undefined

points

[-]

An example to what I'm talking about: I have application that takes two inputs from request. I've put in validation on request values to deny values that are greater than 100. In my code I'm adding these values. LLM can say "cater for addition of these two numbers, because they might go over MAX_INT and result in overflow". This is a situation that won't happen. LLM can recommend - add assertions. That's unnecessary.

by Orphis18 hours ago|

parent|

[-]

And the day you add a way to batch import request through another code path, you may forget the validation.

Having it in the lower layer is correct, a proper optimizing compiler should be able to detect there's a single code path to the function and that the checks have already been done, skipping the second check.

by alright256512 hours ago|

parent|

[-]

Alternatively, the code could be written in the style of parse, don't validate[1]. However I've never had a coding LLM preemptively suggest that.

[1]: https://lexi-lambda.github.io/blog/2019/11/05/parse-don-t-va...

by eithed17 hours ago|

parent|

prev|

[-]

Well - this would be an example of defensive programming and by that logic catering for this "what if" is the way to go. LLMs were correct all along!

by layer821 hours ago|

parent|

prev|

[-]

Arguably it’s only unnecessary when the value range is enforced by the programming language (types). The structure of who calls what in the code can change, and suddenly larger values can appear. You don’t want to have to perform whole-program analysis on every change to check whether all assumptions made in the past still hold. That’s also a source of vulnerabilities: assumptions that held when the code was written, but stopped holding sometime later.

That’s why I think code needs to document all its assumptions, and in a way that is checked by the compiler to the extent possible. If you document that the values have restricted range, then the AI should be taking it into account.

by eithed21 hours ago|

parent|

[-]

Types is an option. Another option would be tests (and in this case mutation testing).

My main point still stands = LLMs code defensively catering for unknowns that are not loaded into context.

by lilbigdoot19 hours ago|

prev|

[-]

Idk I routinely see the LLMs repeat validations that already happen in another layer or it imagines things that don't exist

by ShadowOfThePit21 hours ago|

prev|

[-]

I vibe-slopped a small and local forms application for my family. I explicitly mentioned that fact to the LLM.

Yet, I removed 2/3s of the code, because it triple-checked that every file really existed and was valid, that the input form was less than a million bytes in size, that there were propper HTTP status codes for everything, that every possible error from reading data was eagerly checked and caught, and so on.

Like come on, three people will ever look at it. So keep it small and tidy so I can understand it better!