Chameth.com - posts like debugging-beyond-the-debugger, the-ethics-of-llms, why-you-should-be-using-https but not docker-automatic-nginx-proxy, migrating-from-github-to-forgejo

How tech companies failed to build the Star Trek computer

2025-07-16T00:00:00Z

A computer core room on the Enterprise-D

In most Star Trek series, the ship or station computer is ever-present in the background, waiting to be called on by the main characters¹. It nearly always does exactly the right thing, and there’s little limit to the functions it can perform. Take this mundane example from DS9:

KIRA: Computer, establish link with the Bajoran Medical Index for the Northwestern District.
COMPUTER: Link established.
KIRA: Access all information on Doctor Surmak Ren.
COMPUTER: There are no records matching that name.
KIRA: Try the Northeastern District, same search.
COMPUTER: Doctor Surmak Ren, currently serving as Chief Administrator of the Ilvian Medical Complex.
KIRA: Computer, open a channel to the Ilvian Medical Complex. Administrator’s office.

The computer is doing some kind of networking to a database only identified by name. It does a search and summarises the lack of results. It then repeats the process with another database, and succinctly announces the results. Finally, it opens a communication channel to a specific room in a facility, based only on its name.

This whole interaction is remarkably boring². Kira doesn’t have to know any URLs or API endpoints, or what protocol she wants to use. She doesn’t have to open a specific app and then login and then try the query again. She just says what she wants and the computer does it.

It seems like this should be one of the most easily obtainable bits of sci-fi wizardry with our current technology. We have multiple massive companies throwing lots of money at digital assistants, LLMs that are improving at an insane rate, but we’re somehow not even close to the usability or usefulness of the Trek computers. What gives?

Boring is, well, boring.

Larry Page once said something that might help explain it:

The Star Trek computer doesn’t seem that interesting. They ask it random questions, it thinks for a while. I think we can do better than that.

This is the same Larry Page that founded Google, whose mission statement is “to organize the world’s information and make it universally accessible and useful”. Of all people, surely he should find an omnipresent computer that can answer ‘random questions’ interesting?! It seems like it should be the epitome of Google’s mission!

Google’s “better than that” seems to have been to stuff LLMs into every product they can, even when you don’t want them there. Even when they’re worse than the normal content they displace. These things look exciting when they’re part of a scripted demo at Google I/O, but they fall flat and just get in the way when they’re exposed to the reality of day-to-day use.

The Star Trek computer is the opposite: it isn’t snazzy, but it is genuinely useful. That means it’s not an attractive target for the company execs who want marketing opportunities, and it’s not appealing for engineers who need to demonstrate “impact”. But even if Google did try to make the Trek computer, there are other problems…

Assistants need to be free

A significant amount of tech companies’ business models currently revolves around trapping users in walled gardens. They want you using their ecosystem; that way they get more data from you, and you’re more likely to spend more money on their other offerings that work together. There’s barely any incentive to allow any kind of interoperability with other platforms outside carefully contracted integrations.

I remember trying to help a family member move their photos from iCloud to Google Photos. At one point they turned around and said, exasperated, “why is this so hard? Aren’t they both in the cloud?!”. It’s easy to dismiss that as someone who hasn’t quite grasped the fundamental idea that “the cloud” is just someone else’s computers, but that’s not the whole story. There’s no reason why there shouldn’t be a quick and easy transfer: both services already allow uploading and downloading, there’s just no incentive for the companies involved to make it so³.

These kinds of misaligned incentives and walled garden business models cause even more problems when it comes to digital assistants. Siri is basically never going to be able to interact with, say, your Google Drive; ~~Bard~~ Gemini is never going to be able to send a message via iMessage. Even when there are appropriately blessed interactions, they’re so clunky. Can you imagine Captain Picard saying “Computer, ask the turbolift skill to take me to deck 5”?

Someone else’s computer

Software issues aside, there’s still a key difference between the Star Trek computers and our current batch of digital assistants: where they run. The Trek computers are all housed within the ship or station they serve; they can connect elsewhere to gather information, but they run entirely independently. If they go wrong, a local engineer can go in and fix things. While some of our assistants may have physical hardware in your home, they don’t work without a vast cloud apparatus behind them. If your Internet connection fails, they become paperweights. If the company running them decide to remove some functionality you depend on, you have no recourse.

That kind of helplessness isn’t limited to assistants, either. There’s a rapidly growing trend of being unable to modify or repair hardware you fully own and control. Part of this is just that they’re becoming more complex: it’s a lot harder to replace a microchip than a gear, but companies are also going out of their way to make it more difficult for users through draconian DRM regimes⁴ and aggressive intellectual property enforcement. If the US Navy can’t repair their own equipment because a corporation says so, what hope do consumers have?

We’re approaching a point where you don’t actually own anything. Software is cloud and subscription based, hardware is unrepairable. Even cars can be remotely updated and have features added or removed. The Federation wouldn’t allow a third party control over their ships⁵, so why are we so happy to put up with it in everything we consume?

A small ray of hope?

