Yeah, I have never understood the over reliance on AI. Writing the code is not the challenge. The time it takes to push a new feature and test it out is often trivial, maybe a few hours.
The real challenge is forming the new ideas in the first place and most of those new ideas coming either from using the code as a product or time spent maintaining and refactoring large code.
Anyways, if you want to continue on the path towards regaining control and take it to the next level I wrote something similar here: <a href="https://blog.sharefile.systems/be-brave-go-low/" rel="nofollow">https://blog.sharefile.systems/be-brave-go-low/
Wriring the code is not the challenge, but it's what was taking up most of the time. Not the typing itself, but also because I had to think of how to implement it.
Now I can just say "add 2FA" and in 5 minutes, while I test something else, it is done.
It also made iterations a lot faster, you can try something out, see how it feels, if it doesn't work, you can just trash all the code and start again.
Haven't typed a line of code or read any code for over 6 months now.
And I used to love coding and be a competitive programmer, but this is how "coding" goes nowdays.
I have a mental model of what it would do, and how it would work, and I ask questions to confirm things and tell it to watch for specific gotchas. Then simply test the feature myself a bit.
Security-wise, I think the latest cyber models are better than me anyway at finding vulnerabilitates and pentesting such features.
Plus 2FA is a very common pattern, so it likely has in the training dataset many really good implementations.
> Security-wise, I think the latest cyber models are better than me anyway at finding vulnerabilitates and pentesting such features.
I don't doubt that, but they are equally good in making mistakes, over-engineering, or adding things you never asked for. They have all sorts of patterns in their training data from excellent to inadequate and I find them challenging to guide them consistently in one direction. Also with questions and tests, they can add something extra you didnt need and you dont know about, so your scrutinizing questions and test cases could miss that.
At least for myself, I didnt find them reliable enough yet to do what you describe and just not look at the code at all.
This app[0] is entirely "vibe-coded", started on bolt.new which was like the OG way to vibe code and slowly improved over 1-2 years using various models.
I have no idea how the code looks like, and barely even tested the app entirely, because it is still not released yet, but I do think a lot about new features, tweaks, improvements, etc. Years of programming and game development did help, but I don't think anymore that code is relevant, as long as it looks ok and feels good.
Sort of, it's more of a heurisric of bugs found so far. There are very rarely any bugs, most of the changes I request are for tweaks/logic changes, not bug fixes. Usually things just work.
Also, I barely tested and kept changing things simply because of this: whatever I ask for, seems to work as expected.
No, it was about testing only. I will only do a full test of the app when it's ready to be released, otherwise it makes no sense, as the app/product/flow still changes a lot. It's like prototyping a game, you try it a few times, see what's fun, what's not, and keep iterating. Only once you think it's good enough, you can start fully testing and polishing it.
Even after release, I don't see reasons to check the code if everything works and people are happy with the app.
Firefox had an unsupported missing WebAudio. It should be fixed now, and I've updated my workflow to also test on Firefox. Let me know if the crash was in a different browser (not Firefox).
Right, I missed that context that this was about your own app still in getting the idea right/prototype phase. I was talking more in general and would be quite concerned if with today's LLMs it was my bank/government backend system, handling my financials and personal data, written without no one ever looking at the code.
As someone who has an ide open with claude/codex running, I can never imagine leaving security up to models.
Models have found vulnerabilities that i wasnt aware of sure, but their fixes to the bugs they found often included "overengineering". In this case by "overengineering" i mean optimizing for passing test cases related to said vulnerability they found. eventually i have to step in to make things coherent and make sure that future agent can look at this part of my code and copy it to not introduce that particular class of vulnerability. Otherwise if i dont do that similar vulnerability and codesmell keep appearing throughtout the codebase.
I have increasingly automated encrypting and rotating secrets and setting permissions on them including better network level practices. Thanks to AI which helped me quickly implement those. So security wise i am better because of AI? But I also attribute it to my know how rather than the AI because I have never seen AI suggest robust but simple security postures.
