HN user

dawnbreez

659 karma
Posts3
Comments462
View on HN

Apparently I missed the end of a sentence near the end there. "But because" on the fourth paragraph is supposed to be "but because the sales pitch is that the machine can replace me". Oops.

I mean, fair. It's true that humans aren't that great at writing code that can't be exploited, and the blogpost makes this point too: between a junior engineer's output and an LLM's output, the LLM does the same thing for cheaper.

I would argue that a junior engineer has a more valuable feature--the ability to ask that junior engineer questions after the fact, and ideally the ability to learn and eventually become a senior engineer--but if you're looking at just the cost of a junior engineer doing junior engineer things...yeah, no, the LLM does it more efficiently. If you assume that the goal is to write code cheaper, LLMs win.

However, I'd like to point out--again--that this isn't going to be used to replace junior engineers, it's going to be used to replace senior engineers. Senior engineers cost more than junior engineers; if you want each engineer to be more productive per-dollar (and assume, like many shareholders do, that software engineers are fungible) then the smart thing to do is replace the more costly engineer. After all, the whole point of AI is to be smart enough to automate things, right?

You and I understand that a senior engineer's job is very different from a junior engineer's job, but a stockholder doesn't--because a stockholder only needs to know how finance works to be a successful stockholder. Furthermore, the stockholder's goal is simply to make as much money as possible per quarter--partly because he can just walk out if the company starts going under, often with a bigger "severance package" than any of the engineers in the company. The incentives are lined up not only for the stockholder to not know why getting rid of senior engineers is a bad idea, but to not care. Were I in your position, I would be worried about losing my job, not because I didn't catch the issue, but because

Aside: Honestly, I don't really blame you for getting caught out by that bug. I'm by no means an expert on anything to do with OAuth, but it looks like the kind of thing that's a nightmare to catch, because it's misbehavior under the kind of conditions that are--well, only seen when maliciously crafted. If it wasn't something that was known about since the RFC, it would probably have taken a lot longer for someone to find it.

Throwing my two cents in here...I think there's a disconnect between what AI advocates want, and what everyone else wants.

The arguments against genAI tend to point out things like: 1. Its output is unreliable at best 2. That output often looks correct to an untrained eye and requires expert intervention to catch serious mistakes 3. The process automates away a task that many people rely on for income

And the response from genAI advocates tends to be dismissive...and I suspect it is, in part, because that last point is a positive for many advocates of genAI. Nobody wants to say it out loud, but when someone on Reddit or similar claims that even a 10% success rate outweighs the 90% failure rate, what they mean is most likely "A machine that works 10% of the time is better than a programmer who works 60-80% of the time because the machine is more than 6-to-8-times cheaper than the programmer".

There's also the classic line about how automation tends to create more jobs in the future than it destroys now, which itself is a source of big disconnects between pro-genAI and anti-genAI crowds--because it ignores a glaring issue: Just because there's gonna be more jobs in the future, doesn't mean I can pay rent with no job tomorrow!

"You can write an effective coding agent in a week" doesn't reassure people because it doesn't address their concerns. You can't persuade someone that genAI isn't a problem by arguing that you can easily deploy it, because part of the concern is that you can easily deploy it. Also, "you’re not doing what the AI boosters are doing" is flat-out incorrect, at least if you're looking at the same AI boosters I am--most of the people I've seen who claim to be using generated code say they're doing it with Claude, which--to my knowledge--is just an LLM, albeit a particularly advanced one. I won't pretend this is anything but anecdata, but I do engage with people who aren't in the "genAI is evil" camp, and...they use Claude for their programming assistance.

"LLMs can write a large fraction of all the tedious code you’ll ever need to write" further reinforces this disconnect. This is exactly why people think this tech is a problem.

The entire section on "But you have no idea what the code is!" falls apart the moment you consider real-world cases, such as [CVE-2025-4143](https://nvd.nist.gov/vuln/detail/cve-2025-4143), where a programmer who is a self-described expert working with Claude--who emphasizes that he checked over the results with a fine-toothed comb, and that he did this to validate his own skepticism about genAI!--missed a fundamental mistake in implementing OAuth that has been common knowledge for a long while. The author is correct in that reading other people's code is part of the job...but this is difficult enough when the thing that wrote the code can be asked about its methods, and despite advances in giving LLMs a sort of train of thought, the fact remains that LLMs are designed to output things that "look truth-y", not things that are logically consistent. (Ah, but we're not talking about LLMs, even though kentonv tells us that he just used an LLM. We're talking about agentic systems. No true AI booster would "just" use an LLM...)

