16 ms·

Cloudlflare builds OAuth with Claude and publishes all the prompts

• thih9 1y ago
  Congrats and thanks for sharing, both the code and the story. Which Claude plan did you use? Was it enough or did you feel limited by the quotas?
  • kentonv 1y ago
    This was mostly Claude Code, which runs on API credits. I think I spent a two-digit number of dollars. The model was Sonnet 3.7 (this was all a couple months ago, before Claude 4).
• tonyhart7 1y ago
  same argument with me but only for claude another models feels like shit to use, but claude is good
• gregorywegory 1y ago
  From the readme: This library (including the schema documentation) was largely written with the help of Claude, the AI model by Anthropic. Claude's output was thoroughly reviewed by Cloudflare engineers with careful attention paid to security and compliance with standards. Many improvements were made on the initial output, mostly again by prompting Claude (and reviewing the results). Check out the commit history to see how Claude was prompted and what code it produced. "NOOOOOOOO!!!! You can't just use an LLM to write an auth library!" "haha gpus go brrr" In all seriousness, two months ago (January 2025), I (@kentonv) would have agreed. I was an AI skeptic. I thoughts LLMs were glorified Markov chain generators that didn't actually understand code and couldn't produce anything novel. I started this project on a lark, fully expecting the AI to produce terrible code for me to laugh at. And then, uh... the code actually looked pretty good. Not perfect, but I just told the AI to fix things, and it did. I was shocked. To emphasize, this is not "vibe coded". Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs. I was trying to validate my skepticism. I ended up proving myself wrong. Again, please check out the commit history -- especially early commits -- to understand how this went.
• chrisweekly 1y ago
  mods: typo in title "CloudLflare"
  • mdaniel 1y ago
    There is no "@" system here, you are welcome to email hn@ycombinator.com or hope that we're still within the edit window for the title
    • tempaccount420 1y ago
      though I bet @dang scripted his own system
      • tempaccount420 1y ago
        I guess not
• unshavedyak 1y ago
  Yup. I'm more skeptic than pro-AI these days, but nonetheless i'm still trying to use AI in my workflows. I don't actually enjoy it, i generally find it difficult to use as i have more trouble explaining what i want than actually just doing it. However it seems clear that this is not going away and to some degree it's "the future". I suspect it's better to learn the new tools of my craft than to be caught unaware. With that said i still think we're in the infancy of actual tooling around this stuff though. I'm always interested to see novel UXs on this front.
  • qsort 1y ago
    Probably unrelated to the broader discussion, but I don't think the "skeptic vs pro-AI" distinction even makes that much sense. For example, I usually come off as being relatively skeptic within the HN crowd, but I'm actually pushing for more usage at work. This kind of "opinion arbitrage" is common with new technologies.
    • diggan 1y ago
      > but I don't think the "skeptic vs pro-AI" distinction even makes that much sense Tends to be like that with subjects once feelings get involved. Make any skepticism public, even if you don't feel strongly either way, and you get one side of extremists yelling at you about X. At the same time, say anything positive and you get the zealots from the other side yelling at you about Y. Us who tend to be not so extremist gets push back from both sides, either in the same conversations or in different places, while both see you as belonging to "the other side" while in reality you're just trying to take a somewhat balanced approach. These "us vs them" never made sense to me, for (almost) any topic. Truth usually sits somewhere around the middle, and a balanced approach seems to usually result in more benefits overall, at least personally for me.
    • unshavedyak 1y ago
      > but I don't think the "skeptic vs pro-AI" distinction even makes that much sense. Imo it does, because it frames the underlying assumptions around your comment. Ie there was some very pro-AI folks who think it's not just going to replace everything, but already is. That's an extreme example of course. I view it as valuable anytime there's extreme hype, party lines, etc. If you don't frame it yourself, others will and can misunderstand your comment when viewed through the wrong lens. Not a big deal of course, but neither is putting a qualifier on a comment.
• abroadwin 1y ago
  Oh hey, looks like it's mostly Kenton Varda, who you may recognize from his LAN party house: https://news.ycombinator.com/item?id=42156977 https://news.ycombinator.com/item?id=42156977
  • davidjfelix 1y ago
    Or Cap'n'Proto, Protobuf, Cloudflare workers, Cloudflare Durable Objects. The LAN house is cool too.
• hattmall 1y ago
  I guess for me the questions is, at what point do you feel it would be reasonable to this without the experts involved in your case? As an edit, after reading some of the prompts, what is the likelihood that a non-expert could even come up with those prompts? The really really interesting thing would be if an AI could actually generate the prompts.
  • dkdcio 1y ago
    Why do you need a non-expert? We built on layers of abstractions, AI will help you at whichever layer you're the "expert" at. Of course you'll need to understand low-level stuff to work on low-level code i.e. I might not use AI to build an OAuth library, but I might use AI to build a web app (which I am an expert at) that may use an OAuth library Cloudfare developed (which theya are experts at). Trying to make "anyone" code "anything" doesn't seem like the point to me
  • nisegami 1y ago
    GP is just quoting the readme, they aren't the author. My 2 cents: >I guess for me the questions is, at what point do you feel it would be reasonable to this without the experts involved in your case? No sooner and no later than we could say the same thing about a junior developer. In essence, if you can't validate the code produced by a LLM then you shouldn't really have been writing that code to begin with. >The really really interesting thing would be if an AI could actually generate the prompts. I think you've hit on something that is going underexplored right now in my opinion. Orchestration of AI agents, where a we have a high level planning agent delegating subtasks to more specialized agents to perform them and report back. I think an approach like that could help avoid context saturation for longer tasks. Cline / Aider / Roo Code / etc do something like this with architect mode vs coding mode but I think it can be generalized.
  • kentonv 1y ago
    (I'm the author of this library -- or, the guy who prompted the AI at least.) I absolutely would not vibe code an OAuth implementation! Or any other production code at Cloudflare. We've been using more AI internally, but made this rule very clear: the human engineer directing the AI must fully understand and take responsibility for any code which the AI has written. I do think vibe coding can be really useful in low-stakes environments, though. I vibe-coded an Android app to use as a baby monitor (it just streams audio from a Unifi camera in the kid's room). I had no previous Android experience, and it would have taken me weeks to learn without AI, but it only took a few hours with AI. I think we are in desperate need of safe vibe coding environments where code runs in a sandbox with security policies that make it impossible to screw up. That would enable a whole lot of people to vibe-code personal apps for personal use cases. It happens I have some background building such platforms... But those guardrails only really make sense at the application level. At the systems level, I don't think this is possible. AI is not smart enough yet to build systems without serious bugs and security issues. So human experts are still going to be necessary for a while there.
• lichenwarp 1y ago
  [flagged]
  • drexlspivey 1y ago
    Until you make your own website, then you love them
    • diggan 1y ago
      I've made plenty of websites, still don't love them and still get served 5+ captchas sometimes, straight after each other. Perhaps I have to give them money, then I'll love them?
      • hombre_fatal 1y ago
        It's still just barking up the wrong tree. You're seeing a downstream effect of widespread abuse on the internet and complaining about people trying to mitigate it.
        • diggan 1y ago
          > It's like complaining that you have to ask someone at Walmart to take a product out of the lockbox so that you can buy it. Kind of similar I guess, but mostly not. Never been to Walmart, so not sure what I'd expect, but I'm guessing that if I ask them to give me that item, they'll give it to me? Because that's not how Cloudflare's captchas work. Sometimes they'll keep on coming indefinitely, until you give up and try again another day. Doesn't happen often when I'm in Spain, but if I'm in Peru for example that happens a lot. In Spain I usually get away with filling in 3-5 captchas, then I'm good to go. So I guess your Cloudflare experience is wildly different depending on what country you live in, which is why you see some of us being very tired of it, and others not caring that much about it, probably because they live in a country with lower "spam-ranking", or however they do it internally.
