That's not really the point of the saying though. The point is more so that if you are the kind of person who is in a position to roll your own crypto you probably have a PhD and have worked with cryptography for years. And the thing that you're setting out to do is to produce a cryptography library.
If you're that kind of person, then sure go for it! But if you're a top person in the field of cryptography you didn't need anyone to tell you if you were fit to make a cryptography library anyway.
And if you're not that kind of person you do need someone to tell you because the whole field is a minefield where subtle oversights break the whole thing. If you want to just implement cryptography as a fun learning experience that's great. But actual implementations that people will actually depend on need to be handled by experts.
On the degree the software evolves and will be used.
The reason we've spent years discovering patterns, creating special syntaxes has been to tackle certain domain problems more efficiently and to have systems that can evolve through time.
The only constant is change.
Albeit LLMs chunk out code (and with great know how impressive output), the developer must have the know how to pass a certain threshold.
Writing in unknown languages may seem fine at first. But once you go to the edge, you'll be finding certain quirks, inefficiencies along the way that the LLM may work around it instead of removing it from root.
For example, I've been learning Effect.ts for some weeks now. I've used LLMs extensively, but before that there were a series of manual coding rounds first.
To understand composability, the nitty gritty, where things break, how, how the syntax is formed, and how could I structure some observability challenges I had around the library.
If I hadn't gone through that process, the code quality would be subpar. It wouldn't have been evident at first, but once the system would begin to evolve and adapt to feedback, things would be brittle, existing customers would be affected, and more.
In my personal experience, agentic coding wasn’t useful, but using a chat inference, was. I still need to be the critical path, but the LLM has, indeed, become a major force multiplier.
A few minutes ago, I submitted an app for review, that I started work on, alone, in February. The Quality of the new version is astounding. I’m absolutely thrilled.
It’s a full rewrite (backend server, and frontend client) of a fairly large app that’s been shipping for a couple of years, and that took over two years, to originally write.
I wouldn’t have even tried it, without an LLM. That made all the difference. The majority of the work was done with the $20/month ChatGPT Plus subscription, but the last few days, as I developed supporting materials and Web sites, I used the $100/month Pro level. After my work, over the last few months, the upgrade was a “no brainer.”
But, at every step of the way, I needed to be there, to intimately review and manage the interaction with the LLM. There’s no way that I could trust it to “just do it.”
I’m sure that, sooner or later (likely sooner), LLMs will have progressed to the point that I can trust them to vibe-code a project like this, but I guarantee, that they aren’t quite there, yet.
To be fair, I know that I may have much higher standards than a fairly significant number of developers, but the end product of my work is about as far from “AI slop” as you can get.
When it's your own codebase that you know intimately, you obviously don't want it polluted, and you want to continue to understand everything that's there. For rewriting things you understand perfectly, or porting code to different platforms, the LLMs truly are a force multiplier. But that's so different from the way they are used on new projects. Letting them make design decisions is the problem. To make design decisions, you have to understand the system as a whole.
Seriously? I've explained this many times, but I assume that doing background research before insulting isn't a "modern" thing to do. Just Ready, Fire, Aim. Seriously, you could probably use ChatGPT to make a decent guess.
The issue is that the app addresses a specific (very privacy-aware) demographic. Each signup is manually vetted by two admins. It will probably never have more than a couple of thousand users, and the ones that are there, are more than a little [justified] paranoid.
Having several thousand curious geeks, do throwaway signups, just so they can see that the app is not for them, is not going to be helpful, so I never mention it here. If anyone really wants to know about it, I'm easy to contact. Unlike lots of folks, here, I am quite open about who I am.
The app, itself, is closed-source, but uses a significant number of open-source dependencies (that I also wrote -sometimes with AI help), which are easy to see.
I don't even know any more. I wanted a weather bapp that shows the whole forecast on one page with no scrolling, so I was ambitious and asked anti-gravity to build one for me. Half an hour later, done. Then I asked codex to review it and half the stuff didn't even work, made up wind gust data, misaligned hourly data, polluted caches. So I asked codex to fix the issues. Did it? I don't even know, it said it did.
The way to use AI is to make sure it has clear, verifiable success criteria, test suites, etc. Make sure any output has citations, reduce the need for trust to zero, etc.
