These groups are likely being targeted by a campaign.

These will surely be operated by overseas workers.

Get the money for building factories onshore and still offshore the labour.

It's such a Claudism.

Everything is inundated with info about other things tried.

Comments and docs flooded with things found out in the process when you want something about the info you need to know now.

Just formalise what already happens ?

But that would probably invite scrutiny that was unwelcome.

Someone should get some stats on how much this happens already.

20 a month and using sonnet mostly for random fun stuff.

At work, it seems a bit different - I'm certainly having to declaudify things it can be hard starting there's a lot to dig into - you can see it's overwritten but need to understand every detail to sort it out.

That really stood out.

Code is there to be read and understood by the human developers who come later.

The git history is a similar record, that's why the commits that make it to main (the squashed PRs) should cover one(ish) thing each and be self contained.

Something covering 230 files should be a mechanical change like running a linter or the AI is moving an API from one signature to another.

If an LLM generated a 230 file change they are also capable of going back and breaking it up.

One thing they are bad at is comments that are succinct since they almost only ever add words.

It's funny, because in my experience, the process often looks like:

1. Human gives high-level design. 2. Agent generates wrong code with misleading comments. 3. In further iterations, agent get mislead by said code and comments, ends up generating insane workarounds.

> human developers who come later

Tbf, once the codebase is slopped enough that becomes impossible and only LLM can come later.

Yeah, we should push back on this. We don't have to accept this outcome as if it's inevitable.

Sadly, the hype is real and that's what's happening in many places. Businesses are eager to bet on AI cause they'd been promised x100 productivity = fire 99 or 100 devs = huge profit.

I expect one day some slopware will succumb to one of these weird production bugs, no LLM will be able to fix it, and when the biz guys ask me for a fix estimate, I'm going to say "3 years".

I went all in on it about a year ago, and I've gotten the hype out of my system now. It's now officially a love/hate relationship. Like everything else that is a mainstay in my life.

It is inevitable. We (coders) already did it to other engineering disciplines where machines do most of the work, no human could possibly review or understand the actual details, and only verification ensures it is correct.

Why do you think coding is immune to this?

Call me old fashioned, but things were working just fine.

> no human could possibly review or understand the actual details,

What are you talking about? - The developers understood it. Did my car manufacturer do something to my discipline because I don't understand my car?

Look up Constraint-Driven Design or Declarative Engineering

People often tend to stop in these situations.

There's a continuum between vibe coded and directed LLM, I guess we'll see which it is.

Implementing all the main authentication mechanisms is hell.

Oauth2 is utter utter shite as well.

OAuth2 is fine, I mean:

1. It's not an authentication protocol, but it was abused as one for until OpenID Connect came along

2. OpenID Connect is the compatible authN protocol, and it actually has a spec unlike OAuth2

Both of those are annoying because they are over-complicated for simple use cases and for a long time there were very few simple open-source providers that weren't hiding all the important stuff behind their enterprise/cloud versions.

Open source options like Zitadel are improving this space somewhat, though they are still sort of painfully complicated if you want to deploy something small and simple that you can understand. In order to be big business they have to support tons of 3rd-party provider plugins with all their out-of-spec wrinkles.

It would be nice to have something like Zitadel that is signficantly less concerned about all those third parties - like let me very easily just host username/password and passkey auth in a small package.

OAuth2 is about a billion times better than SAML. At least you have a decent chance of doing it securely if you follow the spec vs about zero chance with saml.

Why are you using an authorization protocol for authentication? Try OIDC.

OIDC is a layer on top of OAuth...

Yes. But it’s authentication, whereas OAuth is authorization.

I kinda disagree. Authentication is at OAuths core. You still need to authenticate to obtain a token and in more complex setups you don’t use it for authorization at all because tokens are stale immediately after issuing them. It’s why things like Zanzibar and OPA have been made.

It’s really not. OAuth makes zero assumptions about how you login - granted, the client credentials flow is a form of authentication if you will, but for the user perspective, OAuth starts when you’re signed in. That’s also why you can easily combine it with all kinds of authentication providers.

> OAuth makes zero assumptions about how you login

Neither does OIDC: "The methods used by the Authorization Server to Authenticate the End-User (e.g., username and password, session cookies, etc.) are beyond the scope of this specification."

OAuth makes zero assumptions about a lot of things, like even how you "authorize". That doesn't mean that authentication doesn't play a crucial role. While it doesn't specify how you authenticate the user it still specifies that you must authenticate the user. Outside of the authorization code flow, other flows strictly mandate that you should authenticate the clients.

Claude definitely has it's own flavour.

It often talks about negatives and things that stuff doesn't do.