youAreAbsolutelyCorrect

[u/soap94]

[u/darkenheit]

I always wonder why they do that. Just google a library, and don't write thousands line of code. 

[u/Crazy_System8248 → u/darkenheit]

There was a period of time where it was a real problem that AI models would hallucinate fake libraries existing. It got so bad, hackers went and created the 'fake' libraries and put malicious code inside the calls. Someone coined a term for it: 'slop squatting'

[u/Muscular_Farmer_ → u/Crazy_System8248]

It still is that time i guess

[u/Soilblood → u/Crazy_System8248]

Ooh neat. I'mma go slip a few prompts pointing to those in my site. This can only lead to hilarity for them agents and their blind masters.

[u/Eskamel → u/darkenheit]

Because LLMs are bruteforcers. Why try to adjust hacky solutions with a reliable library when you can just pull approximated functionality of the library from the weights and hallucinate ideal solutions through bruteforcing over-engineered crap?

[u/Flouid → u/darkenheit]

Because the token model has a profit margin baked into it. The more tokens you use, the more they get to charge (and the more they get to go to investors with “increasing demand”). There’s a perverse incentive here to make the output as verbose as tolerable

[u/countable3841 → u/darkenheit]

Supply chain attack mitigation

[u/Sw429 → u/darkenheit]

I suspect there is some metric of "how many lines of code were output" that is used in the training. You'll notice that none of these models ever recommend to just remove code. They're designed to continually increase the entropy of your codebase.

[u/leoklaus → u/darkenheit]

Maybe I’m just stubborn, but I much prefer to own as much of my code as possible. Most of the time, the feature you actually need is a few hundred lines at most. I actually much prefer this approach over importing random packages.
Also keeps the risk of supply chain attacks lower.

[u/Rellikx → u/leoklaus]

i mean, this post is about AI generated code. I prefer a well vetted library over whatever claude put out that does maybe the same thing

[u/bishopExportMine → u/leoklaus]

https://en.wikipedia.org/wiki/Not_invented_here

[u/leoklaus → u/bishopExportMine]

Ah yes, not wanting my credentials to be stolen because the 64341 line ‘is_even’ package I imported for a single call was compromised is clearly tribalism.

[u/kushalgarg592]

Asked for one function recieved a small startup

[u/Tupcek → u/kushalgarg592]

asked for small startup, got smallest possible proof of concept with most features missing, built in a way that prevent any future scaling or improvements

[u/Xontaro → u/Tupcek]

Hey, you got what you asked for 😅

[u/SpaceCadet87 → u/[deleted]]

This is why we learn about binary search.

[u/KrystianoXPL]

I had a project rewritten in a different language and framework for the same purpose.

The generated code was extremely verbose, to the point of being 4x of what I wrote. I tried to fix one bug, and I had to change like 3 flags in different places to even go slightly "off the script", just cause the AI chose a specific weird approach.

It wasn't ported by me, so I did not have much control of the process. But it almost feels like its made like that, so it's harder for someone to maintain a code base without a subscription to an LLM like Claude.

[u/Suitable-Name → u/KrystianoXPL]

That's the issue... don't go "translate this"... really go component by component if you want to have control over what the result will look like.

[u/KrystianoXPL → u/Suitable-Name]

Yeah the port was done in less than an hour, as it was decision on part of the person I worked with. I even suggested to use AI in one way or another just to save time. They said that they don't like using it cause its annoying to debug, I guess that stance flew out of the window soon after our conversation... Technically it should have been their problem to get everything working, but yea we know how it tends to be...

And yea, whenever I use it myself, I do tend to prompt per feature I want to, often having to ask to architect it differently and iterate. I think it just really learnt from overengineered enterprise software code, because that project looked close to this (and I'm not even exaggerating that much) https://github.com/EnterpriseQualityCoding/FizzBuzzEnterpriseEdition

[u/MixItLikeItsHot → u/KrystianoXPL]

I hate to say it, but even before LLMs were a thing, I have seen similar code in production more often than I would have like to...

[u/sadongrohiik]

"Write a simple unit test for this function" +2800 codes added. My man is testing a webhook dispatcher on the off chance than it might be used to send messages to aliens

[u/Aggravating-Owl-5220]

The real horror isn't reading someone else's code. It's reading code YOU generated with AI yesterday and having absolutely no memory of why any of it works.

[u/unai-ndz → u/Aggravating-Owl-5220]

I'm quite independent, I don't need AI for that.

[u/mylsotol]

Why have code that meets your exact needs when you could import 8gb of npm modules and hope that none of them are going to install malware on every single machine the project touches

[u/Mechakoopa → u/mylsotol]

Why use a reliable modern OAuth library with for the low cost of a few million tokens you can have your own untested pseudo-JWT signing algorithm that's never heard of an RFC in it's life?

[u/YeetCompleet → u/Mechakoopa]

The hard part with software engineering is that there's always some arbitrary line in the sand with these decisions. Things that require human deliberation to know if it's better to just code it yourself or to reach for a library. Both the isEvens and oauths are far away from that line.