          • hombre_fatal 1y ago
• paxys 1y ago
  This is exactly the direction I expect AI-assisted coding to go in. Not software engineers being kicked out and some business person pressing a few buttons to have a fully functional app (as is playing out in a lot of fantasies on LinkedIn & X), but rather experienced engineers using AI to generate bits of code and then meticulously reviewing and testing them. The million dollar (perhaps literally) question is – could @kentonv have written this library quicker by himself without any AI help?
  • dkdcio 1y ago
    > The million dollar (perhaps literally) question is – could @kentonv have written this library quicker by himself without any AI help? I *think* the answer to this is clearly no: or at least, given what we can accomplish today with the tools we have now, and that we are still collectively learning how to effectively use this, there's no way it won't be faster (with effective use) in another 3-6 months to fully-code new solutions with AI. I think it requires a lot of work: well-documented, well-structured codebases with fast built-in feedback loops (good linting/unit tests etc.), but we're heading there no
    • necovek 1y ago
      In a "well-documented, well-structured codebase with fast built-in feedback loops", a human programmer is really empowered to make changes fast. This is exactly what's needed for fast iteration, including in unfamiliar codebases. When you are not introducing a new pattern in the code structure, it's mostly copy-paste and then edit. But it's also extremely rare, so a pretty high bar to be able to benefit from tools like AI.
    • motorest 1y ago
      > I think the answer to this is clearly no: or at least, given what we can accomplish today with the tools we have now, and that we are still collectively learning how to effectively use this, there's no way it won't be faster (with effective use) in another 3-6 months to fully-code new solutions with AI. I think these discussions need to start from another point. The techniques changed radically, and so did the way problems are tackled. It's not that a software engineer is/was unable to deliver a project with/without LLMs. That's a red herring. The key aspects are things like the overall quality of the work being delivered vs how much time it took to reach that level of quality. For example, one of the primary ways a LLM is used is not to write code at all: it's to explain to you what you are looking at. Whether it's used as a Google substitute or a rubber duck, developers are able to reason with existing projects and even explore approaches and strategies to tackle problem like they were never able to do so. You no longer need to book meetings with a principal engineer to as questions: you just drop a line in Copilot Chat and ask away. Another critical aspect is that LLMs help you explore options faster, and iterate over them. This allows you to figure out what approach works best for your scenario and adapt to emerging requirements without having to even chat with anyone. This means that, within the timeframe you would deliver the first iteration of a MVP, you can very easily deliver a much more stable project.
• skybrian 1y ago
  Looking at the commit history, there’s a fair bit of manual intervention to fix bugs and remove unused code.
• mtlynch 1y ago
  >In all seriousness, two months ago (January 2025), I (@kentonv) would have agreed. I'm confused by "I (@kentonv)" means here because kentonv is a different user.[0] Are you saying this is your alt? Or is this a typo/misunderstanding? Edit: Figured out that most of your post is quoting the README. Consider using > and * characters to clarify. [0] https://news.ycombinator.com/user?id=kentonv https://news.ycombinator.com/user?id=kentonv
  • kentonv 1y ago
    He is quoting from the project readme. I wrote all this text.
    • mdaniel 1y ago
      Thanks for weighing in here If I might make a suggestion, based on how fast things change, even within a model family, you may benefit from saying Claude what. I was especially cognizant of this given the recent v4 release which (of course) hailed as the second coming. Regardless, you may want to update your readme to say It may also be wildly out of scope for including in a project's readme, but knowing which of the bazillions of coding tools you used would also help a tiny bit with this reproduction crises found in every single one of these style threads
      • diggan 1y ago
        > It may also be wildly out of scope for including in a project's readme The entire point of the repository seems to be to invalidate/validate the thesis if LLMs are good enough to be pair programmers right now. Removing it from the README makes no sense in that context.
        • mdaniel 1y ago
          I did consider that, but the repo isn't called "kentonv does a yolo" it's straight-up labeled as a provider library for CF workers under Cloudflare's brand Some hair splitting about whether including the Claude stanza is "full disclosure," or "AI advocacy," or just because it's cool Anyway, I mentioned the out of scope because if half the readme is about correct usage of the library, and half is about the sausage making, I'd be confused as a reader about whether this was designed to be for real or for funzies
• qsort 1y ago
  I think this is pretty cool, but it doesn't really move my priors that much. Looking at the commit history shows a lot of handholding even in pretty basic situations, but on the other hand they probably saved a lot of time vs. doing everything manually.
• deleted 1y ago
  [deleted]
• jes5199 1y ago
  I’ve been using Claude (via Cursor) on a greenfield project for the last couple months and my observation is: 1. I am much more productive/effective 2. It’s way more cognitively demanding than writing code the old-fashioned way 3. Even over this short timespan, the tools have improved significantly, amplifying both of the points above
  • deleted 1y ago
    [deleted]
  • diggan 1y ago
    > It’s way more cognitively demanding than writing code the old-fashioned way How are you using it? I've been mainly doing "pair programming" with my own agent (using Devstral as of late) and find the reviewing much easier than it would been to literally type all of the code it produces, at least time wise. I've also tried vibe coding for a bit, and for that I'd agree with you, as you don't have any context if you end up wanting to review something. Basically, if the project was vibe coded from the beginning, it's much harder to get into the codebase. But when pair programming with the LLM, I already have a built up context, and understand how I want things to be and so on, so reviewing pair programmed code goes a lot faster than reviewing vibe coded code.
    • jes5199 1y ago
      I’ve tried a bunch of things but now I’m mostly using Cursor in agent mode with Claude Sonnet 4, doing small-ish pull-request-sized prompts. I don’t have to review code as carefully as I did with Claude 3.7 but I’m finding the bottleneck now is architecture design. I end up having these long discussions with chatGPT-o3 about design patterns, sometimes days of thinking, and then relatively quick implementation sessions with Cursor
      • jcims 1y ago
        It will be interesting to see if and how all of this improves standards around how we document the architecture and concepts of software.
• infinitebattery 1y ago
  From this commit: https://github.com/cloudflare/workers-oauth-provider/commit/60197d5e7038c4f4a316c2a6d9edcfb6f66077c7 https://github.com/cloudflare/workers-oauth-provider/commit/... === "Fix Claude's bug manually. Claude had a bug in the previous commit. I prompted it multiple times to fix the bug but it kept doing the wrong thing. So this change is manually written by a human. I also extended the README to discuss the OAuth 2.1 spec problem." === This is super relatable to my experience trying to use these AI tools. They can get halfway there and then struggle immensely.
  • nisegami 1y ago
    Same. But I personally find it a lot easier to do those bits at the end than to begin from a blank file/function, so it's a good match for me.
    • SkyPuncher 1y ago
      Same here. Sometimes you just need time to stew in the problem/solution space. LLMs let me be ultraproductive upfront then come in at the end to clean up when I have a full understanding.
  • diggan 1y ago
    > They can get halfway there and then struggle immensely. Restart the conversation from scratch. As soon as you get something incorrect, begin from the beginning. It seems to me like any mistake in a messages chain/conversation instantly poisons the output afterwards, even if you try to "correct" it. So if something was wrong at one point, you need to go back to the initial message, and adjust it to clarify the prompt enough so it doesn't make that same mistake again, and regenerate the conversation from there on.
