything on the fly. I use a Django/Vue/Docker template repo that I’ve deployed many production apps from and know like the back of my hand, and I’m deeply familiar with each of the components of the stack.
2. Work in smaller chunks and keep it on a short leash. Agentic editors like Windsurf have a lot of promise but have the potential to make big sweeping messes in one go. I find the manual file context management of Aider to work pretty well. I think through the project structure I want and I ask it to implement it chunk by chunk—one or two moving pieces at a time. I work through it like I would pair programming with someone else at the keyboard: we take it step by step rather than giving a big upfront ask. This is still extremely fast because it’s less prone to big screwups. “Slow is smooth and smooth is fast.”
3. Don’t be afraid to undo everything it just did and re-prompt.
4. Use guidelines—I have had great success getting the AI to follow my desired patterns, e.g. how and where to make XHRs, by stubbing them in somewhere as an example or explicitly detailing them in a file.
5. Suggest the data structures and algorithms you want it to use. Design the software intentionally yourself. Tell it to make a module that does X with three classes that do A, B and C.
6. Let the AI do some gold plating: sometimes you gotta get in there and write the code yourself, but having an LLM assistant can help make it much more robust than I’d bother to in a PoC type project—thorough and friendly error handling, nice UI around data validation, extensive tests I’m less worried about maintaining, etc. There are lots of areas where I find myself able to do more and make better quality-oriented things even when I’m coding the core functionality myself.
7. Use frameworks and libraries the AI “knows” about. If your goal is speed, using something sufficiently mainstream that it has been trained on lots of examples helps a lot. That said, if something you’re using has had a major API change, you might struggle with it writing 1.0-style code even though you’re using 2.0.
8. Mix in other models. I’ve often had Claude back itself into a corner, only to loop in o1 via Aider’s architect mode and have it figure out the issue and tell Claude how to fix it.
9. Get a feel for what it’s good at in your domain—since I’m always ready to quickly roll back changes, I always go for the ambitious ask and see whether it can pull it off—sometimes it’s truly amazing in one shot! Other times it’s a mess and I undo it. Either way over time you get an intuition for when it will screw up. Just last week I was playing around with a project where I had a need to draw polygons over a photograph for debugging purposes. A nice to have on top of that was being able to add, delete, and drag to reshape them, but I never would have bothered coding it myself or pulling in a library just for that. I asked Claude for it, and got it in one shot.
Now there are surely people living there who would argue that this zoning has protected the shape and nature of the town they that they prefer, but the flip side of that coin is that, at $1.4m, a median home in Concord costs more than 3x that of the country overall.
It’s not a trick question nor does it require memorization or study to prepare. You’re not being given 20 minutes to solve something that requires knowledge of an algorithm that researchers worked on for decades that you’ve either practiced or will stumble through deriving from first principles—you’re writing a very simplistic function.
When I’m deep in the weeds on a task, stepping away for a walk in the park, a workout, or to prepare a meal or some coffee, affords me the opportunity to clear the micro details of the task from my mind while retaining the macro at the tip of my attention. This state is very frequently where the best insights on the task emerge, whereas an interruption resets both micro and macro attention entirely to something else.
I imagine, for example, that if the internal project files for a popular video editing app were accessible, we’d see competing and/or open source apps emerge that could parse them, were the original app to become suddenly unavailable. Instead they’re just lost because your phone won’t let you access them.
I have, however, fully adopted chat-to-patch style workflows like Aider, I find it much less intrusive and distracting than the tab completions, since I can give it my entire thought rather than some code to try to complete.
I do think there’s promise in more autonomous tools, but they still very much fall into the compounding-error traps that agents often do at the present.
The mountain has been flooded with rich people paying guides to get them to the top for decades. It’s obviously still a major challenge, but very much a well-monetized one.
- Message board style like Github issues - Slack thread - Email thread - Video call - In person meeting
I do really like in-person meetings for brainstorming or collaborative design type stuff. Having a real whiteboard is hard to beat, and I think the discussion can flow a little more naturally without any latency.
I have found that AI notetakers can bridge this gap fairly well—whether in a virtual meeting or in person. If the calendar event has a virtual meeting with a notetaker that joins by default, someone can join the meeting and throw a phone down on the conference table and everyone gets a full transcript, summary, and list of next steps afterwards. One of my favorite real world applications of LLMs so far.
Personally, though, I do think that the higher-bandwidth effect is valuable to me. I think part of what makes me feel like video calls are tiring is that my brain is working overtime trying to extract some of that extra signal from the participants, while in-person I'm able to better gauge others' reactions intuitively and adjust my tone or approach without much conscious effort. People have told me for years that I have a "calming presence" in the workplace/meetings, which is not a way I'd describe myself unprompted, so I think I've silently benefited from nonverbal cues in that way.
Being in a comfortable environment is a huge one though for sure. So many modern offices are comically badly arranged, with people trying to do thinking work space shared with people having meetings who are overflowing from the insufficient number of conference rooms. It's kind of a joke.
I’m lucky enough to work wherever I want and accept Zoom meetings as a prerequisite to that, but find them tiring and a poor simulacrum of real in-person conversation. If I were asked to come to an office every day and deal with the commute and the stupidity of most modern office designs and still had the majority of meetings happen over video, I’d be pretty dissatisfied with my job.