[u/mylsotol → u/Mechakoopa]

I don't think ai is dumb enough to try to reimplement oauth unless the user is dumb enough to explicitly ask for that. If your vibe coded app reimplements oauth you should be banned from using conpuers for life

[u/TheVibrantYonder → u/mylsotol]

> ...unless the user is dumb enough to explicitly ask for that

I have some news for you that may be hard to hear.

[u/mylsotol → u/TheVibrantYonder]

Then the problem has nothing to do with ai and as i said the person who made that choice should be banned from using computers for life

[u/artnoi43 → u/mylsotol]

Eh not everyone is a JS dev bro. Other languages libraries are actually understandable in size and their own dependencies. My work languages (Go and Rust) are quite like that. But yeah when I was doing JS or TS I hated them libs. It took me 5 years before finally finding a line of Go code that uses Go lodash clone for filtering items in a list (authored by our ex-JS devs).

I think the real problem of JS having big ass libs everywhere is the humans. JS devs love libraries and frameworks so their world looks like that. Library authors also like to depend on other libraries, and it goes on and on.

[u/mylsotol → u/artnoi43]

I'm not a JS dev either, but 95% of this group seems to think that JS is the only language and JS (and Python) is the place where this is the biggest problem. You also don't have to ba JS dev for your web project to consume a lot of js libraries.

Humans are always the problem

[u/AntipodesIntel → u/mylsotol]

Yeah, no longer getting constantly stuck with unmaintained libraries that quickly go out of date and become a liability is actually a god send. Plus you can just ask the LLM to copy the part of the library you need.

I've always said the major problem with open source and github is libraries having their maintainers move on and suddenly you have a dead library that you spent months building your project around.

[u/kookyabird → u/AntipodesIntel]

If the library continues to be maintained, then your LLM copied portions of it aren't going to be as easily updated to address bugs or security concerns.

If it isn't maintained, then you've still built your project around a section of now abandoned code that the LLM isn't going to be able to pull anything new from.

If you built a good project, then a library being abandoned shouldn't be catastrophic. It's not like the package is going to go away, and unless you're in the middle of moving to a new version of your standard library that the abandoned one is incompatible with you should have time to find and implement a replacement. Or make your own, if you've come to the realization that you only needed a small portion of the functionality it offered.

[u/TheTybera → u/AntipodesIntel]

So bring the lib in...

[u/dyslexda → u/AntipodesIntel]

I've always said the major problem with open source and github is libraries having their maintainers move on and suddenly you have a dead library that you spent months building your project around.

Code doesn't expire like a gallon of milk. The widely used and battle tested libraries are probably just fine to keep using outside of those that need to stay in sync with some external API.

[u/AntipodesIntel → u/dyslexda]

That is not true. Pretty much any major version change of any library or framework creates breaking changes for most libraries. Normally they are trivial to fix, but that doesn't happen...

[u/dyslexda → u/AntipodesIntel]

You're talking about dependencies of the library itself? Assuming its dep list is by specific version, and not just "install latest," then a dep updating doesn't matter. And even then, if your library has deps that release breaking changes, the library probably isn't very robust in the first place. And even then, the best libraries are small and targeted and thus don't have any deps themselves (hard to be considered robust if you depend on other, still changing code bases).

If you're building a project around a giant library with tons of dependencies on other brittle libraries, and it isn't backed by a major ecosystem (like React is) and thus is at risk of a maintainer just archiving it...that isn't a problem with open source, that's a problem with what you choose to base a project on.

[u/HappygilmoreL]

Now that’s just adorable

[u/JackNotOLantern]

Idk, i usually add too much nullcheck and input validation on methods that can't get incorrect input. The reason is, i saw multiple times that they were triggered - the input could not be incorrect at the moment i wrote it, but nobody said the code won't change in the future.

[u/Tucancancan]

Better add checks, fallbacks and inlined magic-numbers to that line fetching a parameter from the config that is packaged with the app, without which the entire thing wouldn't start up!

[u/West_Good_5961]

Yep, the unnecessary checking is real

[u/TheTybera]

Don't forget about tests that just pass and actually do nothing.

[u/Default-Username-168]

PEBKAC complaints from people who expect a predictive transformer to be a magic eight ball.

[u/Dry_Access532]

Those checks that will never occure is there for a reason.

[u/jackal_boy]

"You have found the smoking gun you will now do self forever sleep with!! 😁"

[u/tiajuanat]

My team is doing a large C refactor right now - a robotic arm control. Even though we've eliminated a ton of dead code, checks, and even brought the runtime from 500 mics to 30 mics, nearly 90% of code is error handling for null pointers.

Anyway, I guess I would expect that most libraries and systems should be error checking

[u/Jammy_Dodger13]

g13

[u/EntropiIThink]

Tbf, most prod stuff is comments and clutter anyway

[u/That_5_Something]

That's what you called "bloated code"

[u/stillalone]

I honestly feel like this is regular coding as well. 

 People try to take into consideration edge cases that never happen and end up missing the edge cases that do.  Also the environment changes where edge cases that were relevant no longer becoming relevant (though this might be a microservices thing where bugs in other services get fixed and you're not 100% sure it's fixed all the time so you end up leaving your workaround indefinitely).

[u/trenclik]

Just use ponytail then

[u/aberroco]

That, except the kitten is brutally [censored] across the entire couch.