I see people one shot stuff and it makes no sense, is completely fake half the time, just like you point out.
It should be the case that Codex and Claude Code should incorporate this kind of thing automatically at some point.
Claude Code more or less does have the tools to do this: plan mode, todo lists, user question prompts, et al. What it does not have is a "guided" mode where the agent (or harness) interviews you and helps you structure a work plan for the agent, including eliciting those success criteria and any design constraints the user might have in mind (eg it will be used on a boat over slow satellite connection). I can't speak for OpenAI but I get the impression that Anthropic think of these things as opt-in power user features, perhaps on the premise that their LLMs alone are "smart enough".
Fine article, though it ended on a low note with the comment about cryptography engineers gatekeeping the technology.
I have worked on high stakes crypto code. Getting it right requires a level of knowledge, care and engineering conservativism that is very hard to come by. I was teaching students. I wasn't gatekeeping. But a vanishingly small percentage of them were able to make secure software, or analyze existing code to know if it was secure.
In as much as AI coding makes testing or code verification cheaper, sure let's use it. But cryptography engineering is hard for reasons that are not "write moar code" and so AI coding should not be used on production crypto work.
As someone not in the know about cryptography, I know just enought that the words "custom cryptography" scare the hell out of me.
I'm not clear why someone would roll their own crypto. There are so many good solutions out there that are free that it seems pointless.
I keep hearing about post-quantum being an issue though.
It's time to get over the "never roll your own crypto!" bs.
AI can roll you crypto far better than what humans have built by hand. They can literally test things to an extent that no human ever would.
Everybody can device an encryption algorithm that they can't break themselves. That is not sufficient.
"Dropbox is like a thin bash script around rsync" vibe here
They don’t though. LLMs are massive cheaters when it comes to unit tests. Claude will just conveniently not write tests for things it knows will fail.
Lmao, please go do that and get back to me. The Dunning Krueger in this day and age is alarming.
If no one rolled their own crypto then there would be none.
"Don't roll your own crypto." sounds a lot like "Don't you worry about crypto. Let _me_ worry about crypto."
That's not really the point of the saying though. The point is more so that if you are the kind of person who is in a position to roll your own crypto you probably have a PhD and have worked with cryptography for years. And the thing that you're setting out to do is to produce a cryptography library.
If you're that kind of person, then sure go for it! But if you're a top person in the field of cryptography you didn't need anyone to tell you if you were fit to make a cryptography library anyway.
And if you're not that kind of person you do need someone to tell you because the whole field is a minefield where subtle oversights break the whole thing. If you want to just implement cryptography as a fun learning experience that's great. But actual implementations that people will actually depend on need to be handled by experts.
The necessary computer science, you could probably implement. The necessary computer engineering, however...
I'd say it depends.
On the degree the software evolves and will be used.
The reason we've spent years discovering patterns, creating special syntaxes has been to tackle certain domain problems more efficiently and to have systems that can evolve through time.
The only constant is change.
Albeit LLMs chunk out code (and with great know how impressive output), the developer must have the know how to pass a certain threshold.
Writing in unknown languages may seem fine at first. But once you go to the edge, you'll be finding certain quirks, inefficiencies along the way that the LLM may work around it instead of removing it from root.
For example, I've been learning Effect.ts for some weeks now. I've used LLMs extensively, but before that there were a series of manual coding rounds first.
To understand composability, the nitty gritty, where things break, how, how the syntax is formed, and how could I structure some observability challenges I had around the library.
If I hadn't gone through that process, the code quality would be subpar. It wouldn't have been evident at first, but once the system would begin to evolve and adapt to feedback, things would be brittle, existing customers would be affected, and more.
I like to move fast without breaking things
what i'm seeing is agentic coding helps be(come) more ambitious
build your own framework, database, operating system, game engine etc
things that used to be infeasible (too hard, too big, …)
> agentic coding
In my personal experience, agentic coding wasn’t useful, but using a chat inference, was. I still need to be the critical path, but the LLM has, indeed, become a major force multiplier.
A few minutes ago, I submitted an app for review, that I started work on, alone, in February. The Quality of the new version is astounding. I’m absolutely thrilled.
