this post was submitted on 03 Jun 2026
250 points (97.3% liked)

Programming

27213 readers
542 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev



founded 3 years ago
MODERATORS
 

Seems like he's been pushed into using LLMs as a way to cope with the deluge of LLM-generated security reports.

you are viewing a single comment's thread
view the rest of the comments
[โ€“] daniskarma@lemmy.dbzer0.com 2 points 1 week ago (1 children)

It's a fair point.

I've had diverse success using llm for coding.

For simple things and basic questions it has worked. For anything complex. It has been a complete failure.

But I've never used a paid tool, most of the time I just use self hosted LLMs. But, to be honest, I don't think the paid tools are that much better.

But if someone knows how to use it better. And assumes responsibility for checking the code, I'm ok with it.

It's just a tool like many others, it can be usedfor good or for bad.

[โ€“] rollerbang@lemmy.world 6 points 1 week ago (1 children)

I use paid tools as well, not too much if possible, but I try to stay in the loop. Anyway, they fail miserably at anything slightly complex. And confidently too ๐Ÿ˜‚

My experience is you have to close as many degrees of freedom as possible. Its tedious as hell for generating quality code.

Its great at debugging if you require it to manage its context window by delegating tasks to scoped subagents, generate evidence with references, and verify that evidence with a minimal reproducible example. Expensive... I've seen them run for a solid 30 minutes before responding back (not including the "thinking" log), but it usually finds the issue.

A similar technique can be used for code generation but again it burns tokens and takes awhile. Have it generate and verify isolated reference implementations for anything nontrivial. Much easier to review with the rest of your domain and layered on complexity stripped out. The "thinking" log is interesting to watch as it bangs it head against bad assumptions or documentation and needs to start digging into dependency source code to work it out.

Only then apply the implementation to your project from the reference implementation. Takes breaking down the tasks though to small enough units and closing those degrees of freedom.

Anecdote on degrees of freedom: This one didn't require a reference implementation in particular. I was reviewing a PR (LLM assisted, I wasn't the authoring dev) to add signature validation to OAuth tokens. It duplicated the entire header/token parsing logic. It needed that path closed with a pointer to where the existing logic was and explicit requirements to enhance it. Refactor was great upon reviewing and the PR size was reduced by more than half.