The most promising way of tackling all of these problems is through legislation. The EU’s Digital Market Act is an attempt to force ‘gatekeepers’ like Google, Apple and Meta, to allow third-party access to their services. It seems like a pretty reasonable approach, but the tech companies are unsurprisingly resisting it. Apple in particular have gone out of their way to refuse to comply, and when forced to do so have limited the functionality to people in Europe. Still, the DMA is a promising start, and if similar legislation is introduced (and robustly enforced) elsewhere it might start forcing companies to behave a bit better.

There are also smaller companies that actually do the right thing. Framework make laptops that are user-serviceable; Fairphone do the same for mobile phones. Smaller software companies provide useful, open APIs. The average person on the street will probably have never heard of these, unfortunately, but they do still exist. Maybe as the bigger tech companies tighten the screws more, people will turn to alternatives like this? Or maybe we’ll just keep accepting that our computers work for everyone but us?

Unless, of course, the computer is playing the role of the episode’s MacGuffin and has contracted space-computer-COVID or something, then it’s a lot less in-the-background. ↩︎
It’s almost like it only exists to move the plot along. ↩︎
You can generally export your data, thanks to a combination of legislation and efforts like Google’s “Data Liberation Front”, but I’ve never seen an export format that could then just be imported into an equivalent commercial product. ↩︎
Oh, you’ve changed the screen on your iPhone? Better hope it can do the secret handshake with the Apple hardware. ↩︎
I think there might actually have been an episode where that did in fact happen. We’ll just ignore that as a plot contrivance. ↩︎

The Ethics of LLMs

2025-06-22T00:00:00Z

I’ve written about LLMs a few times recently, carefully dodging the issue of ethics each time. I didn’t want to bog down the other posts with it, and I wanted some time to think over the issues. Now I’ve had time to think, it’s time to remove my head from the sand. There are a lot of different angles to consider, and a lot of it is more nuanced than is often presented. It’s not all doom and gloom, and it’s also not the most amazing thing since sliced bread. Who would have thought?

It’s worth noting that I’m just setting out my position here. I’m not trying to convince you to change your mind. To set the scene a bit, I mainly use Claude Code as a programming tool. I use the Claude chat interface sometimes to proofread things, do random one-off data analysis, or help organise things. More rarely I’ll try to use it to brainstorm things, or recommend things, or do more “creative” things, but I don’t trust it enough in those domains to do it often. I don’t use it for research or as a Google replacement¹, which I recognise probably makes me a weird half-in-the-water, half-out-of-it class of user.

Copyright & Corporate Control

One of the key issues, and something that is being prosecuted in several court cases right now, is how LLMs interact with the copyright system. And by “interact with” I mean “run roughshod all over”. It seems pretty obvious from my lay perspective that if having 10 seconds of pop music in the background of a YouTube video is copyright infringement, then Meta pirating books via BitTorrent must also be.

That said, the entire copyright system as it exists now is fundamentally broken. I don’t mind the idea of individual creators having protection, but I absolutely hate how copyright is wielded as a blunt instrument by massive corporations to intimidate individuals and to try to earn more money. If a law enables a huge conglomerate to sue the author of an open source project for a theoretical 75 trillion dollars then that is a bad law. Copyright today has been twisted well beyond what it was meant to be originally, thanks to lobbying by people and businesses with lots of money that want to keep it.

So if copyright law is not fit for purpose, are LLMs fine? Well, not quite. The argument that LLM training is a bit like a child learning to read holds some merit, but it falls flat when LLMs can regurgitate the input material verbatim². Personally I don’t care if they steal all the content of the New York Times and all the Disney characters that are still in copyright. It’s the individual harm that bothers me: the struggling author whose words are slurped up by the LLMs and regurgitated, potentially costing them readers; the open source dev who chooses a copyleft licence on their work, only for an LLM to dump complete copies of functions in someone else’s codebase with no attribution or licence, stopping any future improvements from being released for the public good.

I can mostly mitigate those concerns in my personal use. When coding I generally direct the agent closely enough that the opportunity to drop in massive chunks of someone else’s code is negligible. I don’t use LLMs to generate big chunks of written content. Overall I’m reasonably happy that I’m not making anyone worse off.

One related area that doesn’t affect me much because of my limited use, but does concern me a lot, is corporate control. Most of the frontier LLMs are built by big tech companies. As more and more people are using LLMs, they become an avenue for control over information. It’s clear the people in charge should not be trusted with that responsibility, as Grok’s whole Boer War thing demonstrated. I’m not sure what the answer is, though. Would a government built LLM be any better? Probably not. The requirements to actually do the training are so high that the only people who can do it are the ones you wouldn’t want to.

So I’m left in the uncomfortable position of using tools by companies I don’t trust, trained on data they shouldn’t have been trained on. Still, there can’t be many more ethical issues, right?

