alt Hacker NewsI have often whined about the quality (or lack, thereof) of today's software, but I certainly have no room to be smug. I recently turned an LLM loose on a number of mature packages that I wrote, and would have sworn were "perfect," and it found issues (thankfully, none, serious, but issues, nonetheless).
I think LLMs are a gamechanger. I was just talking to a friend of mine, last night, and he pointed out that it would have been quite difficult for a human (on their own) to find the PHP2Shell issue, but he thinks that multiple LLMs probably found it (it seems that some people knew about it before it was initially "discovered").
I think that we, as programmers, need to run LLMs on our own code -no matter what we think of them, for authoring the code- and do everything we can, to batten down the hatches.
Replies
>of today's software
There is tons of old software still around you can use your LLM to poke at. You'll see that it was crap too. Software has always sucked, very little of it has been formally verified or built.
I remember accidentally finding buffer overflows in Netware in school but I had no idea what that actually was at the time.
As someone relatively anti-LLM, I fully agree we should run them on our own code for a bug scan. I think the only two scenarios that make sense to avoid it is if you are ethically opposed to them AND releasing something just for fun, or if you are worried about IP issues from them training on your data AND haven't released the product yet. I have something in that second category, my plan is to run an LLM on it immediately before releasing.
My experience exactly, and also Linus Torvalds experience apparently, leading to a controversial and I think misunderstood take on AI-assisted coding.
Way too many people do the parallel LLM assistance = vibe-coding, opponents call it slop, proponents claim increased productivity. But vibe coding is just one aspect, but to me, analysis is where it shines, at least when quality matters.
We have static analyzers and sanitizers, sometimes fuzzers, which I think are essential to serious development work. Now, I think we can add LLMs to the list.
We blame AI for many evils, like a lack of understanding, code ownership, poor quality output, etc... This is the complete opposite, here the AI is not there to do the thinking for you, instead it says "here look, have your thought about this?", what to do next is up to you, you are in full control of the situation. It also makes development slower instead of faster, again, the opposite of what people claim AI does. But to me, it is the good kind of slow, as in "slow and steady wins the race".
I’d like to push back on the idea that this bug would have been quite difficult for a human to discover. I’m not much of a C programmer these days, but I’ve known longjmp to be a code smell for decades now. The reasons why were broadly covered in a 1968 CACM letter to the editor by Dijkstra that we’ve all certainly heard about. Though possibly not everyone makes the connection because if all you know of the article is its title then you can perhaps be forgiven for thinking it was only talking about one language keyword in particular.
What I’m getting at is that this PHP bug was adorned with marquee lights and sirens and a giant sign saying, “Hey, look here!”
That said, when that code was written 20 years ago they could perhaps be forgiven for this approach to handling OOM. The alternatives apparently come with a pretty decent performance penalty, and culture around memory safety wasn’t as strong then as it is now. But in 2026 there is an argument to be made that exploits are so common and damage potential is so high that we need to take the same mindset that flight control software developers have in their coding standards: some ways of doing them are dangerous enough that simply using them is a defect, even when they work exactly as intended, because they are just too hard to reason about.
Walk down the street in your local neighborhood. Most modern subdivisions have a single builder, but imagine it's an older street with a variety of homes. They all stand, they all hold off the elements well enough. They are heated, they are wired, and they are certainly comfortable enough to live in.
Now imagine you are an inspector. You enter these homes one by one and discover suboptimal electrical wiring, misaligned trimming, nonsensical handle placement, lazy tile jobs, etc.
Is it a problem? Only once it becomes one. There might be 10 things in your house right now that need fixing, but you will probably not become aware of them until they reach a critical point: a leak, a fire, a collapse.
The human body is similar, no? How many ticking health time bombs are you sitting on?
Maybe this is a reminder for you to go get that exam, haha.