Yoric

While I agree that handcrafting code has never been any kind of guarantee of secure code, I'd argue that it remains a condition: if all you have is a set of specs (or even worse, specs written by AI and not read carefully by anyone) and no mean to ensure that the implementation actually matches the spec, you essentially have no understanding of what the code is doing, which is security suicide.

Of course, AI reviewers and security tools will catch some security errors, but this should come as an addition to a proper security design, not instead of it.

I've started to use the term "downskilling" for what a number of companies are going through in the age of agents: layoffs of key employees in the name of increased efficiency, developers being incentivized to outsource their thinking when writing code, tests, specs, docs or reviews, agents increasingly replacing communication between team members...

Not GP, but please take a look at CloudFlare's data. As far as I understand, it was only measuring indexing bots, without attempting to look for anything political or shady.

I've been a moderator (on smaller platforms). Can confirm that it's standard.

> If AI found a way to exploit clinical trial design, it would be noticed and the errors corrected.

Do you think so? So far, AI is gaming lots of things, and I don't see much fixing in the processes.

Asking as a curious bystander: would that be sufficient?

I'm not familiar with ModernBert (my understanding stops around the original Bert), but it feels like this is asking it to do lots of heavy lifting. Can it do that much?

In fact, I'd argue that [vibe-]coding is the least interesting thing that LLMs can accelerate. I'm really frustrated because LLMs are insanely powerful, but also insanely misused.

> The more pertinent question in my mind is.. why does it still matter? Your customers don’t care about elegant code, they care about working products.

No, they don't care about nice code, but they do care about code that actually works. In my experience, there is a correlation between code that has been thought out correctly and code that hasn't, in terms of security, safety, compliance, data-safety, performance, etc. And so far, all LLM-produced code I've seen is severely lacking.

> That assumes both pieces of code are functional though, and you do need to babysit LLMs to make sure it actually remains functional.

So, I guess we agree on that :)

> It’s also just false. The good LLMs already produce output far better than the average programmer in most domains.

I hear this being repeated, but every time I've asked a LLM to come up with code without proper supervision, the result only superficially looked correct, but didn't stand up to scrutiny.

I wonder why our experiences differ.

Worth investigating, but I suspect that it's more complicated: as far as I understand, many billionaires are billionaires in valuation, but own relatively little currency.

I assume that GP speaks of reducing the salaries for C-suite to the levels they had before Reaganism? I personally suspect that this would be pretty good for companies.

Or perhaps they're thinking of nationalization, which leaves me a bit more skeptical.

> So I would say we are not normalizing failures (yet) but rather normalizing legacy.

Nice way of putting it.

Nah, jump straight to pi-calculus.

Unrealistic deadlines, productivity being measured in PR counts and tokens spent, and generally a 100% focus towards having a software factory produce all code.

In our latest evaluation, one of the criteria was whether you trust AI, with "trust" being defined as letting the AI write all the code, without reviewing it. And of course, not trusting AI meaning that you were behind the curve.

I'm confused. Aren't you actually describing racism?