    • eikenberry 1y ago
      I thought Claude still has a problem generating the same output for the same input? That you can't just rewind and rerun and get to the same point again.
• deleted 1y ago
  [deleted]
• declan_roberts 1y ago
  Getting a "Too Many Requests" error is kind of hilarious given the company involved.
  • rcastellotti 1y ago
    same
• _tqr3 1y ago
  I’ve tried building a web app with LLMs before. Two of them went in circles—I'd ask them to fix an infinite loop, they’d remove the code for a feature; I’d ask them to add the feature back, they’d bring back the infinite loop, and so on. The third one kept losing context—after just 2–3 messages, it would rebuild the whole thing differently. They’ll probably get better, but for now I can safely say I’ve spent more time building and tweaking prompts than getting helpful results.
  • diggan 1y ago
    Rather than doing that approach which eventually builds up to 10+ messages or more, iterate on your initial prompt and you'll see better results. So if the first prompt correctly fixed the infinite loop, but removed something else, instead of saying "Add that back again", change the initial prompt to include "Don't remove anything else than what's explicitly mentioned" or similar, and you'll either get exactly what you want, or some other issue. Then rinse and repeat until completed. Eventually you'll build up a somewhat reusable template you can use as a system prompt to guide it exactly how you want. Basically, you get what you ask for, nothing else and nothing more. If you're unclear, it'll produce unclear outputs, if you didn't mention something, it'll do whatever with that. You have to be really, really explicit about everything.
• stego-tech 1y ago
  On the one hand, I would expect LLMs to be able to crank out such code when prompted by skilled engineers who also understand prompting these tools correctly. OAuth isn’t new, has tons of working examples to steal as training data from public projects, and in a variety of existing languages to suit most use cases or needs. On the other hand, where I remain a skeptic is this constant banging-on that somehow this will translate into entirely new things - research, materials science, economies, inventions, etc - because that requires learning “in real time” from information sources you’re literally generating in that moment, not decades of Stack Overflow responses without context. That has been bandied about for years, with no evidence to show for it beyond specifically cherry-picked examples, often from highly-controlled environments. I never doubted that, with competent engineers, these tools could be used to generate “new” code from past datasets. What I continue to doubt is the utility of these tools given their immense costs, both environmentally and socially.
  • TeMPOraL 1y ago
    > where I remain a skeptic is this constant banging-on that somehow this will translate into entirely new things - research, materials science, economies, inventions, etc - because that requires learning “in real time” from information sources you’re literally generating in that moment, not decades of Stack Overflow responses without context. Personally I hope this will materialize, at the very least because there's plenty of discoveries to be made by cross-correlating discoveries already made; the necessary information should be there, but reasoning capability (both that of the model and that added by orchestration) seems to be lacking. I'm not sure if pure chat is the best way to access it, either. We need better, more hands-on tools to explore the latent spaces of LLMs.
    • stego-tech 1y ago
      I don’t consider that “new” research, personally - because AI boosters don’t consider that “new”. The future they hype is one where these LLMs can magic up entirely new fields of research and study without human input, which isn’t how these models are trained in the first place. That said, yes, it could be highly beneficial for identifying patterns in existing research that allows for new discoveries - provided we don’t trust it blindly and actually validate it with science. Though I question its value to society in burning up fossil fuels, polluting the atmosphere, and draining freshwater supplies compared to doing the same work with Grad Students and Scientists with the associated societal feedback involved in said employment activities.
• horacemorace 1y ago
  I did the same thing a few months ago with 4o. This stuff works fine if done with care.
• jauntywundrkind 1y ago
  > Again, please check out the commit history -- especially early commits -- to understand how this went. Direct link to earliest page of history: https://github.com/cloudflare/workers-oauth-provider/commits/main/?after=fe8dbd46fb8e8e25fc1bef7ea0114aa7e402617d+104 https://github.com/cloudflare/workers-oauth-provider/commits... A lot of very explicit & clear prompting, with direct directions to go. Some examples on the first page: https://github.com/cloudflare/workers-oauth-provider/commit/c7db32bcf667662a10d49c8e2406b82b9e57e815 https://github.com/cloudflare/workers-oauth-provider/commit/... https://github.com/cloudflare/workers-oauth-provider/commit/87e182ebf999ba584e54733a37b306a70096926f https://github.com/cloudflare/workers-oauth-provider/commit/...
• jonplackett 1y ago
  This doesn’t seem like much of a surprise that it’s possible - if you are a security expert, you can make LLMs write secure code.
• c-linkage 1y ago
  I very much appreciate the fact that the OP posted not just the code developed by AI but also posted the prompts. I have tried to develop some code (typically non-web-based code) with LLMs but never seem to get very far before the hallucinations kick in and drive me mad. Given how many other people claim to have success, I figure maybe I'm just not writing the prompts correctly. Getting a chance to see the prompts shows I'm not actually that far off. Perhaps the LLMs don't work great for me because the problems I'm working on a somewhat obscure (currently reverse engineering SAP ABAP code to make a .NET implementation on data hosted in Snowflake) and often quite novel (I'm sure there is an OpenAuth implementation on gitbub somewhere from which the LLM can crib).
  • 8-prime 1y ago
    This is something that I have noticed as well. As soon as you venture into somewhat obscure fields, the output quality of LLMs drastically drops in my experience. Side note, reverse engineering SAP ABAP sounds torturous.
    • Vicinity9635 1y ago
      [dead]
  • theshrike79 1y ago
    The usual solution is a multi-tiered one. First you use any LLM with a large context to write down the plan - preferably in a markdown file with checkboxes "- [ ] Task 1" Then you can iterate on the plan and ask another LLM more focused on the subject matter to do the tasks one by one, which allows it to work without too much hallucination as the context is more focused.
• teaearlgraycold 1y ago
  > Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs. This sounds like coding but slower
  • TeMPOraL 1y ago
    The point was validating a hypothesis. That is the validation part.
    • nipah 1y ago
      You don't validate an hypothesis without testing counterfactuals, tho.
  • kentonv 1y ago
    I would say it ended up being much faster than had I written it by hand. It took a few days to produce this library -- it would almost certainly have taken me weeks to write it myself.
    • noodletheworld 1y ago
      If you had written it by hand would the verification process been as time consuming? i.e. overall including the time spent verifying that it was correct, do you consider it a net win?
      • kentonv 1y ago
        I was already including my own time spent verifying the output, which I mostly did right away as the code was being generated (approving or rejecting each edit). And the separate security review would have been required either way. So yes, it saved time.
        • nipah 1y ago
          Did you wrote it from scratch to compare? There's an old motto devs use all the time, you know. Measure first, don't guess. How do you know it would not have took you the same time or less to write the program if it was you? Or if for example, if you were using the AI to write the boilerplate for you while you focused on the core of coding? Or using it as a tab completor assistant instead of it being an agent? Saying it saved you time is easy when you don't have the data to back it up, it's easier than thinking that maybe, maybe this was not that good of an use of your time.
• sceptic123 1y ago
  If you need to be an expert to use AI tools safely, what does that say about AI tools?
  • dkdcio 1y ago
    Genuinely curious what your point is? Do you know how to use a ventillator? A A timing gun? A tonometer? A keratometer? Can you use all of those in a "production" setting safely without expertise?
    • Bjartr 1y ago
      They didn't make a point, they asked a question. Sometimes people do still ask questions because they're interested in the answer.
      • okthrowman283 1y ago
        It was clearly rhetorical
        • deleted 1y ago
          [deleted]
        • Bjartr 1y ago
          Even if it were, which I disagree, treating it was though it were a plain sincere question instead of rhetorical would lead to better discussions.