Forced Features & Flattery

Before we get onto the more obvious ethical topics, let’s go on a brief detour so I can complain about how LLMs are being crowbarred into seemingly EVERY SINGLE SERVICE. I don’t want an LLM in my text editor. Or when shopping. Or taking screenshots of everything my computer does every few seconds. I don’t want LLMs anywhere outside a clearly-defined LLM box. With these forced integrations, you’re even more in the dark about what their prompts are, what information they have access to, what underlying model they’re using, and so on.

There’s no good reason for 90% of these implementations; there’s just some weird Silicon Valley hype train that everyone is scared to miss out on. And as a result we get more and more screen real estate taken up with things with animated gradients that can’t be turned off and are prompted to talk in an insufferable manner.

The problem isn’t just that they’re everywhere, though, it’s how they behave when they’re there. The overly sycophantic behaviour that most LLMs adopt can hook users in the same way a social media app can fiddle with its algorithms to encourage people to keep scrolling. It’s a lot harder to dismiss an LLM when it’s blowing smoke up your ass. Now I don’t believe this behaviour is actually intentionally nefarious, but more of an artifact of the models overfitting on user approval instead of something useful like accuracy.

The combination of going too far to please the user and hallucinating things is incredibly problematic. How are ordinary, non-tech savvy, people meant to deal with these models being forced in front of them? If you ask a question and get back a flattering answer that’s roughly the shape of what you were expecting, would you question it? Would a student, who was doing their homework in Google Docs when an LLM inserted itself into their lives question it?

This isn’t just a problem for naive users, either: I occasionally ask Claude Code “Can we do X?” and discover much later that the answer should either be an emphatic “NO”, or at least have a page of caveats attached. But the LLM wouldn’t want to displease me, so it tries to do what’s asked of it, with all kinds of weird hacks, and ultimately gets itself tied up in knots. This is not how a tool should behave. If I wanted someone to say “Yes, and” repeatedly I’d join an improv troupe.

Environmental Expenses

The biggest ethical issue with LLMs is their environmental impact. Are we adding more fuel to the dumpster fire that is our planet, just so my phone can inaccurately summarise news headlines for me? The answer is a resounding “maybe”. The companies making the LLM models are cagey about how much energy goes into making them and then answering queries. There are estimates for the latter, but there are several orders of magnitude between the most optimistic and most pessimistic. LLMs are definitely not good for the environment. Basically no computer activity is³. But you don’t see people campaigning to shutter YouTube (for example) because of its environmental impact. I struggle to see the difference.

I’m not saying considering the environmental impact isn’t important. We are killing the planet. We are not doing enough about it. More attention to the climate crisis in general is a good thing. But even with the most pessimistic estimates on power usage, my personal LLM usage is a drop in the ocean. I can have far more impact by reducing the amount I travel, avoiding red meat, and so on.

One issue I do have, though, is the forced integrations I mentioned. I’m happy with my personal usage. I’m not happy that a whole slew of LLMs are being operated on my behalf. How much power is wasted by Google generating LLM results in every search results page, versus how much benefit it provides? How do people know if a search box will just use a few Watts doing a database search, or burn kilowatts⁴ spinning up an LLM and filling its context window?

Then there’s the issue with training. Who knows what resources go into training these models? Whether the amortised cost of that across all its users is worth it? I think the answer to the first question is “only the tech companies making the models”, and their utter silence on the second question says volumes.

But this kind of industrial power isn’t unique to LLMs. There are many industries that do far worse. And that’s not a justification, but I think it makes sense to look at them more holistically. In an ideal world, where we have functioning governments that listen to scientists⁵, we could address all of this with legislation on emissions and clean power. Then all of these industries will either manage to function in a manner compatible with keeping the planet alive, or will have to stop. I appreciate that actually legislating that is about as likely as waking up one day to find Claude has become an AGI, though.

Slop & Survival

We’re nearly done, I promise. You can see why I didn’t want to try to tackle these issues in an earlier post! The last big issue I want to talk about is slop. It feels like it’s everywhere, and still getting worse.

The Internet has slowly morphed from a wonderful place full of individual, quirky sites, into a desert of bland corporate silos, and now into a wasteland of AI slop. It’s becoming more and more difficult to find original information. There’s this conspiracy theory called “Dead Internet Theory” that basically says nearly all traffic on the Internet is generated by bots as part of a co-ordinated effort to manipulate us. Obviously it’s unhinged, but at the same time some elements of it are not that far off the mark. How long will it be before the Internet is so drowned in slop that it is, effectively, dead?

The other issue is what happens to the human jobs that have been replaced with slop? It’s way too easy for a money-pinching publication to get rid of their human staff in favour of pushing a few buttons and publishing the output. You’d hope that market forces would balance things out, but there doesn’t seem to be much sign of that happening. There are small movements of people putting badges and other marks on their work to show it was made by a human, perhaps that will take off?

On a more personal level: what happens to software developers? As it stands, code agents are nowhere near good enough to replace a human. At least not if you want a non-trivial output that works, can be changed in the future, and doesn’t have massive issues. Even if they get substantially better, I feel like you’d still need a knowledgeable human in the loop to keep a rein on everything. Does that mean the world needs far fewer software engineers? Probably. But it doesn’t mean we’re all going to be out of jobs overnight as some people seem to be predicting. The only way I can see that ever happening is if there’s a radical shift in how software is made: a new language of some kind that’s uniquely suited to LLMs, or new ways of composing software together from smaller parts⁶.