I actually agree with the point about how the language can catch and point out some of the errors caused by hallucination, but...I can generate bad function signatures just fine on my own, thank you! :P In all seriousness, this addresses basically nothing about the actual point. The problem with hallucination in a setting like this isn't "the AI comes up with a function that doesn't exist", that's what I'm doing when I write code. The problem with hallucination is that sometimes that function which doesn't exist is my RSA implementation, and the AI 'helpfully' writes an RSA implementation for me, a thing that you should never fucking do because cryptography is an incredibly complex thing that's easy to fuck up and hard to audit, and you really ought to just use a library...a thing you [also shouldn't leave up to your AI.](https://www.theregister.com/2025/04/12/ai_code_suggestions_s...) You can't fix that with a language feature, aside from having a really good cryptography library built into the language itself, and as much as I'd love to have a library for literally everything I might want to do in a language...that's not really feasible.

"Does an intern cost $20/month? Because that’s what Cursor.ai costs," says the blog author, as if that's supposed to reassure me. I'm an intern. My primary job responsibility is getting better at programming so I can help with the more advanced things my employer is working on (for the record, these thoughts are my own and not those of my employer). It does not make me happy to know that Cursor.ai can replace me. This also doesn't address the problem that, frankly, large corporations aren't going to replace junior developers with these tools; they're going to replace senior developers, because senior developers cost more. Does a senior engineer cost 20 dollars a month? Because that's what Cursor.ai costs!

...and the claim that open source is just as responsible for taking jobs is baffling. "We used to pay good money for databases" is not an epic own, it is a whole other fucking problem. The people working on FOSS software are in fact very frustrated with the way large corporations use their tools without donating so much as a single red cent! This is a serious problem! You know that XKCD about the whole internet being held up by a project maintained by a single person in his free time? That's what you're complaining about! And that guy would love to be paid to write code that someone can actually fucking audit, but nobody will pay him for it, and instead of recognizing that the guy ought to be supported, you argue that this is proof that nobody else deserves to be supported. I'm trying to steelman this blogpost, I really am, but dude, you fundamentally have this point backwards.

I hope this helps others understand why this blogpost doesn't actually address any of my concerns, or the concerns of other people I know. That's kind of the best I can hope for here.

What if the employer was charged a subscription fee, instead of waiting until they find a hire to charge? Then the incentive is for the company to find a hire quickly, since they're now paying per month instead of per head. Some companies will balk at this, obviously, since existing services charge them per head and they don't know how fast a viable hire will appear...but I'd guess that this would be highly effective at weeding out 'employers' who have no interest in employing any new hires.

(Also, seconding the part about grifts where a candidate is charged upfront. Charging upfront for access to training materials, equipment, or some kind of licensing agreement is often a sign that you're about to get roped into a multi-level marketing scam.)

But we're not talking about an insolvent renter, we're talking about a renter who's making their payments. A renter who makes payments every month at 2500 can, and regularly is, not approved for a mortgage at 2000 a month, even though--based on the payment history--the renter would not only be able to make those payments, the mortgage payment would be easier for them to make--and therefore less risky--than the rent payment.

The problem isn't that the cost of renting is higher than the cost of mortgaging, the problem is that banks treat people who have to make a $2,500 monthly payment to live decently as if they can't be trusted with a $2,000 payment. People like me are charged a premium for shelter because we did things like...be financially responsible and avoid taking on unnecessary loans or credit card debt. And when we ask why we can't have the cheaper option, the response is...the bank doesn't trust us to make a payment that's _easier_ to make than the payment I'm working with right now?

It's blatant nonsense, which makes one wonder what the real reasoning is.

Doesn't he cite several solutions that already exist and have been demonstrated? For instance, he cites voting systems that have already been implemented in two US states, as well as a video describing the mathematical proof of how that voting system affects the outcomes of elections compared to a simple first-past-the-post vote. That's not "not simple or effective", that's "mathematically proven to be effective".

It's not that it costs too much money, in many cases. The money's there. The problem is that the solution is not profitable compared to other actions, which is a different thing entirely.

For example, it is much more profitable to sell recurring treatments than it is to sell cures. You can only sell a cure once per instance of disease, after all, whereas selling a recurring treatment means you have an indefinite stream of revenue. (Similar logic applies to selling software as a subscription instead of as a one-off license.)

