I don't understand these types of comments. Aren't the CVEs epic today with human written code? What difference does it make then? You want no CVEs, make software engineering into a real gate-kept engineering professions with accountability chains, government regulations, formal education, etc.

▲

KaiserPro 2 hours ago | parent | next [-]

By default Claude chooses old versions of libraries. without something that checks for CVEs you're gonna be shipping criticals like no tomorrow.

Yes, there are more CVEs discovered every day, but, if you don't patch, the hacker doesn't have to try.

▲

akersten 3 hours ago | parent | prev | next [-]

> You want no CVEs, make software engineering into a real gate-kept engineering professions with accountability chains, government regulations, formal education, etc.

This will not only not prevent CVEs, it will also make everything a giant pain in the ass

	▲	fnoef 3 hours ago \| parent [-]
		Of course it will. But at the same time I don't see building falling left and right like CVEs in software. So don't tell me agents write bad code, because humans do as well. The only way to prevent this (or minimize), is to turn software engineering into real engineering.

▲

bigstrat2003 2 hours ago | parent | prev | next [-]

> Aren't the CVEs epic today with human written code? What difference does it make then?

LLMs cause errors at a noticeably higher rate than human devs do. If you lean on them without actually checking what they wrote, the error rate in your software is going to go up.

▲

frumplestlatz 3 hours ago | parent | prev [-]

"If it works, ship it" is very different from "If it works, and I understand it because I wrote it, ship it".

Does the LLM understand it, in detail? Can you trust its interpretation of the information and instructions you provided? Did it independently make an adverse decision you haven't noticed, because you didn't read the code? Was the model missing any information it required -- and would you know if it was?

LLMs depend on humans and human oversight to ensure they have the information required to make the right decisions, to catch when they don't, and to steer them based on your much more complete understanding of the broader context and requirements. You can't rely on them to do that thinking for you (yet?).

	▲	fnoef 3 hours ago \| parent [-]
		I’d argue that most people also don’t understand code they read from their colleagues. Or if they do, then they don’t understand the entire context of the app. You said LLM need human oversight and it’s true, but it does not imply you have to read the code. I think we are going towards a place where code no longer makes sense, you just describe what you want in English, and the LLM just builds directly in machine code. You then build different verification tests to make sure the program is doing what it’s suppose to do.