So… Yeah. Where does that leave us? I’ve written several thousand words about how LLMs are an ethical mess, but I’m going to carry on using them. That’s uncomfortable. But it’s not unlike using Amazon: they’re not a great company, I’d rather give the money to a local shop or supplier, but I’m also not going to massively inconvenience myself by being quixotic about it. Life is about compromises like this, and it’d be silly to think otherwise. I’ll stand on morals on some things⁷, but not to the extent of becoming a reclusive old crank shouting at the clouds.

That’s what Kagi is for. It’s great. You should try it. ↩︎
Or, maybe even worse, with added hallucinations. ↩︎
Hell, basically no human activity is good for the environment. ↩︎
±several kilowatts, because who knows? ↩︎
and didn’t elect people who withdraw from climate agreements, re-open coal plants, and so on… ↩︎
I don’t think I’m just saying this to reassure myself… ↩︎
I’ll grudgingly give Jeff Bezos money, but I sure as hell am not going to use any service from Elon Musk. ↩︎

An app can be a ready meal

2025-06-11T00:00:00Z

It’s not a home-cooked meal, but it does the job sometimes.

Three years ago I read “an app can be a home-cooked meal” by Robin Sloan. It’s a great article about how Robin cooked up an app for his family to replace a commercial one that died. It’s been stuck in my head ever since. It’s only recently that I’ve actually done anything like Robin described, though. Part of the reason was my brain got too hung up on the family aspect: in my head, a home-cooked meal is one where your family or friends all gather around to eat it with you (in much the same way as Robin’s app is used in the article). It took me an embarrassingly long time to realise that you can apply all the same arguments to an app built just for you. And it doesn’t even have to be difficult. In fact, it can be more like a ready meal¹ than a family dinner.

Why not open source?

I love open source software. Almost everything I use day-to-day is open source, and most things I write for myself I release as open source. I believe that should be the default stance for most software. So why would you want to make something and keep it just for yourself?

Even if an open source project garners no users whatsoever, there’s still some pressure for it to meet certain standards²: if it needs configuring, then there needs to be a mechanism for people to do that; the code needs to be of a reasonable quality — my open source projects are linked from my CV, potential clients might be looking at them — and there needs to be at least some attempt at documentation or showing other people how to use it. There’s “building in public” and then there’s “inviting the whole world to poke around your drawer of shame”.

The way I usually work on things that are mostly for me is I hack them together, and then I gradually force myself to fix them up into a state where I consider them acceptable for release. That stage isn’t fun, and sometimes it adds more complexity than the whole original project. I’m not saying open source isn’t worth it — far from it! — but there is definitely a balance to be struck between the utility of making something open source and the amount of effort it takes.

For example, I mentioned previously that I wrote a home automation system. Hidden within that is a ~40 line function that determines whether a fan should be turned on to keep a room cool. The logic is entirely unique to the devices on my network and my requirements. To try to put it into a form that would be useful to anyone but me would take exponentially more effort. I’d basically be re-inventing Home Assistant, and I explicitly started that project because I didn’t need that kind of complexity. For a while I had this nagging feeling that I should find a way to open source it. Then I had my³ “lightbulb” moment: I could just not.

Writing something entirely for yourself, without planning on open sourcing it is surprisingly liberating: you don’t need to worry about documenting things; you can change anything and everything at will without having to worry about migration paths or whether it’ll break anyone’s workflow; you don’t have to configure things, you can just code them how you want. Hell, you can hard-code API keys right in the source code. Who cares!

The microwave revolution

XKCD 1205

One of the other problems with making software just for yourself is that often the time investment just isn’t worth it. If I spend a day automating something that normally takes me five minutes, it’s going to take an awful long time to “break even” on that time spent. If you’re open sourcing something then there are ancillary benefits that may tip those scales: you might help other people, have something to show off, etc. But if it’s just for you, then XKCD 1205 is a harsh mistress.

Recently, though, a new tool has emerged that tips the balance: LLM assistants. I’ve talked about my experience before. I’m definitely not comfortable letting an LLM run roughshod over my published code, even if it can help write some of it, but for private code? Why not! For a trivial example: I have a USB key with an Arch Linux ISO on it, in case I need to troubleshoot or reinstall my PC. Every so often I’ll update the ISO to the latest version. It probably takes 5 minutes to do, so it’s probably only worth 25-50 minutes to optimise it. Can I write, test, and debug a script to do it myself in that time? Probably not. Can I get an LLM to generate some code to do it for me, and then spend 10 minutes reviewing it⁴? Easily.

To continue with the strained metaphor: LLMs are like the microwave that nukes your ready meal. Pop in a prompt, let it use a load of power for a while, and out pops your app. You can even do it on your phone while sat on a sofa⁵. That changes the time equation even more: you can just squeeze in a prompt whenever something comes to mind.

