When the combustion engine was invented, and we got the means by which we could accelerate our trip by 10x, and at the same time scale it to multiple people, we didn't tell the humans to keep pushing the vehicles by their hands, didn't we?
As a developer you are more akin to a car mechanic, who’s still expected to know how the engine works even a century after it was invented, rather than a driver, who is just the user in this parallel.
Mechanics I've been to generally have no idea about how things actually in the car work - from what I could understand, area is full of recurring problems, and this exactly benefits mechanics to solve them through trial and error approach rather than understanding much how underlying things work. Pretty much close to what I would say SWE will turn into, there's no other choice IMO in foreseeable future.
I think you underestimate the skill of more experienced mechanics. Tractor (as in 18 wheeler) and master mechanics tend to know what’s going on under the hood in detail.
I’m sure there are many of those, but like everything, there are tiers. I’m sure we’ll get something similar in SWE, but my hope is that you’ll still be able to choose to be a high tier engineer if you wanted to
Evidence so far does not suggest people driving off a cliff so while a valid concern it's not a likely one. We also acknowledged that the benefit of using a vehicle is such that it outnumbers the risks it may introduce. We never said there will be no risks attached.
We’ve only been on this train for 3-4 years, and in that period, we’ve already invented terms for this kind of vibe-coded, highly-breakable crud. We’ve also had a few, relatively high-profile in their spheres bugs come out and hurt people’s real, lived experiences.
And that’s just the stuff where the house of cards failed quickly.
Software by definition has always been and will remain broken in one or another way. AI makes no difference or whatsoever. Arguably, it will help raising the quality of software.
Exactly. That would mean going back to square one, and I also personally don't review the code anymore but I am more focused on asking the model to demonstrate the value it created through benchmarks, workload-generators, and e2e tests.
Mostly it proves as a valid approach, barring the bugs the model can introduce to value-demonstrating benchmarks which can of course skew the evidence on hypotheses, and thus code trajectory the model opts to go with.
The problem I see with this is really that I am not anymore under the control but I am not sure I see other alternative. I am becoming more and more like a system observer with surface-level understanding of the system rather than the engineer with zoomed-in level of understanding of how the code actually behaves. Perhaps we're transitioning into a QA roles present.
Assuming you're investing aggressively and not touching that money for the next 20 years, with the nominal return of 6% per year, adjusted for the inflation rate of 3% per year, 1M will increase to 1.8M. Not sure how you came up with 8M.
Your initial response made it sound as if Xiaomi did nothing wrt chip design and all the hail goes to "ARM engineers" which is simply not true. Had that been true we would have dozens of chip designers which we don't.
It occurred to me as well that this is ragebait trolling too since being disconnected this much from reality would have been concerning. The author's app can be rewritten with the use of AI in one day (pessimistically speaking).
gist was certainly not implying that it was not possible to do it or that some people won't continue doing it but the point was rather that the pool of such people or such projects will significantly decrease because software has now (mostly) reached the abundance state where all of these technical details start to matter less and less for general consumption.
Parent comment was likely about how are you supposed to put LLM into your chip. Commodity ICs are already optimized down to their minimums wrt compute/memory/storage. Ultimately, I think it will prove that RE examples like this are going to become a difficult problem to solve.
I misunderstood you then, sorry. Yes, that makes complete sense but ultimately I think this will likely not be enough. Implementation will be hardened but new models with better capabilities will be released, and will discover vulnerabilities that would not have been caught or discovered with prior models.
Hey, traditional hand coder fellow ... the times have past and the future is already a present. I never have been this productive before, and it's been ~20 years that I spent coding. System level programming. Few years back I would have said the bottleneck is not in spelling out the code so we wouldn't see that much AI impact but boy I was wrong. Writing code has never been this cheap, both in terms of time resources and $$$. Now I can iterate over the ideas I didn't have the capacity before, both intellectual and time-wise.
Like, who cares? In today's present, I wouldn't bother writing the article myself neither besides giving the instructions and auditing the output. Substance is what matters
I struggled to understand the article, it doesn't properly explain what the exploit is in a way I could immediately understand, after staring at it for a bit and reading comments here I think it's a hardware register that's exposed to user software that shouldn't be but I really didn't understand that at first glance ("Poke the DRAM controller" made me think a hardware exploit) and I'm still not sure if I'm right about that (if it is, just start by explaining that instead of all the unnecessary filler and diagrams and animations of the Mona Lisa being scrambled and talk of bath salts which I still don't understand the relevance of)
Ultimately, yes, this seems to be a memory controller register that should not be exposed to ring 0 or above.
Ring -1 needs DRAM, so it tells the memory controller to give it some blocks. The memory controller hands back a “physical” address, and promises not to let anything but ring -1 access that address.
The exploit takes advantage of that control register to remap the same DRAM blocks to a different physical address. Since the memory controller only promised to protect the physical address it handed back, that protection is bypassed when using the new address.
There are several theoretical ways to mitigate this exploit, but it remains to be seen if the system is sufficiently field-upgradeable to defend.