          • dkdcio 1y ago
            Yeah I was a bit snarky, my bad. I was also genuinely curious though, as it did seem like an odd question that probably had a point behind it.
    • sceptic123 1y ago
      To speak to your analogy, I could possibly use a fully automated tonometer (or maybe a defibrillator). The idea being that the tool can guide a non-expert through the required steps. If I had a point it would be that these tools are currently offered as if they are experts and are taking you through the steps as if they can be trusted. The reality is far from that, and understanding that difference is key to how we approach their use. Maybe this will change in the future, but right now, you need to be an expert to use AI coding tools, I don't think many people understand that.
• alanfranz 1y ago
  Carefully reviewed greenfield project; I don’t think this is astonishing, and I very much love they recorded the prompts. Question is: will this work for non-greenfield projects as well? Usually 95% of work in a lifetime is not greenfield. Or will we throw away more and more code as we go, since AI will rewrite it, and we’ll probably introduce subtle bugs as we go?
  • DaiPlusPlus 1y ago
    > Question is: will this work for non-greenfield projects as well? Depends on the project. Word on the street is the closer your project is to an archetypical React tutorial TODO App then you'll likely be pleased with the results. Whereas if your project is a WDK driver in Rust where every file is a minefield then you'll spend the next few evenings having to audit everything with a fine toothed comb. > since AI will rewrite it That depends if you believe in documentation-first or program-first definitions of a specification.
• multimoon 1y ago
  I think this reinforces that “vibecoding” is silly and won’t survive. It still needed immensely skilled programmers to work with it and check its output, and fix several bugs it refused to fix. Like anything else it will be a tool to speed up a task, but never do the task on its own without supervision or someone who can already do the task themselves, since at a minimum they have to already understand how the service is to work. You might be able to get by to make things like a basic website, but tools have existed to autogenerate stuff like that for a decade.
  • NitpickLawyer 1y ago
    I don't think it does. Vibecoding is currently best suited for low-stakes stuff. Get a gui up, crud stuff, write an app for a silly one time use, etc. There's a ton of usage there. And it's putting that power in the hands of people that didn't have the capabilities before. This isn't vibecoding. This is LLM-assisted coding.
  • subarctic 1y ago
    I get the sense that "vibecoding" is used like a strawman these days, something people keep moving the goal posts on so they can keep saying it's silly. Getting an LLM to write code for you that mostly works with some tweaks is vibe coding, isn't it?
    • Izkata 1y ago
      No. Vibe coding is never even looking at the code and using the LLM as the only interface.
• ZiiS 1y ago
  Shouldn't they really have asked it to read https://developers.cloudflare.com/workers/examples/protect-against-timing-attacks/ https://developers.cloudflare.com/workers/examples/protect-a...
  • kentonv 1y ago
    The secret token is hashed first, and it's the hash that is looked up in storage. In this arrangement, an attacker cannot use timing to determine the correct value byte-by-byte, because any change to the secret token is expected to randomize the whole hash. So, timing-safe equality is not needed. That said, if you have spotted a place in the code where you believe there is such a vulnerability, please do report it. Disclosure guidelines are at: https://github.com/cloudflare/workers-oauth-provider/blob/main/SECURITY.md https://github.com/cloudflare/workers-oauth-provider/blob/ma...
    • ZiiS 1y ago
      I am not confident enough in this area to to report a vunrability, the networking alone probably makes timing impractical. I thought it was now practical to generate known prefix Sha256, so some information could be extracted? Not enough to compromise but the function is right there.
      • kentonv 1y ago
        Learning a prefix of the hash doesn't really get you anywhere. The hash itself isn't a secret -- it could be published publicly without breaking the security model. You still need to derive a token that hashes to that value in full, and if you can do that then you've broken the hash algorithm by definition.
        • ZiiS 1y ago
          Yes I guess if you trust the hash implementation completly; I just favour a bit more defence in depth.
        • ZiiS 1y ago
• DJBunnies 1y ago
  I feel like well defined RFCs and standards are easily coded against, and I question the investment/value/time tradeoff here. These things happily regurgitate training data, but seriously struggle when they don’t have a pool of perfect examples to pull from. When Claude can do something new, then I think it will be impressive. Otherwise it’s just piecing together existing examples.
• kentonv 1y ago
  I'm the author of this library! Or uhhh... the AI prompter, I guess... I'm also the lead engineer and initial creator of the Cloudflare Workers platform. -------------- Plug: This library is used as part of the Workers MCP framework. MCP is a protocol that allows you to make APIs available directly to AI agents, so that you can ask the AI to do stuff and it'll call the APIs. If you want to build a remote MCP server, Workers is a great way to do it! See: https://blog.cloudflare.com/remote-model-context-protocol-servers-mcp/ https://blog.cloudflare.com/remote-model-context-protocol-se... https://developers.cloudflare.com/agents/guides/remote-mcp-server/ https://developers.cloudflare.com/agents/guides/remote-mcp-s... -------------- OK, personal commentary. As mentioned in the readme, I was a huge AI skeptic until this project. This changed my mind. I had also long been rather afraid of the coming future where I mostly review AI-written code. As the lead engineer on Cloudflare Workers since its inception, I do a LOT of code reviews of regular old human-generated code, and it's a slog. Writing code has always been the fun part of the job for me, and so delegating that to AI did not sound like what I wanted. But after actually trying it, I find it's quite different from reviewing human code. The biggest difference is the feedback loop is much shorter. I prompt the AI and it produces a result within seconds. My experience is that this actually makes it feels more like I am authoring the code. It feels similarly fun to writing code by hand, except that the AI is exceptionally good at boilerplate and test-writing, which are exactly the parts I find boring. So... I actually like it. With that said, there's definitely limits on what it can do. This OAuth library was a pretty perfect use case because it's a well-known standard implemented in a well-known language on a well-known platform, so I could pretty much just give it an API spec and it could do what a generative AI does: generate. On the other hand, I've so far found that AI is not very good at refactoring complex code. And a lot of my work on the Workers Runtime ends up being refactoring: any new feature requires a bunch of upfront refactoring to prepare the right abstractions. So I am still writing a lot of code by hand. I do have to say though: The LLM understands code. I can't deny it. It is not a "stochastic parrot", it is not just repeating things it has seen elsewhere. It looks at the code, understands what it means, explains it to me mostly correctly, and then applies my directions to change it.
  • rethab 1y ago
    Fancy! Why are the first twenty commits or so created in the same minute though? Surely you can’t be that fast if you need to prompt for each commit
• apwell23 1y ago
  yes there are plenty of examples of ppl writing tic-tac-toe or a flying simulator with llm all over youtube. what does that prove exactly? oauth is as routine as it gets.
• revskill 1y ago
  So who's the experts here ?
• ookblah 1y ago
  AI critics always have to make strawmen arguments about how there has to be a human in the loop to "fix" things when that's never been the argument AI proponents ever make (at least those who deal with it day to day). This will only get better with time. AI can frequently one-shot throwaway scripts that I need get things done. For actual features I typically start and have it go thru the initial slog and then finish it off. You must be reviewing the entire time, but it takes a huge cognitive load off. You can rubber-duck debug with it. I do agree if you have no idea what you are doing or are still learning it could be a detriment, but like anything it's just a tool. I feel for junior devs and the future. Lazy coders get lazier, those who utilize them to the fullest extent get even better, just like with any tech.
  • nipah 1y ago
    > This will only get better with time. Prove it.
  • skydhash 1y ago
    The one thing about concocting throwaway scripts yourself is the increased familiarity with the tooling you use. And you're not actually throwing away those scripts. I have random scripts laying around my file system (and my shell history) to check how I did a task in the past.