This also goes back to the open source issue: I don’t feel comfortable publishing something created by an LLM with minimal intervention on my part. If I can prompt an LLM to do something, so can anyone else. We don’t need more slop out there, and I don’t want there to be any confusion about what I’ve written and what I’ve just prompted into existence. But for personal projects that will never see the light of day it’s perfect.

What I’ve made

Besides the home automation controller, I’ve built a constellation of smaller tools: a script to arrange windows on my monitors how I want them⁶, one to help me verify that my backups are working and can be restored, one to create the files/folders for a new blog post, and some other odds and ends. They’re all pretty small, and pretty specific to my setup.

My biggest just-for-me project is a web app that I started to help me aggregate film recommendations. It’s since morphed into a general personal data aggregation service: it deals with data from GitHub, Todoist, Letterboxd, TMDB, Healthkit, and others. It also lets me make re-orderable lists, store recipes, and more. Parts of this could definitely be open sourced, and I might carve them out at some point, but it’s mostly a glorious hodge-podge of things specific to me. Having all these services in one place lets me make quick and dirty automations, for example: when I create a Todoist note on my phone or watch, I often forget to set the due date, so it doesn’t show up in the “Today” view. It was literally a few lines of code to plumb things together so any inbox task without a due date gets set to today automatically.

If I was trying to write these things in a way that would be useful to other people, or — for some of the features — without the aid of an LLM, I just wouldn’t be bothered. It’d take too much time for questionable benefit. But there’s a kind of joy in just being able to hack things together that work just well enough for you. A ready meal will never compete with a home-cooked meal, but sometimes it perfectly hits the spot.

Image credits	Creator	Licence	Source
Spaghetti carbonara	Wikimedia user Geni	CC BY-SA 4.0	Wikimedia
XKCD 1205	Randall Munroe	CC BY-NC 2.5	XKCD

or a “TV dinner”, if you’re North-American-ly inclined. ↩︎
Self-imposed pressure, for sure, but brains are going to do brain things. ↩︎
very obvious in retrospect ↩︎
Reviewing LLM-generated code that shells out to dd to write to the root of a storage drive is perhaps the most intensely I’ve ever reviewed any code to date. I really didn’t want to write a blog post about how an LLM blatted my hard drive! ↩︎
Phones are terrible input devices for code, but they’re just about passable for typing English. ↩︎
I basically want a tiling window manager, but without all the effort and weirdness of a tiling window manager. ↩︎

Coming around on LLMs

2025-05-28T00:00:00Z

Claude says hi.

For a long time I’ve been a sceptic of LLMs and how they’re being used and marketed. I tried ChatGPT when it first launched, and was totally underwhelmed. Don’t get me wrong: I find the technology damn impressive, but I just couldn’t see any use for it.

Recently I’ve seen more and more comments along the lines of “people who criticise LLMs haven’t used the latest models”, and a good number of developers that I respect have said they use coding models in some capacity. So it seemed like it was time to give them another shake.

The first decision to make was which model to try. OpenAI are no longer the only player in the game, every tech company of a certain size is now also somehow an AI company¹. I looked a bit at some benchmarks, and then mostly ignored them and went with the only company that I didn’t outright hate: Anthropic, and their model Claude.

Initial impressions

The latest Claude models do feel a lot more “capable” than the earlier ChatGPT versions I remember, but they also still have a lot of the same problems. At their heart, they’re still text-prediction models, and still seem to be trained to predict text that will please the user rather than be factually accurate or useful.

One of the improvements that people kept mentioning was the ability for models to access the web directly. I’ve seen it kick in a bit naturally, and asked for it explicitly sometimes, and it’s… nothing special? Are people just really bad at searching the web? Maybe they should try Kagi? I feel like about 80% of the time I could have found the information just as quickly myself, about 10% of the time it searched and then hallucinated an answer, and the remaining 10% it found something quicker than I otherwise would have. Those aren’t great results, especially when you consider how much cheaper and simpler just searching the web is.

There is another way to trigger web searches in Claude: using “research mode”. When you enable it, it splits off into different models: a “lead researcher” to come up with a plan, and then some minions that execute it. It ends up doing hundreds of web queries in the span of a few seconds. Suddenly I understand why things like Anubis need to exist. I’ve not used the “please launch a DoS attack” button since.

What did impress me, though, was its ability to churn out reasonable-ish code. It can hack together a bash script as well as I can, and do it far faster than I’d be able to. Sometimes they even work. That made me wonder what it would be like doing actual coding with it. Anthropic have a CLI tool called claude-code, so I paid them lots of money and gave it a spin.

Coding with Claude

The first thing I notice about claude-code is that I really like the interface. It’s basically an input box in a terminal. It doesn’t force me to use a certain IDE or do things in a certain way. By default it asks before making any changes, showing you a side-by-side diff of what it’s doing and allowing you to provide feedback. If I had to design a way to interact with a coding agent from scratch, I can’t think of many things I’d improve.