When something is "not profitable", that does not mean it costs too much. It means that the thing is not as profitable as other options, which is sometimes a result of excessively costly processes, but is at other times a result of having "do nothing" as an option (which by definition costs nothing, and depending on the field can make quite a lot of money).

Another example of something being "not profitable", but not because it costs more, is public goods. Public transportation, for instance. It is undeniable that good public transportation is a boon to society, but public transport is often framed as a business rather than a public good, and in the context of a business, public transport is simply not as profitable as something like a toll road. Running a toll road is close to "do nothing" compared to running a bus line or train line, since everyone brings their own car instead of using the publicly-provided transportation. The catch is, this is actually MORE costly overall--because many more vehicles have to be fueled and maintained, and cars are relatively inefficient compared to trains. But, because the cost is distributed to the users of the road, the toll road is "cheaper" for the people operating it, and thus more profitable--so if you run government like a business, the toll road is the thing you go with.

IIRC, the companies that stopped advertising with Twitter had asked about whether Elon would handle the Trust & Safety team correctly at a conference right when Elon was preparing to take over as CEO.

The official response was to dodge the question.

Not only can Elon pin blame on the research agency for his own explicit actions, he can't pin blame on the research agency for an exodus that started before the research agency released its findings. It would be like breaking your foot, going on a rollercoaster with a broken foot, and then suing the theme park for breaking your foot. I'm not a lawyer, but in any sane court, that wouldn't hold water.

Parent comment's argument is that married heterosexual couples are less likely to spread HIV, on the grounds that a married couple won't spread HIV outside of that pairing if they remain faithful to each other.

Begging the question...gay people can be monogamous too, does that not count for whatever reason?

This sexual behaviour statistically does not create STD spread, because of negative feedback...

You know that it's possible to infect someone while also impregnating them, right? In fact, this leads to more STD spread than non-procreative sex, because the child then runs the risk of infection as well. There is no 'negative feedback' here beyond "being upset that your partner infected you", which is already a factor in non-procreative sex.

Using punishments and taboos to control these things does not work. You're not incentivizing 'good behavior', you're incentivizing not getting caught--not to mention that, inevitably, the power structure that forms around these taboos starts rewarding people who punish others with the ability to do the taboo themselves.

You realize this is the exact opposite of what happened, right? Governments and churches were very firmly convinced at the start of the AIDS epidemic that it was exclusively a thing that happened to gay people, even though it spreads through any kind of sexual activity. In fact, the LGBT community is largely more careful about STDs than the general public--when it was claimed that monkeypox spread more easily through anal sex (a mirror of earlier bogus claims about AIDS), the LGBT community responded faster than the government did[1].

Turning this around and saying that the gay community "tried to downplay the risks of unprotected sex" is a flat-out lie. The LGBT community has been working harder to share resources about safe sex than most US state governments do, through sites like the Trevor Project. What they have 'downplayed' is the idea that AIDS is more common among gay men because it's more easily transmitted through anal sex. The actual reason that HIV incidence happens more often among gay men is that, up until very recently, getting tested for HIV meant having to tell someone about your sexuality in the 80s and 90s, a time when violence targeting gay men was on the rise[2]. Getting tested could mean getting beaten half to death--or worse--if the wrong person found out, so people avoided getting tested. Would you let someone beat you half to death for 'moral superiority'? (If the answer is 'yes', I suspect you might not understand how severe a beating that is.)

Simply put, you are spreading misinformation. I hope this post helps others recognize that misinformation for what it is.

[1] https://www.cnn.com/2022/07/29/health/monkeypox-lgbtq-slow-r... [2] https://www.nytimes.com/1986/11/23/us/violence-against-homos...

Get a job...

Actually, this doesn't work. Many people who are homeless--and thus, constantly committing small 'crimes' like loitering--actually have jobs. According to recent statistics, 53% of people in shelters and 40% of people living on the street are 'working homeless'.[1] It's simply not practical to live off of a single job in parts of the country where it's easy to get a single job--which makes it harder to make an honest living. And if you can't make an honest living anymore...

Avoid prison to be sure you have a good life...

This is another problem with "Get a job". Most places will not hire someone once they have a criminal record of any kind, which means that going to jail once permanently ruins your life--there are some places that hire people with a record, but those are few, far between, and take full advantage of how desperate the people who work there are. Of course, this is only exacerbated by flaws in the criminal justice system, which include things like "evidence presented as rock-hard proof may actually be complete bunk"[2].

Crime continue to exist because selfish people put selfish needs ahead of sociology and human rights...