    • bongodongobob 1y ago
      I used to do that too. I find I don't really need to save anything less than 100 lines these days because I can just ask again when I need it.
    • NitpickLawyer 1y ago
      > increased familiarity with the tooling you use In general I agree, but sometimes you want something that you haven't done in years but vaguely remember. ~20 years ago I worked with ffmpeg and vlc extensively in an IPTV project. It took me months to RTFM, implement stuff, test and so on. Documentation was king, and really the only thing I could use. Old-school. But after that project I moved on. In 2018 I worked on a ML - CV project. I knew vlc / ffmpeg could do everything that I needed, but I had forgotten most of everything by then. So I googled/so/random-blogs, plus a bit of RTFM where things didn't match. But it still took a few days to cobble together the thing I needed. Now I just ask, and the perfect one-liner pops-up, I run it, check that it does what I need it to, and go on my merry way. Verification is much faster than context changing, searching, reading, understanding, testing it out, using a work-around for the features that ffmpeg supports but not that python wrapper, and so on.
• wooque 1y ago
  Not surprised, this is perfect task for AI, boilerplaty code that implements something that is implemented 100 times. And it's small project, 1200 lines of pure code. I'm surprised I took them more than 2 days to do that with AI.
• vjerancrnjak 1y ago
  I like how it is just 1 file. Wonder how well incremental editing works with such a big file. I keep pushing for 1 file implementations, yet people split it up into bazillion files because it works better with AI.
  • weird-eye-issue 1y ago
    Unfortunately Claude Code falls apart as soon as you hit 25k tokens in a single file. It's a hard coded limit where they will no longer put the full file into the prompt so it's up to the model to read it chunk by chunk or by using search tools
• curtisszmania 1y ago
  [dead]
• IncreasePosts 1y ago
  Has this source been compared with other oauth libraries, to see if it is just license-violating some other open source code it was trained on?
• freedomben 1y ago
  On a meta-note, it's (seriously) kind of refreshing to see that other people make this same typo when trying to type Cloudflare. I also often write CLoudflare, Cloudlfare, and Cloudfare: > Cloudlflare builds OAuth with Claude and publishes all the prompts
• mehdibl 1y ago
  That's great. But Claude don't allow yet to add APPS in their backend. Mainly only closed beta for integration. How you can configure an app to leverage correctly Oauth and have your own app secret ID/ Client ID!
• globular-toast 1y ago
  Should I be impressed? Oauth already exists and there are countless libraries implementing it. Is it impressive that an LLM can regurgitate yet another one?
• EtienneK 1y ago
  > This is a TypeScript library that implements the provider side of the OAuth 2.1 protocol with PKCE support. What is the "provider" side? OAuth 2.1 has no definition of a "provider". Is this for Clients? Resource Servers? Authorization Server? Quickly skimming the rest of the README it seems this is for creating a mix of a Client and a Resource Server, but I could be mistaken. > To emphasize, this is not "vibe coded". Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs Experience with the RFCs but have not been able to correctly name it.
  • DaiPlusPlus 1y ago
    > OAuth 2.1 has no definition of a "provider" Strictly speaking, yes. But speaking of IDPs more broadly, it’s perfectly acceptable to refer to the authorisation-server as an auth-provider, especially in OIDC (which is OAuth, with extensions) where it’s explicitly called “OpenID provider” - so it’s natural for anyone well-versed in both to cross terminology like that.
  • kentonv 1y ago
    This library helps implement both the resource server and authorization server. Most people understand these two things to be, collectively, the "provider" side of OAuth -- the service provider, who is providing an API that requires authorization. The intent when using this library is that you write one Worker that does both. This library has no use on the client side. This is intended for building lightweight services quickly. Historically there has been no real need for "lightweight" OAuth providers -- if you were big enough that people wanted to connect to you using OAuth, you were not lightweight. MCP has sort of changed that as the "big" side of an MCP interaction is the client side (the LLM provider), whereas lots of people want to create all kinds of little MCP servers to do all kinds of little things. But MCP specifies OAuth as the authentication mechanism. So now people need to be able to implement OAuth from the provider side easily. > Experience with the RFCs but have not been able to correctly name it. These docs are written for people building MCP servers, most of whom only know they want to expose an API to AIs and have never read OAuth RFCs. They do not know or care about the difference between an authorization server and a resource server.
• catigula 1y ago
  When I want to spend a dollar or two, it's much faster to just instruct Claude on how to write my code and prompt/correct it than to write it myself. It feels probably similarly from going from dumb or semi-dumb text editor to an IDE.
• weinzierl 1y ago
  "I thoughts LLMs were glorified Markov chain generators" "the code actually looked pretty good. Not perfect, but I just told the AI to fix things, and it did. I was shocked." These two views are by no means mutually exclusive. I find LLMs extremely useful and still believe they are glorified Markov generators. The take away should be that that is all you need and humans likely are nothing more than that.
  • smallnix 1y ago
    > humans likely are nothing more than that Relevant post: https://news.ycombinator.com/item?id=44089156 https://news.ycombinator.com/item?id=44089156
  • Flemlo 1y ago
    The way the input doesn't match the output should imply that it's not just statistics. As soon as compression happens, optimization happens which can lead to rules/learning of principles which got feed by statistics.
    • immibis 1y ago
      That's "just" more statistics though.
      • Flemlo 1y ago
        Are you good in math definitions or is this an opinion? For me a compressed model learning rules through statistics is not statistics anymore. Physic rules are not statistics.
        • immibis 1y ago
          Of course they are. Force has a strong correlation with mass times acceleration. Objects at rest have a high chance of being observed to remain at rest. And so on.
          • 1y ago
• simonw 1y ago
  The most clearly Claude-written commits are on the first page, this link should get you to them: https://github.com/cloudflare/workers-oauth-provider/commits/main/?after=fe8dbd46fb8e8e25fc1bef7ea0114aa7e402617d+104 https://github.com/cloudflare/workers-oauth-provider/commits...
• throwaway314155 1y ago
  "built OAuth" here means they "implemented OAuth for CloudFlare workers" FYI.
• varispeed 1y ago
  The thing is you need to know what exactly LLM should create and you need to know what it is doing wrong and tell it to fix it. Meaning, if you don't already have skill to build something yourself, AI might not be as useful. Think of it as keyboard on steroids. Instead of typing literally what you want to see, you just describe it in detail and LLM decompresses that thought.
• bsder 1y ago
  > Claude's output was thoroughly reviewed by Cloudflare engineers with careful attention paid to security and compliance with standards. So, for those of us who are not OAuth experts, don't have a team of security engineers on call, and are likely to fall into all the security and compliance traps, how does this help? I don't need AI to write my shitty code. I need AI to review and correct my shitty code.
  • baq 1y ago
    You want hammers to review your woodwork or your hammering technique, too? …anyway, Gemini pro is a quite good reviewer if you are specific about what you need reviewed and provide relevant dependencies in the context.
• pier25 1y ago
  Did you really save time given that every line of code was "thoroughly reviewed"?
• caycep 1y ago
  tbh I would find it annoying to have to go audit someone else (i.e. an LLM's) code... Also, maybe the humbling question is, maybe we humans aren't so exceptional if 90% of the sum of human knowledge can be predicted by next-word-prediction
• rienbdj 1y ago
  Why not use an existing OAuth library?
• mmaunder 1y ago
  Claude 4 in agent mode is incredible. Nothing compares. But you need to have a deep technical understanding of what you’re building and how to split it into achievable milestones and build on each one. It also helps to provide it with URLs with specs, standards, protocols, RFCs etc that are applicable and then tell it what to use from the docs.