A simple example of a claude-code session

The power in claude-code versus just using the web UI is that it can use tools. It can query git, run grep commands, even use sed if it wants to change something in lots of files at once. It’s very good at figuring out its way around a codebase, even without any explicit instructions. You can see in the screenshot that with a little prompting it managed to get the permalink to this post; I didn’t tell it where the posts were stored, or how to work out the latest, I just told it when it was wrong. If I’d run /init before it would have probably picked up on the fact that my posts have custom permalinks, and noted it in CLAUDE.md.

But how good is it at actually writing code? It’s like having a keen but not particularly thorough Junior Engineer at your beck and call. If you give it a clearly defined task and guidance on how to implement it (and maybe some feedback as it suggests changes), it’s more than capable of doing it. If you don’t give it enough guidance it tends to go more off the rails. I tried having it generate a simple application from scratch with minimal technical guidance and no review of what it was doing, and it made such a mess of it I decided it was quicker to throw it away and start again by hand.

The man behind the curtain

Even with sufficient guidance, at times it’s really obvious that it’s an LLM generating pleasing-token-strings and not something that genuinely understands what it’s doing. It will spit out code like this:

if err != nil {
    if err == sql.ErrNoRows {
       return nil, err
    }
    return nil, err
}

Why’s that check for sql.ErrNoRows there? It’s entirely pointless. There was no instruction to check for it, none of the existing code checked for it, but I assume it comes up quite a bit in the training data. But it didn’t understand why, so it put the check in, and returned the exact same thing as if it hadn’t.

It also occasionally tries to “cheat” or solve problems the wrong way. It sometimes feels a bit like you’re asking for wishes from a Monkey Paw. “Stop the unit tests failing”, you’ll say; Claude will respond with a request to delete the failing test. The man behind the curtain isn’t particularly well hidden, and the training data and pattern matching often shows through.

This lack of understanding also makes it very hard to get Claude to use comments in a sensible way. It absolutely loves doing nonsense like this:

// render form
function renderForm() {
    // ...
}

Even with explicit instructions to avoid useless comments, or comments that only explain what the code does (not why it does it), or other prompts. Again, I’m chalking it up to a mixture of training data that does that, and lack of any actual understanding about why a human developer may want a comment to exist. Of course, there are plenty of flesh-and-blood devs out there that also don’t comment effectively, so maybe I shouldn’t give Claude too much of a hard time on this.

… and yet …

So with all those problems, it sounds like it’s just not worth it, right? Well, not quite. I feel like programming mostly consists of two distinct tasks: thinking how to implement things; actually implementing them; and then debugging why you’re off-by-one somewhere. Letting an LLM do the thinking is a big no-go for me: it’s evidently not good at it, and frankly that’s one of the things I most like about programming. Having let it loose on small projects, I shudder to think what the codebases of all the “vibe coded” projects that are popping up are like.

For the second stage, though, it’s actually quite nice. If I’ve thought through how I want something to be implemented, I can feed those steps to Claude and have it churn out the otherwise not-too-interesting code. This requires far less time and concentration on my part than writing code, to the extent that I can be thinking about the next feature, or doing something else at the same time. I don’t feel like I’m going to end up deskilling myself this way, as I’ve already formed the idea of what I want to code, I’m just using the LLM to spit it out faster than I can type it.

A lot of the most boring bits of coding like implementing CRUD-y operations can be summarised as “Look at this file/function. Do the same thing but slightly differently elsewhere”. Claude is great at this, especially when explicitly prompted like that. You’re basically playing to its pattern-matching strengths, rather than asking it to come up with anything novel. Most of my prompts tend to be prefixed with “Look at @some_file.go and @other_file.go.” to cue up the patterns I want it to use, and I find this works well.

As for debugging, it’s a mixed bag. It’s sometimes amazingly insightful, and sometimes just runs around in circles trying the wrong things over and over. It’s worth asking the question, but I definitely wouldn’t rely on it over my own abilities.

The future

I’m probably going to carry on using claude-code, at least for personal projects. I’ve got so much done that I just wouldn’t have been bothered to do if I was doing it all by hand. I very much enjoy being in the more “diffuse thinking” mindset, planning how things are going to work, rather than being stuck in the mines digging out SQL queries. After all, who wouldn’t want an over-eager assistant to work on all their hobby projects?

Work is a slightly different matter: a private project or even an open source project that disclaims any liability is different to something I’m being paid to deliver, and bear responsibility for fixing if it’s not done correctly. I’m not saying I won’t use it at all, but if I do it’ll be much more constrained than I would in personal projects.

As for non-code usages: I’m not sold. My sceptic hat is still firmly in place. I don’t think chat is a particularly good interface for many things, and hallucinations are still a big problem despite what people say. I hate the tide of AI slop that’s taking over the Internet, and how LLM-powered chat agents are being forced into every random product. You’re definitely not going to be seeing any AI-generated blog posts from me!

