Technology

In all fairness, while this is a particularly bad case, the fact that it's often very difficult to safely fiddle with environment variables at runtime in a process, but very convenient as a way to cram extra parameters into a library have meant that a lot of human programmers who should know better have created problems like this too.

IIRC, setting the timezone for some of the Posix time APIs on Linux has the same problem, and that's a system library. And IIRC SDL and some other graphics libraries, SDL and IIRC Linux 3D stuff, have used this as a way to pass parameters out-of-band to libraries, which becomes a problem when programs start dicking with it at runtime. I remember reading some article from someone who had been banging into this on Linux gaming about how various programs and libraries for games would setenv() to fiddle with them, and races associated with that were responsible for a substantial number of crashes that they'd seen.

setenv() is not thread-safe or signal-safe. In general, reading environment variables in a program is fine, but messing with them in very many situations is not.

searches

Yeah, the first thing I see is someone talking about how its lack of thread-safety is a problem for TZ, which is the time thing that's been a pain for me a couple times in the past.

https://news.ycombinator.com/item?id=38342642

Back on your issue:

Claude, being very smart and very good at drawing a straight line between two points, wrote code that took the authentication token from the HTTP request header, modified the process’s environment variables, then called the library

for the uninitiated - a process’s environment variables are global. and HTTP servers are famously pretty good at dealing with multiple requests at once.

Note also that a number of webservers used to fork to handle requests

and I'm sure that there are still some now that do so, though it's certainly not the highest-performance way to do things

and in that situation, this code could avoid problems.

searchs

It sounds like Apache used to and apparently still can do this:

https://old.reddit.com/r/PHP/comments/102vqa2/why_does_apache_spew_a_new_process_for_each/

But it does highlight one of the "LLMs don't have a broad, deep understanding of the world, and that creates problems for coding" issues that people have talked about. Like, part of what someone is doing when writing software is identifying situations where behavior isn't defined and clarifying that, either via asking for requirements to be updated or via looking out-of-band to understand what's appropriate. An LLM that's working by looking at what's what commonly done in its training set just isn't in a good place to do that, and that's kinda a fundamental limitation.

I'm pretty sure that the general case of writing software is AI-hard, where the "AI" referred to by the term is an artificial general intelligence that incorporates a lot of knowledge about the world. That is, you can probably make an AI to program write software, but it won't be just an LLM, of the "generative AI" sort of thing that we have now.

There might be ways that you could incorporate an LLM into software that can write software themselves. But I don't think that it's just going to be a raw "rely on an LLM taking in a human-language set of requirements and spitting out code". There are just things that that can't handle reasonably.

Claude, being very smart and very good at drawing a straight line between two points, wrote code that took the authentication token from the HTTP request header, modified the process's environment variables, then called the library

Brilliant, 10/10. 😂

If he doesn't care or need to verify it, then it doesn't really matter.

These tools are great at creating demoable MVPs. They're terrible at creating maintainable codebases, and cannot be relied on to generate correct code. But if all you need is a demo or MVP, then it's likely you don't care, and that's often the case for personal tools that non-coders want to use.

The people using it to manage their personal finances are nuts though.

He doesn't need to understand it. Claude understands it.