• csmpltn 1y ago
  There are tens (if not hundreds) of thousands of OAuth libraries out there. Probably millions of relevant codebases on GitHub, Bitbucket, etc. Possibly millions of questions on StackOverflow, Reddit, Quora. Vast amounts of documentation across many products and websites. RFCs. All kinds of forums. Wikipedias… Why are you so surprised an LLM could regurgitate one back? I wouldn’t celebrate this example as a noteworthy achievement…
  • ThrowawayTestr 1y ago
    Could you imagine typing the words "write an oauth library in typescript" into a computer and it actually working even 5 years ago? This is literally science fiction.
    • blibble 1y ago
      yeah, I remember putting this sort of query into Google 5 years ago and the computer produced it! "literally science fiction"
      • ThrowawayTestr 1y ago
        If you're not willing to have a good faith discussion I won't bother.
        • csmpltn 1y ago
          It is a good faith argument though. LLMs are trained on this exact kind of data - and a lot of times, chat frontends (Claude, ChatGPT, etc) will simply search the web and summarize the results for you...
• keeda 1y ago
  A number of comments point out that OAuth is a well known standard and wonder how AI would perform on less explored problem spaces. As it happens I have some experience there, which I wrote about in this long-ass post nobody ever read: https://www.linkedin.com/pulse/adventures-coding-ai-kunal-kandekar-aodle/?trackingId=%2BvjTQqFvSc69p6ASZ9pafw%3D%3D https://www.linkedin.com/pulse/adventures-coding-ai-kunal-ka... It’s now a year+ old and models have advanced radically, but most of the key points still hold, which I've summarized here. The post has way more details if you need. Many of these points have also been echoed by others like @simonw. Background: * The main project is specialized and "researchy" enough that there is no direct reference on the Internet. The core idea has been explored in academic literature, a couple of relevant proprietary products exist, but nobody is doing it the way I am. * It has the advantage of being greenfield, but the drawback of being highly “prototype-y”, so some gnarly, hacky code and a ton of exploratory / one-off programs. * Caveat: my usage of AI is actually very limited compared to power users (not even on agents yet!), and the true potential is likely far greater than what I've described. Highlights: * At least 30% and maybe > 50% of the code is AI-generated. Not only are autocompletes frequent, I do a lot of "chat-oriented" and interactive "pair programming", so precise attribution is hard. It has written large, decently complicated chunks of code. * It does boilerplate extremely easily, but it also handles novel use-cases very well. * It can refactor existing code decently well, but probably because I'ver worked to keep my code highly modular and functional, which greatly limits what needs to be in the context (which I often manage manually.) Errors for even pretty complicated requests are rare, especially with newer models. Thoughts: * AI has let me be productive – and even innovate! – despite having limited prior background in the domains involved. The vast majority of all innovation comes from combining and applying well-known concepts in new ways. My workflow is basically a "try an approach -> analyze results -> synthesize new approach" loop, which generates a lot of such unique combinations, and the AI handles those just fine. As @kentonv says in the comments, there is no doubt in my mind that these models “understand” code, as opposed to being stochastic parrots. Arguments about what constitutes "reasoning" are essentially philosophical at this point. * While the technical ideas so far have come from me, AI now shows the potential to be inventive by itself. In a recent conversation ChatGPT reasoned out a novel algorithm and code for an atypical, vaguely-defined problem. (I could find no reference to either the problem or the solution online.) Unfortunately, it didn't work too well :-) I suspect, however, that if I go full agentic by giving it full access to the underlying data and letting it iterate, it might actually refine its idea until it works. The main hurdles right now are logistics and cost. * It took me months to become productive with AI, having to find a workflow AND code structure that works well for me. I don’t think enough people have put in the effort to find out what works for them, and so you get these polarized discussions online. I implore everyone, find a sufficiently interesting personal project and spend a few weekends coding with AI. You owe it to yourself, because 1) it's free and 2)... * Jobs are absolutely going to be impacted. Mostly entry-level and junior ones, but maybe even mid-level ones. Without AI, I would have needed a team of 3+ (including a domain expert) to do this work in the same time. All knowledge jobs rely on a mountain of donkey work, and the donkey is going the way of the dodo. The future will require people who uplevel themselves to the state of the art and push the envelope using these tools. * How we create AI-capable senior professionals without junior apprentices is going to be a critical question for many industries. My preliminary take is that motivated apprentices should voluntarily eschew all AI use until they achieve a reasonable level of proficiency.
• tveita 1y ago
  Some examples of prompt exchanges that seem representative: https://claude-workerd-transcript.pages.dev/oauth-provider-token-exchange-callback2 https://claude-workerd-transcript.pages.dev/oauth-provider-t... ("Total cost: $6.45")! https://github.com/cloudflare/workers-oauth-provider/commit/a103ed06d94cc097db0744da36618153e1f27789 https://github.com/cloudflare/workers-oauth-provider/commit/... https://github.com/cloudflare/workers-oauth-provider/commit/adcbb5de9c24f5b6a7dbea2e0a313a87c304d9bb https://github.com/cloudflare/workers-oauth-provider/commit/... The first transcript includes the cost, would be interesting to know the ballpark of total Claude spend on this library so far. -- This is opportune for me, as I've been looking for a description of AI workflows from people of some presumed competency. You'd think there would be many, but it's hard to find anything reliable amidst all the hype. Is anyone live coding anything but todo lists? antirez: https://antirez.com/news/144#:~:text=Yesterday%20I%20needed%20to%20evaluate https://antirez.com/news/144#:~:text=Yesterday%20I%20needed%... tptacek: https://news.ycombinator.com/item?id=44163292 https://news.ycombinator.com/item?id=44163292
  • kentonv 1y ago
    I didn't keep extract track but I'd estimate the total cost of Claude credits to build this library was somewhere around $50, which is pretty negligible compared to the time saved.
• blibble 1y ago
  > I thoughts LLMs were glorified Markov chain generators that didn't actually understand code and couldn't produce anything novel. so he's been convinced by it shitting out yet another javascript oauth library? this experiment proves nothing re: novelty
  • ayuhito 1y ago
    Good thing most of my tasks don’t require novelty, just working code.
  • kentonv 1y ago
    While implementing the OAuth standard itself is not novel, many of the specific design details in this implementation are. I gave it a rather unusual API spec, an unusual storage schema, and an unusual end-to-end encryption scheme. It was totally able to understand these requests, even reasoning about the motivation behind them, and implement what I wanted. That's what convinced me. BTW, the vast majority of JS OAuth libraries are implementing the client side of OAuth. Provider-side implementations are relatively rare, as historically it's mostly only big-name services that ever get to the point of being a OAuth providers, and they tend to build it all in-house and not release code.
    • blibble 1y ago
      I think you're easily convinced.
      • ThrowawayTestr 1y ago
        I think you'll never be impressed.
• Squeeeez 1y ago
  [flagged]
  • kentonv 1y ago
    What are you talking about? The entire library is 2600 lines. There are no 2500-line methods.
    • Squeeeez 1y ago
      Yeah, my bad, I got lost and frustrated while scrolling endlessly and trying to keep track of what was part of what. Look, clearly you are happy with the results, so all good for you.