It’s equally good at catching mistakes as it is at making them. So you put it in a loop, write code, make mistakes, catch mistakes, write code, make mistakes… etc. Eventually it converges and stabilizes. That process can take weeks. So the question is: when is it worth it versus not?
austin-cheney · · focus · HN ↗
The real challenge is forming the new ideas in the first place and most of those new ideas coming either from using the code as a product or time spent maintaining and refactoring large code.
Anyways, if you want to continue on the path towards regaining control and take it to the next level I wrote something similar here: <a href="https://blog.sharefile.systems/be-brave-go-low/" rel="nofollow">https://blog.sharefile.systems/be-brave-go-low/
XCSme · · focus · HN ↗
Now I can just say "add 2FA" and in 5 minutes, while I test something else, it is done.
It also made iterations a lot faster, you can try something out, see how it feels, if it doesn't work, you can just trash all the code and start again.
anygivnthursday · · focus · HN ↗
XCSme · · focus · HN ↗
Haven't typed a line of code or read any code for over 6 months now.
And I used to love coding and be a competitive programmer, but this is how "coding" goes nowdays.
I have a mental model of what it would do, and how it would work, and I ask questions to confirm things and tell it to watch for specific gotchas. Then simply test the feature myself a bit.
Security-wise, I think the latest cyber models are better than me anyway at finding vulnerabilitates and pentesting such features.
Plus 2FA is a very common pattern, so it likely has in the training dataset many really good implementations.
anygivnthursday · · focus · HN ↗
I don't doubt that, but they are equally good in making mistakes, over-engineering, or adding things you never asked for. They have all sorts of patterns in their training data from excellent to inadequate and I find them challenging to guide them consistently in one direction. Also with questions and tests, they can add something extra you didnt need and you dont know about, so your scrutinizing questions and test cases could miss that.
At least for myself, I didnt find them reliable enough yet to do what you describe and just not look at the code at all.
XCSme · · focus · HN ↗
I have no idea how the code looks like, and barely even tested the app entirely, because it is still not released yet, but I do think a lot about new features, tweaks, improvements, etc. Years of programming and game development did help, but I don't think anymore that code is relevant, as long as it looks ok and feels good.
[0]: <a href="https://ultimidi.com" rel="nofollow">https://ultimidi.com
sarchertech · · focus · HN ↗
>barely even tested
So the lowest stakes possible and you have absolutely no idea what bugs are waiting.
XCSme · · focus · HN ↗
Also, I barely tested and kept changing things simply because of this: whatever I ask for, seems to work as expected.
parineum · · focus · HN ↗
XCSme · · focus · HN ↗
It's one thing to test once and find 10 bugs, and another to test 10 times and find 1 bug.
ndbe · · focus · HN ↗
[dead]
thwarted · · focus · HN ↗
This is worded as if knowing how the code works and testing it is hinged on it being released.
XCSme · · focus · HN ↗
Even after release, I don't see reasons to check the code if everything works and people are happy with the app.
podgietaru · · focus · HN ↗
XCSme · · focus · HN ↗
XCSme · · focus · HN ↗
anygivnthursday · · focus · HN ↗
sarkarghya · · focus · HN ↗
Models have found vulnerabilities that i wasnt aware of sure, but their fixes to the bugs they found often included "overengineering". In this case by "overengineering" i mean optimizing for passing test cases related to said vulnerability they found. eventually i have to step in to make things coherent and make sure that future agent can look at this part of my code and copy it to not introduce that particular class of vulnerability. Otherwise if i dont do that similar vulnerability and codesmell keep appearing throughtout the codebase.
I have increasingly automated encrypting and rotating secrets and setting permissions on them including better network level practices. Thanks to AI which helped me quickly implement those. So security wise i am better because of AI? But I also attribute it to my know how rather than the AI because I have never seen AI suggest robust but simple security postures.
ModernMech · · focus · HN ↗