Assuming this is a genuine question, here is why people care, and why this sort of writing is a waste of everyone's time.
LLMs can of course generate a lot of text about a subject, but they are still quite bad at generating a piece of writing with a coherent point. Remember how in grade school they teach you that your writing should have stuff like "introductions" a "thesis" and "topic sentences" and "conclusions"? How these things give structure to your writing, communicating to your reader both what they are reading about and why you are telling them about it? LLMs still don't seem have a model for the why part of writing. They can generate large homogeneous blobs of text on the topic at hand, but fail to differentiate the important parts from the details.
For example: all those LinkedIn cliches that LLMs are so fond of - "it's not X, it's Y", rule of 3, etc. - these are tools for bringing focus to the most important points. Even terrible LinkedIn posters implicitly know to use these cliches to drive home their (usually anodyne) messages. LLMs don't understand this, so they just use linkedin cliches everywhere, turning the whole thing into a breathless monotone.
Besides all of that - unless you've somehow missed the constant parade of people begging others to stop sending them LLM-generated prose, and all the reasons they've given for why it's actively bad for everyone involved - it seems like "who cares?" is a bit of a disingenuous question, and one you could have easily answered yourself.
> I wouldn't bother writing the article myself neither besides giving the instructions and auditing the output.
The article would be better with just the instructions and audited output. All the LLM added bloat is tiring and distracting; it's like an article from New-Yorker or Wired.
Well for one thing I also trust most people I respect to not suddenly have someone else speaking on their behalf in their voice with no disclosure in most contexts where it would not be normal, yet that seems to have happened here. So while I personally do still trust and even respect the author, I can't help but empathize with someone who is suddenly a bit more skeptical.
Speaking as someone who posts a lot of stuff like this, the question isn't "Do I use AI or not?" The question is, "Do I have time to deal with writing this up for public consumption or not?"
This was a relatively complicated post of the sort that we are lucky to get in any form, AI-assisted or otherwise. Does it meet my personal stylistic standards? No, it's too LLM-ish. Assuming I cared about the presentation at all -- which I don't always, but would here -- I wouldn't be able to stop myself from fixing that in the process of reviewing it. Is it the usual bucket of slop? Emphatically no.
I wonder if the author asked an LLM to turn his Black Hat talk track into a blog post. I can’t imagine prompting an LLM to produce a post this organized and fact-dense (if stilted in tone) would be any quicker than just writing it up myself.
You are literally asking this to people who clearly care...
> In today's present, I wouldn't bother writing the article myself neither besides giving the instructions and auditing the output.
Then why exactly are you even bothering to reply to me instead of having Claude do it and auditing the output? If HN didn't have a rule against it, would you even bother replying yourself?
But really, there's a fair bit more to unpack here than just that. Why wouldn't you bother? Is writing a README.md about some project you worked on really that hard? Even with heavy LLM assistance, I'd wager to guess this project, which clearly involved working on real hardware, was more than just prompting. So clearly there was human effort other than prompting. And I do respect that, but I want people who write things to respect my time. I'm not asking them to disclose every tool they use, I'm asking them to not waste our time with crappy irritating Claude writeups. Whether it's explictly specified or not, we know.
Frankly I struggle to believe that people don't really mind if someone else speaks for them in their own voice, just because they're too fucking lazy to speak for themselves anymore. We've had competent GenAI for like a year or two, at this rate people are going to forget their potty training in another few months.
> Substance is what matters
Substance matters, which is not great for LLMs, because they put out text that has far more fluff than substance. What, however, is far worse for LLMs, is the fact that kick and scream and cry all you want, but: style and presentation matters, too.
It is absolutely true that if you just dropped a very brief blurb that all AMD CPUs from a certain generation can be pwned it would have a decent chance to hit the HN frontpage just out of sheer interestingness. That is not because the style and presentation doesn't matter, it's just that the substance is significant in spite of the bad presentation and style.
And absolutely, we can easily forgive someone for simply not being very good at the presentation and style part, certainly I'm not really an expert at it. But this author has released plenty of great hits before, so I damn well know they can. It's a serious disappointment to see them downgrade to irritating, grating Claude garbage output.
My question was genuine because I don't understand people who are even as of today such a big skeptics while the evidence surrounding us suggests that LLMs are far away from what you are trying to imply. I am not saying nobody should be skeptical of it, we all should in some way but not in an extreme way. FWIW I didn't find anything garbage in the README you're suggesting it is, reads pretty well despite the fact that it feels LLM-ey. I'm not here to argue really, I am successfully using LLMs for a fairly non-trivial coding day-to-day, in domains such as distributed systems, storage engines, and database kernels, so whenever I read comments on HN like "it is a LLM garbage" it always makes me stop for a moment.
To show the world you're a "world class talent", whatever that means, also suggests you would either have to be a genius or have enough resources to work on your side quests. Latter implies you're well off so, no, I don't think there's zero correlation between the two in all cases.
reply