• eGQjxkKF6fif 1y ago
  Looking at all of these arguments and viewpoints really is something to witness. Congratulations Cloudflare, and thank you for showing that a pioneer, and leader in the internet security space can use the new methods of 'vibe coding' to build something that connects people in amazing ways, and that you can use these prompts, code, etc to help teach others to seek further in their exploration of programming developments. Vibe programming has allowed me to break through depression and edit and code the way I know how to do; it is a helpful and very meaningful to me. I hope that, it can be meaningful for others. I envision the current generation and future generations of people to utilize these things; but we need to accept, that this way of engineering, developing things, creation, is paving a new way for peoples. Not a single comment in here is about people traumatized, broken, depressed, or have a legitimate reason for vibe coding. These things assist us, as human beings; we need to be mindful that it isn't always about us. How can we utilize these things to to the betterment of the things we are passionate about? I humbly look forward to seeing how projects in the open source space can showcase not only developmental talent, but the ability to reason and use logic and project building thoughtfulness to use these tools to build. Good job, Cloudflare.
  • nop_slide 1y ago
    It literally says in the post it’s not “vibe coded”. That has a very specific meaning of not reviewing the code at all and accepting everything.
• _pdp_ 1y ago
  It is a single file with 2630 locs and it is a straightforward problem. 1/3 of the code is just interface definitions and comments.
• humanlity 1y ago
  [dead]
• jbeus 1y ago
  Getting rate limited…Cloudflare, do you you think you can help with caching and load balancing for github?
• animanoir 1y ago
  [dead]
• scherlock 1y ago
  Is it really good form in TypeScript to make all functions async, even when functions don't use await? like this, https://github.com/cloudflare/workers-oauth-provider/blob/fe8dbd46fb8e8e25fc1bef7ea0114aa7e402617d/src/oauth-provider.ts#L1882 https://github.com/cloudflare/workers-oauth-provider/blob/fe...
  • ccorcos 1y ago
    No. It’s possible env[?].get returns a promise though
  • kentonv 1y ago
    env.OAUTH_KV.get(...) is reading from Workers KV storage. It returns a promise.
• topspin 1y ago
  Been here many times: This time Claude fixed the problem, but: - It also re-ordered some declarations, even though I told it not to. AFAICT they aren't changed, just reordered, and it also added some doc comments. - It fixed an unrelated bug, which is that `getClient()` was marked `private` in `OAuthProvider` but was being called from inside `OAuthHelpers`. I hadn't noticed this before, but it was indeed a bug. Frequently can't get LLMs to limit themselves to what has been prompted, and instead they run around and "best practice" everything, "fixing" unrelated issues, spewing commentary everywhere, and creating huge, unnecessary diffs.
  • dboreham 1y ago
    Tbf I've seen human developers do this and similar irritating things many times.
• okthrowman283 1y ago
  The sheer amount of copium in this thread is illuminating, it’s fascinating the lengths people will go to downplaying advancements like this when their egos/livelihoods are threatened - pretty natural though I suppose.
• dboreham 1y ago
  It turns out that "actually understanding" is a fictional concept. It's just the delusion some LLMs (yours and mine) has about what's going on inside itself.
• zackify 1y ago
  Oauth isn’t that complicated. It’s not a surprise to see an llm build out from the spec. Honestly I was playing around writing a low level implementation recently just for fun as I built out my first oauth mcp server.
• dang 1y ago
  We changed the URL from https://github.com/cloudflare/workers-oauth-provider/commits/main/ https://github.com/cloudflare/workers-oauth-provider/commits... to the project page.
• zeroq 1y ago
  Holy cow! My latest try with Gemini went like this: - Write me a simple todo app on CloudFlare with auth0 authentication. - Let's proceed with a simple todo app on CloudFlare. We start by importing the @auth0-cloudflare and... - Does that @auth0-cloudflare actually exists? - Oh, it doesn't. I can give you a walkthrough on how to set up an account on auth0. Would you like me to? - Yes, please. - Here. I'm going to write the walkthrough in a document... (proceed to create an empty document) - That seems to be an empty document. - Oh, my bad. I'll produce it once more. (proceed to create another empty document) - Seems like you're md parsing library is broken, can you write it in chat instead? - Yes... (Your Gemini trial has expired. Would you like to pay $100 to continue?) My idea was to try the new model with a low hanging fruit - as kentov mentioned, it's a very basic task that has been made thousand of times on the internet with extremely well documented APIs (officially and on reddit/stackoverflow/etc.). Sure, it was a short hike before my trial expired, and kentov himself admited it took him couple of days to put it together, but... holy cow.
• helsinki 1y ago
  I don’t see any prompts?
  • sensanaty 1y ago
    The expanded commit messages have the prompts
• ab_testing 1y ago
  Sorry this might be a dumb question but where are the prompts in the source code ? I was thinking like I prompt ChatGPT and it prints some code , there would be similar prompts. Is the readme the prompt?
  • animex 1y ago
    https://github.com/cloudflare/workers-oauth-provider/commits/main/?after=fe8dbd46fb8e8e25fc1bef7ea0114aa7e402617d+104 https://github.com/cloudflare/workers-oauth-provider/commits... Start at the bottom...they are in the commit messages, or sometimes the .md file
  • deleted 1y ago
    [deleted]
• cyberax 1y ago
  I looked through the source code, and it looks reasonable. The code is well-commented (even _over_ commented a bit). There are probably around ~700 meaningful lines of pure code. So this should be about 2 weeks of work for a good developer. This is without considering the tests. And OAuth is not particularly hard to implement, I did that a bunch of times (for server and the client side). It's well-specified and so it fits well for LLMs. So it's probably more like 2x acceleration for such code? Not bad at all!
  • nipah 1y ago
    700 lines of code is 2 weeks of work for a good developer? My friend, I wrote 350 lines of executable code (excluding boilerplate) in a morning (4AM to like 9AM, maybe a bit more) to make a test with voxel octrees like yesterday. There's no reason it would take "2 weeks of work for a good developer" to write 700. What takes times in those projects is the research, if you already have this fresh in your head it should not take more than 3 days to make something very simple but reasonable, and a week at max to make something good (not perfect, but good).
• aeneas_ory 1y ago
  Very impressive, and at the same time very scary because who knows what security issues are hidden beneath the surface. Not even Claude knows! There is very reliable tooling like https://github.com/ory/hydra https://github.com/ory/hydra readily available that has gone through years of iteration and pentests. There are also lots of libraries - even for NodeJS - that have gone through certification. In my view this is an antipattern of AI usage and „roll your own crypto“ reborn.
• yapyap 1y ago
  bit of a typo in the title
• rienbdj 1y ago
  The commits are revealing. Look at this one: > Ask Claude to remove the "backup" encryption key. Clearly it is still important to security-review Claude's code! > prompt: I noticed you are storing a "backup" of the encryption key as `encryptionKeyJwk`. Doesn't this backup defeat the end-to-end encryption, because the key is available in the grant record without needing any token to unwrap it? I don’t think a non-expert would even know what this means, let alone spot the issue and direct the model to fix it.
  • october8140 1y ago
    It's a Jr Developer that you have to check all their code over. To some people that is useful. But you're still going to have to train Jr Developers so they can turn into Sr Developers.
    • PeterStuer 1y ago
      I don't like the jr dev analogy. It neither has the same weaknesses nor the same strenghts. It's more like the genious coworker that has an overassertive ego and sometimes shows up drunk, but if you know how to work with them and see past their flaws, can be a real asset.
      • hn_throwaway_99 1y ago
        I also like your analogy, but it also explains why I find working with AI-assisted coding so mentally tiresome. It's like with some auto-driving systems - I say it like having a slightly inebriated teenager at the wheel. I can't just relax and read a book, because then I'd die. But so I have to be more mentally alert than just driving myself because everything could be going smoothly and relaxed, but at any moment the driving system could decide to drive into a tree.
