Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe code is legacy code

blog.val.town

Post reply on HN
Print view View original

121–130 of 473 posts

Re: Vibe code is legacy code

#121

Post by dashdotme »

CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment.

This feels like less of a win for the customers though. They're paying money and exposing their data insecurely, all for a product that maybe does what it's trying to do.

> Now he's hiring a developer to shore it up.

This is going to be way harder than it sounds...

I'm all for AI as a reference or productivity/learning aid, but the results without a human in the loop quickly get horrific.

Re: Vibe code is legacy code

#122

Post by achierius »

eddythompson80 wrote: post #120
WD-42 wrote: post #110

Earlier quoted context omitted.

I would not default to assuming it was his competitors, that sounds like scapegoating to deflect responsibility. What most likely happened is his site was scanned by one of the increasingly sophisticated exploit crawlers (anyone who runs an internet facing site and can view traffic knows what I'm talking about). His site got flagged as vulnerable, the hacker found out it was built like swiss cheese and had fun with i…

Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.

Why is it unbelievable? There is an entire industry of people trying to find vulnerable niche applications like this. There are bots which crawl the web, not to make an index, but just to find vulnerabilities. Nobody necessarily even had to 'point' anything at this at all, it just shows up on their dashboard one day and they get to dig in.

Re: Vibe code is legacy code

#123

Post by imiric »

xorcist wrote: post #103
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

Will his customers trust him a second time though?

"Claude, write a heartfelt apology tweet, downplay the damages, and emphasize that we're working around the clock to fix things."

Re: Vibe code is legacy code

#124

Post by tele_ski »

andy_ppp wrote: post #57

I think most software is extremely buggy and it’s about to get much worse… just today several comments just disappeared from YouTube, did they even get written there? Uber has a whole feature about upgrading to Uber Comfort - it’s never worked once for me just gives an error. Three have managed to not take PAYG top up automatically for the nth time. Google’s UI is broken everywhere, loads of sites including John Lewi…

https://danluu.com/everything-is-broken/

Always has been and always will be. This article was eye opening to me because I didn't even realize how often I was working around buggy software.

Re: Vibe code is legacy code

#125

Post by eddythompson80 »

achierius wrote: post #122
eddythompson80 wrote: post #120

Earlier quoted context omitted.

Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.

Why is it unbelievable? There is an entire industry of people trying to find vulnerable niche applications like this. There are bots which crawl the web, not to make an index, but just to find vulnerabilities. Nobody necessarily even had to 'point' anything at this at all, it just shows up on their dashboard one day and they get to dig in.

I was being facetious. Yes, there are millions of bots that are constantly searching every website for leaked keys, passwords, database credentials, crypto wallets, firebase endpoints, s3 buckets, email addresses, phone numbers, etc. the list is bottomless

Re: Vibe code is legacy code

#126

Post by apimade »

All code is legacy code.

And as someone who’s reviewed plenty of production scripts, functions, and services written by junior developers, including my own early work, this take is overly absolutist.

The problem persists in the vast majority of organisations.

You can write articles criticising LLM-generated code, but if you’ve spent most of your career fixing, extending, or re-architecting systems built by others, you should know better.

Until software engineering adopts the same standards, certifications, consistency, and accountability as traditional engineering, along with real consequences, these arguments don’t hold much weight.

This entire modern industry was built on the opposite philosophy: agile. Move fast, break things. Ship iteratively with minimal design. Drop production? Just revert. Outage? Oops.

Software is still treated like a toy. It’s playdough in the hands of toddlers led by other toddlers. You might be among the 1% who do things properly.. but the other 99% don’t.

And odds are, if you’re reading this, you’re not the 1%.

Re: Vibe code is legacy code

#127

Post by CharlieDigital »

risyachka wrote: post #117
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

It’s not a “hack” when you have your stripe keys in the frontend. It’s called a skill issue and to prevent these you have to actually spend time learning instead of vibing. It’s literally the same as driving a car without license. Everyone can do it - but shouldn’t.

It's a hack because he had an admin route and API endpoint which was only checking for authenticated users. He thought no one could see the route because it wasn't in a sitemap (of course, everyone could see the route). Hacker found the API route to insert themselves into an admin table (Supabase RLS was not deployed correctly) and from there, started adding himself to other orgs in the DB.

Re: Vibe code is legacy code

#128

Post by mikert89 »

matt_cogito wrote: post #97

All production code will be written by AI. The question is not if. It is WHEN. What we are seeing right in front of our eyes is how the boundaries of what is possible in the realm of software programming has gone from AI/LLMs poorly writing simple scripts, to being able to "zero-shoot" and "vibe code" a complex system, with a set of instructions written in natural language. What we might be seeing in 2025 is how prog…

Yeah I think its over, it will take a while for the effects to ripple through society, but writing code will be seen as something like wood working

Re: Vibe code is legacy code

#129

Post by CharlieDigital »

xorcist wrote: post #103
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

Will his customers trust him a second time though?

They trusted him more after he got hacked. He actually got more signups from inbound.
Post reply on HN