One topic I’ve not gone into here is the ethical concerns about using LLMs. They obviously exist, and I do have thoughts, but that’s a topic for another day.

I’m surprised it’s not gone more mainstream: why’s there no Tesco Value LLM model, yet? ↩︎

Debugging beyond the debugger

2019-05-08T00:00:00Z

Real-life debugging tools

Most programming — and sysadmin — problems can be debugged in a fairly straight forward manner using logs, print statements, educated guesses, or an actual debugger. Sometimes, though, the problem is more elusive. There’s a wider box of tricks that can be employed in these cases but I’ve not managed to find a nice overview of them, so here’s mine. I’m mainly focusing on Linux and similar systems, but there tend to be alternatives available for other Operating Systems or VMs if you seek them out.

Networking

tcpdump

tcpdump prints out descriptions of packets on a network interface. You can apply filters to limit which packets are displayed, chose to dump the entire content of the packet, and so forth.

Typical usage might look something like:

# tcpdump -nSi eth0 port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
16:03:35.577781 IP6 2001:db8::1.54742 > 2001:db8::2.80: Flags [S], seq 2815779044, win 64800, options [mss 1440,sackOK,TS val 2378811665 ecr 0,nop,wscale 7], length 0
16:03:35.586853 IP6 2001:db8::2.80 > 2001:db8::1.54742: Flags [S.], seq 1522609102, ack 2815779045, win 28560, options [mss 1440,sackOK,TS val 3063610173 ecr 2378811665,nop,wscale 7], length 0
16:03:35.586877 IP6 2001:db8::1.54742 > 2001:db8::2.80: Flags [.], ack 1522609103, win 507, options [nop,nop,TS val 2378811674 ecr 3063610173], length 0
16:03:35.620678 IP6 2001:db8::1.54742 > 2001:db8::2.80: Flags [P.], seq 2815779045:2815779399, ack 1522609103, win 507, options [nop,nop,TS val 2378811708 ecr 3063610173], length 354: HTTP: GET / HTTP/1.1

Here you can see the start of a plaintext HTTP request: the three-way handshake as the TCP connection is established followed by a GET request. Even if the data is encrypted as it will be in most cases, it’s often useful to see the “shape” of the transmissions: did the client start sending data when it connected, did the server ever respond, etc.

Daniel Miessler has a good tutorial on tcpdump if you’re not familiar with it and don’t want to jump straight into the man page.

… with Docker

Docker sets up separate network namespaces for each container. To see the traffic across the interfaces of a single container you can nsenter the container’s network namespace:

# nsenter -t $(docker inspect --format '{{.State.Pid}}' my_container) -n tcpdump -nS port 80

This retrieves the PID for the container, and tells nsenter to enter the network (-n) namespace from the given target (-t) PID, and then run the given command (in this case tcpdump ...).

openssl s_client / s_server

When a connection is using TLS it’s often useful to try connecting to the server and see what certificate it presents, algorithms it negotiates, and so forth. OpenSSL offers two useful subcommands which can help with this: s_client for connecting as a client, and s_server for listening to connections.

For example, using s_client to connect to google.com on the standard HTTPS port shows us details about the server cert and its verification status:

$ openssl s_client -connect google.com:443
CONNECTED(00000003)
depth=2 OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
verify return:1
depth=1 C = US, O = Google Trust Services, CN = Google Internet Authority G3
verify return:1
depth=0 C = US, ST = California, L = Mountain View, O = Google LLC, CN = *.google.com
verify return:1
---
Certificate chain
 0 s:C = US, ST = California, L = Mountain View, O = Google LLC, CN = *.google.com
   i:C = US, O = Google Trust Services, CN = Google Internet Authority G3
 1 s:C = US, O = Google Trust Services, CN = Google Internet Authority G3
   i:OU = GlobalSign Root CA - R2, O = GlobalSign, CN = GlobalSign
---
# ...

Whereas connecting to my webserver and providing an unknown host in the SNI field results in an SSL alert 112 (“The server name sent was not recognized”) and no server certificate is sent:

$ openssl s_client -connect chameth.com:443 -servername example.com
CONNECTED(00000003)
140384831313024:error:14094458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:../ssl/record/rec_layer_s3.c:1536:SSL alert number 112
---
no peer certificate available
---
# ...

Often if you hit this kind of alert in an application the exact error will be lost somewhere in the many layers between the SSL library and the logs, so being able to directly connect and test can help diagnose a lot of issues.

Once a connection is established you can read and write plain text and it will be encrypted and decrypted automatically.

Java apps

If a Java app is involved in the connection, you can enable a lot of built-in debugging with a simple JVM property: javax.net.debug. You can tweak what exactly gets logged, but the easiest thing to do is just set the property to all and you’ll see information about certificate chains, verification, and packet dumps:

$ java -Djavax.net.debug=all -jar ....
# ...
found key for : duke
chain [0] = [
[
  Version: V1
  Subject: CN=Duke, OU=Java Software, O="Sun Microsystems, Inc.",
  L=Cupertino, ST=CA, C=US
# ...