    • Cthulhu_ 1y ago
      I don't really agree; a junior developer, if they're curious enough, wouldn't just write insecure code, they would do self-study and find out best practices etc before writing code, including not storing plaintext passwords and the like.
• sahil_sharma0 1y ago
  [dead]
• Luker88 1y ago
  Hello Cloudflare, impressive result, I did not think things were this advanced. Still, legal question where I'd like to be wrong: AFAIK (and IANAL) if I use AI to generate images, I can't attach copyright to it. But the code here is clearly copyrighted to you. Is that possible because you manually modify the code? How does it work in examples like this one where you try to have close to all code generated by AI?
  • dvrp 1y ago
    Did you check the latest documents from copyright.gov? They’re interesting exactly because of what you’re saying
    • Luker88 1y ago
      I did not, especially seeing as I am not from the USA, so I'd like to have the point of view of a multinational company --edit: didn't the same office have a controversy a few weeks ago where AI training was almost declared not-fair-use, and the boss was fired on the spot byt the administration, or something like that? Things sounds confusing to me, which is why I'm asking
  • fastball 1y ago
    I believe you are wrong about AI-generated images as well.
  • kentonv 1y ago
    I am also not a lawyer, but I believe the law here is yet to be fully settled. Here in the US, there have been lower-court rulings but surely it will go to the supreme court. There are parts of the library that I did write by hand, which are presumably copyright Cloudflare either way. As for whether the AI-generated parts are, I guess we'll see. But given the thing is MIT-licensed, it doesn't seem like it matters much in this case?
• bigcat12345678 1y ago
  Kenton at it again!
• deleted 1y ago
  [deleted]
• jwally 1y ago
  fwiw, I feel like LLM code generation is scaffolding on steroids, and strapped to a rocket. A godsend if you know what you're doing, but really easy to blow yourself up if you complacent. At least with where models are today; imho.
• lapcat 1y ago
  If my future career consists of constantly prompting and code-reviewing a semi-competent, nonhuman coder in order to eventually produce something decent, then I want no part in that future, even if it's more "efficient" in the sense of taking less time overall. That sounds extremely frustrating, personally unrewarding, alienating. I've read the prompts and the commit messages, and to be honest, I don't have the patience to deal with a Claude-level coder. I'd be yelling at the idiot and shaking my fists the whole time. I'd rather just take more time and write the code myself. It's much more pleasant that way. This future of A.I. work sounds like a dystopia to me. I didn't sign up for that. I never wanted to be a glorified babysitter. It feels infinitely worse than mentoring an inexperienced engineer, because Claude is inhuman. There's no personal relationship, it doesn't make human mistakes or achieve human successes, and if Claude happens to get better in the future, that's not because you personally taught it anything. And you certainly can't become friends. They want to turn artists and craftsmen into assembly line supervisors.
  • chii 1y ago
    > They want to turn artists and craftsmen into assembly line supervisors. the same was uttered by blacksmiths and other craftsman who has been displaced by technology. Yet they are mercilessly crushed. Your enjoyment of a job is not a consideration to those paying you to do it; and if there's a more efficient way, it will be adopted. The idea that your job is your identity may be at fault here - and when someone's identity is being threatened (as it very much is right now with these new AI tools), they respond very negatively.
    • lapcat 1y ago
      > the same was uttered by blacksmiths and other craftsman who has been displaced by technology. Yet they are mercilessly crushed. This is misleading. The job of blacksmith wasn't automated away. There's just no demand for their services anymore, because we no longer have knights wearing armor, brandishing swords, and riding horses. In contrast, computer software is not disappearing; if anything, it's becoming ubiquitous. > Your enjoyment of a job is not a consideration to those paying you to do it But it is a consideration to me in offering my services. And everyone admits that even with LLMs and agents, experienced senior developers are crucial to keep the whole process from falling into utter crap and failure. Claude can't supervise itself. > The idea that your job is your identity may be at fault here No, it's just about not wanting to spend a large portion of my waking hours doing something I hate.
• vaidhy 1y ago
  I think the discussions are also missing another key element. The time in takes to read someone else code is way more mentally tiring. When I am writing the code, my mind tracks what I have done and the new pieces flow. When I am reading code written by someone else, there is no flow.. I have to track individual pieces and go back and forth on what was done before. I can see myself using LLMs for short snippets rather than start something top down.
• arrty88 1y ago
  im using AI to build a cloudflare replica :)
• paulddraper 1y ago
  > To emphasize, this is not "vibe coded". Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs.
• Bluestein 1y ago
  From the docs: > "NOOOOOOOO!!!! You can't just use an LLM to write an auth library!" > "haha gpus go brrr"
• ElijahLynn 1y ago
  [flagged]
  • kentonv 1y ago
    https://news.ycombinator.com/item?id=44159167 https://news.ycombinator.com/item?id=44159167
• alienbaby 1y ago
  Reading the authors comments on the github page I can relate. Over this paast weekend I attempted to use copilot to write some code for a home project and expected it to be terrible, like the last time I tried. Except, this time it wasn't. It got most things right first time, and fixed things I asked it to. I was pleasantly surprised.
• JackSlateur 1y ago
  Fascinating It's like cooking with a toddler The end result has a lower quality than your own potential, it takes more time to be producted, and it is harder too because you always need to supervise and correct what's done
  • aerhardt 1y ago
    > it takes more time to be producted, and it is harder too because you always need to supervise and correct what's done This is hogwash, the lead dev in charge of this has commented elsewhere that he's saved inordinate amounts of time. He mentioned that he gets about a day a week to code and produced this in under a month, which under those circumstances would've been impossible without LLM assistance.
    • dang 1y ago
      Can you please make your substantive points without name-calling like "This is hogwash"? Your comment would be just fine without that bit. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. "When disagreeing, please reply to the argument instead of calling names. 'That is idiotic; 1 + 1 is 2, not 3' can be shortened to '1 + 1 is 2, not 3."
      • aerhardt 1y ago
        OK, but in my defense "hogwash" is literally defined as "nonsense" by Oxford dictionary, I didn't call a person names and only criticized the idea. It's softer than "idiotic" which while also an attribute of the idea may be taken to imply that the person is an idiot. Not my intention. The point is nevertheless taken that it adds nothing of substance to the argument, and I will not do it again.
    • JackSlateur 1y ago
      It took two months for a lead dev and a bunch of "Cloudflare engineers" (to "thoroughly review .. with careful attention paid to security and compliance with standards") to write ~1300 lines of typescript code for a feature they (he ?) masters If that sounds like "save inordinate amounts of time", well, that's your opinion
• Phiality 1y ago
  This is so cool
• kiitos 1y ago
  Is this not... embarrassing? to the engineers who submit these commits? It seems that way to me... Certainly if I were on a hiring panel for anyone who had this kind of stuff in their Google search results, it would be a hard-no from me -- but what do i know?
• gcr 1y ago
  This library has some pretty bad security bugs. For example, the author forgot to check that redirect_uri — matches one of the URLs listed during client registration. The CVE is uncharacteristically scornful: https://nvd.nist.gov/vuln/detail/cve-2025-4143 https://nvd.nist.gov/vuln/detail/cve-2025-4143 I’m glad this was patched, but it is a bit worrying for something “not vibe coded” tbh
• jplehmann 1y ago
  Fascinating share and discussion. I read many of the comments, but extracted key take-aways using GPT here: https://chatgpt.com/share/6840c9e8-a498-8005-971b-3b91e09b9d90 https://chatgpt.com/share/6840c9e8-a498-8005-971b-3b91e09b9d... for anyone interested.
• hamdouni 1y ago
  Claude is not mentioned in the 'contributors' section.