Remix.run Logo
newsomix9xl an hour ago

One article said secure software was here because of AI, this one says it can now be performant.

Yet when I ask for code it writes, by default, both slow and insecure code that mostly works. Kinda.

As I try to get AI to rewrite it into more secure, less bloated and optimized code is when it starts to randomly crash.

Then I read articles about how AI is "moving too fast" and cry.

y1n0 an hour ago | parent | next [-]

It's all about the test suite. The test suite becomes an executable specification, and the better the spec, the better the results you can get from AI.

devin 39 minutes ago | parent | next [-]

The very first thing many people did with AI is start calling the automated tests it writes good enough to capture the desired behavior. Writing tests isn't a whole lot of fun for most, so now the thing that it is supposed to help ensure we're not evolving our software into piles of trash is, in fact, one of the most neglected parts of vibed out codebases.

archargelod 36 minutes ago | parent | prev | next [-]

How do you write a spec for correctness? Only the small and unimpressive programs can be checked exhaustively.

aw1621107 27 minutes ago | parent | next [-]

> Only the small and unimpressive programs can be checked exhaustively.

Even if you assume that statement is true, there are techniques other than exhaustive checking/model checking. Proof assistants/theorem provers/etc. like Rocq/Isabelle/Lean are quite capable of formally verifying programs without needing to exhaustively explore the search space.

I'd question the accuracy of that statement in general as well; model checkers like CBMC/TLA+ are handy for proving properties about interesting systems. The latter, for example, sees use for verifying concurrent/distributed systems, which I think can be reasonably described as more than "small and unimpressive"

thorian1828i03 31 minutes ago | parent | prev [-]

Not true at all! Most of the HTTP APIs, and a good chunk of the webapps, that I've worked on can be defined as a combination of an API spec that carves out valid and invalid behaviors, and a set of behavioral tests for the workflows that the client users care about. Working from a codebase which is generated from a spec document (e.g. OpenAPI or gRPC) and use of tools like https://pkg.go.dev/net/http/httptest and https://bun.com/docs/test/dom makes this a pretty achievable goal in practice.

noosphr 24 minutes ago | parent | prev | next [-]

It really isn't.

It's s about subpar models trained on subpar data doing subpar work.

The only reason why anyone takes it seriously is that we've had a glut of subpar developers for 30 years so it all balances out in the end.

hodgehog11 12 minutes ago | parent | next [-]

No it really is about the test suite, and provably so. As another poster pointed out, speed is a superoptimization problem and the test suite provides the constraints. If the constraints are appropriately set, even a naive genetic algorithm will eventually improve the outcome over time, provided suitable mixing of the proposal scheme. LLMs provide measurably better proposals than naive approaches, so the entire chain is sound. The issue really is an inability to set appropriate constraints on what the user is looking for, and poor quantification of the multiple objectives one should try to balance in practice. What's great is that's a human problem. Diverting that to the models is obviously a disaster.

I agree that there has been a glut of subpar developers for years, and that has lowered the bar significantly. This is mostly because core values shifted. So let's keep our eyes on what really matters rather than acting elitist.

17 minutes ago | parent | prev [-]
[deleted]
jongjong 44 minutes ago | parent | prev | next [-]

It's part of it but you need good systems thinking in order to write good tests. The kind of thinking which requires years of software engineering experience to acquire.

Also the architecture really matters now because a poor architecture will lead to more weird edge cases and require more exotic tests to plug all the holes.

zx8080 29 minutes ago | parent | prev | next [-]

It's all now about money extraction from the areas dependant on software, not the sofrware itself.

moron4hire an hour ago | parent | prev [-]

If you have such a test suite then you really don't need AI to write the code for you.

thorian1828i03 38 minutes ago | parent [-]

Writing a benchmark test is about 100x to 1000x easier than writing optimizations. A benchmark test can be as simple as:

    func Benchmark(b *testing.B) {
      for range b.N {
        runCodeUnderBenchmark()
      }
    }
Actually optimizing the runCodeUnderBenchmark() function is far more difficult.
petra 21 minutes ago | parent | prev | next [-]

Regarding speed - now it takes much less learning to use a fast web framework(like Meteor), this means web based software will be more performant.

Regarding security - i wonder: can we develop a framework that is responsible to 100% of the security, with zero responsibility for security on the app developer?

jayd16 16 minutes ago | parent | prev | next [-]

Aha, the problem is you're asking for code that works.

calvinmorrison 34 minutes ago | parent | prev | next [-]

I cannot imagine how nitpicky people are. AI went from 'good autocomplete' to 'I just tell it to do an entire thing and it does it and it works the first try'.

Maybe pick languages that are more boring. That's what works for me. It worked for hiring crappy outsourced programmers and it works for AI. It seems to do well with PHP - no long running processes / side effects. it works great with golang, simple language spec, and a very common style of writing.1

paulddraper 17 minutes ago | parent [-]

The goal posts always move

etoxin 19 minutes ago | parent | prev | next [-]

[dead]

SadErn an hour ago | parent | prev [-]

[dead]