I mean, I'd agree with you if you were talking about tax evasion or wage theft. In fact, wage theft makes up a larger percentage of overall theft than any of the things people think of when you say the word 'theft'. However, you explicitly stated that you're talking about people who are poor or who have a risk of going to prison, which excludes a lot of white-collar crime.

[1] https://endhomelessness.org/blog/employed-and-experiencing-h... [2] https://www.propublica.org/article/putting-crime-scene-dna-a...

I feel like having video evidence of a police officer doing something they really shouldn't is neither "mild" nor "disrespect" (although, I guess you could argue that I rapidly stopped respecting the police when I realized just how little accountability there is for these incidents...)

Basically everyone I work with right now is a furry and I met them all through a discord server for fans of MLP who also like compsci. Being a furry has been more effective for my networking (and therefore my career) than any certification I've pursued.

I have to wonder, why do some people just not realize how deeply integrated furries are into the internet's infrastructure? Have they just never looked at their coworkers' profile pictures?

For some people, "going back to your home country" means going back to a place where basic human rights are not protected by law. Further, I'm not sure what having your visa revoked would do to your future immigration prospects--not to mention that, once that visa is revoked, you're technically "in the country illegally", and you may have heard about how badly our legal system treats people, both with and without citizenship.

A romantic partner should not, but some people believe that they deserve authority over their romantic partners. It would be nice to believe that all relationships are handled healthily, but this is something a surprisingly large number of people struggle with, partly because it's not something that you can take a formal training course on.

This argument has been made since at least the start of written records:

And so it is that you by reason of your tender regard for the writing that is your offspring have declared the very opposite of its true effect. If men learn this, it will implant forgetfulness in their souls. They will cease to exercise memory because they rely on that which is written, calling things to remembrance no longer from within themselves, but by means of external marks. What you have discovered is a recipe not for memory, but for reminder. And it is no true wisdom that you offer your disciples, but only the semblance of wisdom, for by telling them of many things without teaching them you will make them seem to know much while for the most part they know nothing. And as men filled not with wisdom but with the conceit of wisdom they will be a burden to their fellows. - Plato, in Phaedrus, ca. 370 BC

While our replacements for parts of ourselves have gotten far more advanced, the fact of the matter is that we haven't stopped being human simply because we can make tools that remember things for us, build things for us, or let us change parts of ourselves more easily.

This is because what makes something human is not our body--an argument that Diogenes famously refuted in about the same era--nor is it merely our minds, though our minds are pretty impressive. What makes us human--what makes us alive, in a sense beyond merely being an animal that isn't dead yet--is what we do with those things. I could grow fox ears and a fluffy tail in the world of tomorrow; I could use an AI to remind myself to self-care; today I already benefit from a thousand different kinds of mass-produced products. But none of that makes me a different person, because I'll still be doing things with my life that meant something to me yesterday--because those things will continue meaning something to me tomorrow.

because Twitter does not ban based on political preferences/opinions.

Because the journalists Musk banned were definitely not banned for their opinions on Musk?

I'm going to preempt the 'harassment' argument--the photo Musk posted, when he was claiming that the journalists caused him to be stalked, was found to have been taken an hour after Musk's jet took off and nowhere near any airport.

This is actually how I found out about several of these services. Elon's finding out the hard way that the Streisand Effect continues to work no matter how hard you swing the banhammer.

...This still ignores examples where sexual characteristics don't actually fit a binary, though. These are edge cases, yes, but they are edge cases that occur in nature. This is why cases like the bee example are important--bees have sexual trimorphism. Drones, workers, and queens all have different sexual characteristics that affect how they reproduce. Based on the reproductive function of bee anatomy, sex is not a binary for bees.

Also, I'd like to point out--for the record--that the ability to change one's sexual characteristics, and the presence or absence of sexual characteristics, has almost nothing to do with one's gender (beyond avoiding body dysphoria). This is an important distinction to make, because while we don't have full ability to change a person's sex (i.e., we don't have artificial wombs yet), a person's gender can be independent of their sexual characteristics (as evidenced not only by trans people, but also by intersex people who identify as cisgender).

Mind linking a source for the CRISPR thing? I was just thinking the other day that having a CRISPR-based "one and done" pill for hormone therapy would be awesome.

You argue that people who are intersex regularly identify as male or female, and do not like being pointed to as trans representation...but that's not describing their biological sex characteristics, that's describing their gender identity. You're describing someone who identifies as cis-male or cis-female, despite their biological sex characteristics.