More information about Java’s debugging options is available on docs.oracle.com.

Thread and core dumps

Higher-level languages frequently provide an interactive way to dump the current execution state of all of their threads (a “thread dump”). This is useful to spot deadlocks, some types of race conditions, and as a quick and dirty method of investigating hangs or excessive CPU usage.

With both Java and Go applications you can send a QUIT signal to have a thread dump printed out; Go applications will quit after doing so, Java ones will carry on running. At most terminals you can hit Ctrl and \ to send a QUIT signal.

For Java you can also use the jstack tool from the JDK to dump threads by PID; this can be useful if the application is running in the background or has redirected sysout:

$ jstack 8321
Attaching to process ID 8321, please wait...
Debugger attached successfully.
Client compiler detected.

Thread t@5: (state = BLOCKED)
 - java.lang.Object.wait(long) @bci=-1107318896 (Interpreted frame)
 - java.lang.Object.wait(long) @bci=0 (Interpreted frame)
 - java.lang.ref.ReferenceQueue.remove(long) @bci=44, line=116 (Interpreted frame)
 - java.lang.ref.ReferenceQueue.remove() @bci=2, line=132 (Interpreted frame)
 - java.lang.ref.Finalizer$FinalizerThread.run() @bci=3, line=159 (Interpreted frame)

# ...

A core dump provides more complete information about the state of a process, but is often more complex to interpret. The gcore utility from GDB will create a core dump of a process with a given PID. You can then generally load the core file using your normal debugger, depending on the language in question.

System calls

strace is the swiss army knife for seeing what a process is doing. It details each system call made by a program (you can filter them down, of course). For example:

$ strace -e read curl https://google.com/
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 \236\0\0\0\0\0\0"..., 832) = 832
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P!\0\0\0\0\0\0"..., 832) = 832
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200l\2\0\0\0\0\0"..., 832) = 832
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20Q\0\0\0\0\0\0"..., 832) = 832
# ...
read(3, "\0\0\0\0\0\0\0\4\25\345\366\302\273sE6\365wI\225\321|\3435Z\362\216\372\215\251aO"..., 253) = 253
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://www.google.com/">here</A>.
</BODY></HTML>
read(3, "\27\3\3\0!", 5)                = 5
# ...

Brendan Gregg has a nice guide on strace and alternatives.

… with docker

When the application is running in docker you can usually just strace it from the host with the correct PID (from e.g. docker inspect --format '{{.State.Pid}}' my_container). Sometimes you may need to trace the startup of an application though, which is a bit trickier. Instead you can run a new container using the same PID namespace as your target, and the permissions needed to strace:

$ docker run --rm -it --pid=container:my_container \
  --net=container:my_container \
  --cap-add sys_admin \
  --cap-add sys_ptrace \
  alpine

From within the new container you can install strace, and trace any running program within the target container using strace -p as normal. To start a new program you need access to the target container’s filesystem, which you can get to via /proc/1/root (PID 1 being the main process that docker started in the target container).

Files

Sometimes the problem might relate to file access. There are a couple of straight forward — but nonetheless useful — tools which might help here. inotifywait uses the Linux inotify subsystem to watch files or directories for operations. For example:

$ inotifywait -mr site/content
Setting up watches.  Beware: since -r was given, this may take a while!
Watches established.
site/content/post/ MODIFY 2019-05-08-debugging-beyond-the-debugger.md
site/content/post/ OPEN 2019-05-08-debugging-beyond-the-debugger.md
site/content/post/ MODIFY 2019-05-08-debugging-beyond-the-debugger.md
site/content/post/ MODIFY 2019-05-08-debugging-beyond-the-debugger.md
site/content/post/ CLOSE_WRITE,CLOSE 2019-05-08-debugging-beyond-the-debugger.md
# ...

Here the -m switch makes inotifywait monitor the files forever (instead of exiting on the first modification, which is the normal behaviour) and r makes it recurse into the directory and monitor each file and subdirectory in there.

If you want to see what processes currently have a file open, fuser is the go-to tool. For example:

$ fuser -v /
                     USER PID ACCESS COMMAND
/:                   root     kernel mount /
                     chris      2961 .rc.. systemd
                     chris      2986 .r... gdm-x-session
                     chris      2994 .r... dbus-daemon
                     chris      3001 .r... gnome-session-b
# ...

Honourable mentions

These aren’t really debugging tools, but I feel it’s worth mentioning as they often feature somewhere along the debugging-of-weird-problems journey.

I’ve seen some weird and wonderful problems happen because a disk is full, so a quick df early on in the debugging process never hurts. Some apps may hang, some may corrupt their config, some may fall over and die; sometimes the manner in which they fail doesn’t obviously point to a disk space issue.

Another issue that comes up now and then — especially inside VMs or other environment that don’t have a decent amount of “noise” happening — is entropy exhaustion. A quick look at /proc/sys/kernel/random/entropy_avail should be enough to confirm that everything is ticking along nicely. If it’s exceedingly low then you may find that anything involving random number generation stalls (TLS connections for example).