koliber

Reviewing code by layer is easy if the code is written layer by layer. When I used to code, this ways the highest level of craftsmanship I always aimed at, and rarely hit. It required excellent understanding of the problem, a good plan, and disciplined execution. This was rarely possible in a ship-ship-ship business and a family life.

My ideal state was when I had a PR and each commit had a different layer - DB, controllers, feature A biz logic, feature B biz logic, APIs, backend UI prep, frontend UI, polishing, bug fixing, test cases, touchups, etc. It felt marvelous when it happened.

With AI, this is doable much more easily. Even if an LLM produces one giant commit, just ask it to refactor the code and recommit it to a new branch with one commit per layer. This is the kind of "translation" work that LLMs are now excellent at. Reviewing such PRs is a pleasure. The work to build the code layer by layer is one prompt.

Not yet, and not completely.

Some accountants need to make judgement calls. LLMs are not great at many judgement calls yet.

Curious where you're getting this confidence from.

> This is not how it (supposed to) work.

I agree. But it is how it works.

That's the difference between theory and practice. In theory, there is no difference.

> You still seem to not understand the problem.

You seem to make assumptions about what I understand and what I don't. It's presumptive but it would be silly to try to argue about this.

The problems we have no with AI generated code are an extension of the same problem that was always there.

- How do people that have to make decisions get enough of an understanding and context to make good decisions.

- Who is accountable for things.

You're arguing that since now AI is generating code, something changed fundamentally. I am arguing that it's more of the same. The pace changed, and people have to react to make sure that we can continue to control things, but the problems are the same.

- Now, we can't ask people about the code but have to ask machines about it.

- As before management and "the company" are responsible in theory. In practice, courts (through fines) and insurance companies (through higher premiums) are the ones who enforce that accountability via financial pressure.

I don't think I misunderstood the question.

In my team people left and that understanding was gone too. Over time, the level of understanding was less and less.

I agree with you that strictly speaking, there is no active human understanding of code that LLMs generate. However, we have an on-demand ability to get an arbitrary level of understanding quickly by leveraging the same LLMs. The amount of effort for any person to get an understanding of that code is in my opinion smaller than what it was with humans.

With a human team, if I wanted to understand some code, I would read it, meet with the authors, and slowly build up that understanding. With LLMs, I can ask it to slice and dice the code and present it in any way I feel would help me understand it, immediately.

Summarizing and transforming ideas is something LLMs are fantastic at. They are an incredible tool to understand foreign code.

I was once employee nr. 1 at a startup and the lead engineer. For a number of years I understood every nook and cranny of the system and knew what every line of code did.

The company got successful. At some point I had a team, and then multiple teams. Gradually, I had to let go of that level of understanding and delegate it to others. When I was overseeing 50+ engineers, I only had a high level understanding of most the systems, and only got involved in lower-level decisions rarely. All the new code was created by my team, and it varied in quality.

If I had AI tools back then I could ask it to explain things to me that my team did and have a 2nd set of eyes which had a different set of biases and abilities.

That's how I deal with it right now. I ask one AI to gen the code based on a design. I work with the AI tool and see how it builds the system out. I intervene where it starts doing things I don't want it to do. I ask another AI to review the PR after the code is written. I sometimes dig into design choices and ask it to explain them, rate them, and offer other alternatives. I sometimes change things, and occasionally scrap the whole thing and start again with better guidance.

So far I've written more code without an outage this way than ever before with a team of human developers. AI screws up too. But right now, at Opus / ChatGPT Sol and higher models, on average, it makes fewer mistakes than humans did. Any time they slip through is because I am rushing too quickly. In a pre-AI human dev team we would call this a process or management failure.

The more dangerous a decision and the harder it is to roll back, the more time I spend reviewing it. This has served me well when managing people who write code, and seems to work well with AI.

AI is a tool that needs to be managed. It won't do all the work for you, but it can speed you up greatly.

When Trump screwed with the tariffs we saw exactly that. Arbitrarily messing with tariffs is one of the risks that causes people to think keeping gold in the US is not entirely safe.

There is a program that allows university students to come to the US, work for a bit, and then stay for a month or so longer. It’s called work & travel. Many entertainment companies like six flags and casinos hire them. I have many friends who have done this years ago. The pay was low but they had a fun summer, travelled a bit, and came come with a new laptop or a good SLR camera. It wasn’t glamorous but a generally positive experience.

Exactly. We need "observability tools" that allow us to keep a handle on things we can't see or comprehend innately.

We have such tools for a large number of events that we're incapable of witnessing or understanding in "raw form".

We can't possibly read through thousands of raw records of recordings of individual's heights and make sense of it. But we can use Excel to calculate the average in seconds. We can chart the results and the image is perfectly comprehensible. We can trust the average calculation and the image because we trust the mechanism for transforming the data. We have what I would call a trusted path of provenance. We don't need to nor do we want to read the raw data.

Now we need things like this of the 2nd order. We need mechanisms of transforming trusted paths of provenance into things we can look at and easily verify.

We can do formal verification of code that would be hard to do by hand. We need formal verification tools for formally verifying formal verification tools. Eventually we will need multiple layers of this. As long as the chain and reasoning is intact, we should be alright.

It's kind of like with a horse. A horse is much stronger than us, but we can control it by pulling on two strategically connected pieces of rope.

They paid for it, via property taxes, either as owners, or less directly, via rent.

I am convinced that you are trolling.

Road damage is proportional to the 4th power of the weight of the thing that passes over them.

I hope you were just making a snarky joke as there is effectively no road damage done by pedestrians and cyclists.

I do it all the time, and I get feedback about tons of things that need to be fixed. I ask Claude to review ChatGPT code and vice versa. I also ask Claude to review Claude code, and it finds issues as well. I ask it to review copy I wrote and offer style, grammar, voice, and consistency suggestions. LLMs make pretty darn good reviewers.

In this case, what matters most is that the AI security review raised real issues that needed to be fixed. That is valuable.

I am an experienced engineer and am building a product actively right now. I started pre-AI, and cautiously adopted AI. I am using AI tools a lot now, but still dedicate a lot of my attention to validating it's output and design decisions.

I recently asked it to review my code and configs from the security perspective. Wow! 90% of the things it identified were MY bad decisions dating from pre-AI development. I am honestly humbled and impressed at the same time.

AI can create slop, and it can create quality products. It depends who is using it, and how.

Likely, but I am not sure. There were a few well-publicized cases where someone used an AI agent to hack a system. In many cases the exact details were missing. Sometimes it was the creator of the agent. At other times it was an independent lab. In one case it was someone who was tinkering and hacked the appointment system at a gym or something like that to get a better slot.

That's my point. The articles often gloss over or omit who was using the agent and focus on the fact that it was the agent that did the hacking. It's worded to absolve whoever operates the agent, and that is where responsibility ultimately lies.

I think you and I agree. If it was OpenAI employees who did the hacking using their own agent, then the analogy would be like you describe. I wish the article made that clear.