It’s a full rewrite (backend server, and frontend client) of a fairly large app that’s been shipping for a couple of years, and that took over two years, to originally write.
I wouldn’t have even tried it, without an LLM. That made all the difference. The majority of the work was done with the $20/month ChatGPT Plus subscription, but the last few days, as I developed supporting materials and Web sites, I used the $100/month Pro level. After my work, over the last few months, the upgrade was a “no brainer.”
But, at every step of the way, I needed to be there, to intimately review and manage the interaction with the LLM. There’s no way that I could trust it to “just do it.”
I’m sure that, sooner or later (likely sooner), LLMs will have progressed to the point that I can trust them to vibe-code a project like this, but I guarantee, that they aren’t quite there, yet.
To be fair, I know that I may have much higher standards than a fairly significant number of developers, but the end product of my work is about as far from “AI slop” as you can get.
When it's your own codebase that you know intimately, you obviously don't want it polluted, and you want to continue to understand everything that's there. For rewriting things you understand perfectly, or porting code to different platforms, the LLMs truly are a force multiplier. But that's so different from the way they are used on new projects. Letting them make design decisions is the problem. To make design decisions, you have to understand the system as a whole.
you can also situate the agent within your codebase and have it only write things you review (or have it not write/change the code at all)
> as far from “AI slop” as you can get
as always: no code, no link, not even a description.
Incoming reasons: possible doxx, "internal", etc. pp.
Sigh...
Seriously? I've explained this many times, but I assume that doing background research before insulting isn't a "modern" thing to do. Just Ready, Fire, Aim. Seriously, you could probably use ChatGPT to make a decent guess.
The issue is that the app addresses a specific (very privacy-aware) demographic. Each signup is manually vetted by two admins. It will probably never have more than a couple of thousand users, and the ones that are there, are more than a little [justified] paranoid.
Having several thousand curious geeks, do throwaway signups, just so they can see that the app is not for them, is not going to be helpful, so I never mention it here. If anyone really wants to know about it, I'm easy to contact. Unlike lots of folks, here, I am quite open about who I am.
The app, itself, is closed-source, but uses a significant number of open-source dependencies (that I also wrote -sometimes with AI help), which are easy to see.
And that's all I'll say.
Have a great day!
I don't even know any more. I wanted a weather bapp that shows the whole forecast on one page with no scrolling, so I was ambitious and asked anti-gravity to build one for me. Half an hour later, done. Then I asked codex to review it and half the stuff didn't even work, made up wind gust data, misaligned hourly data, polluted caches. So I asked codex to fix the issues. Did it? I don't even know, it said it did.
The way to use AI is to make sure it has clear, verifiable success criteria, test suites, etc. Make sure any output has citations, reduce the need for trust to zero, etc.
I see people one shot stuff and it makes no sense, is completely fake half the time, just like you point out.
It should be the case that Codex and Claude Code should incorporate this kind of thing automatically at some point.
Claude Code more or less does have the tools to do this: plan mode, todo lists, user question prompts, et al. What it does not have is a "guided" mode where the agent (or harness) interviews you and helps you structure a work plan for the agent, including eliciting those success criteria and any design constraints the user might have in mind (eg it will be used on a boat over slow satellite connection). I can't speak for OpenAI but I get the impression that Anthropic think of these things as opt-in power user features, perhaps on the premise that their LLMs alone are "smart enough".
Try Fable and make it write a ton of tests. I generally don't trust benchmarks, as they don't match my experience, but this one[1] very much does.
[1] https://www.primeintellect.ai/research/nanogpt-speedrun
Great minds… that’s what I vibe coded with Claude couple of weeks ago.
Fast and Hard - very much like Zapp Brannigan's love
Fine article, though it ended on a low note with the comment about cryptography engineers gatekeeping the technology.
I have worked on high stakes crypto code. Getting it right requires a level of knowledge, care and engineering conservativism that is very hard to come by. I was teaching students. I wasn't gatekeeping. But a vanishingly small percentage of them were able to make secure software, or analyze existing code to know if it was secure.
In as much as AI coding makes testing or code verification cheaper, sure let's use it. But cryptography engineering is hard for reasons that are not "write moar code" and so AI coding should not be used on production crypto work.