Vibe code is legacy code • Hacker News Board

Re: Vibe code is legacy code

#211

Post by vlovich123 » Thu, Jul 31, 2025, 1:25 AM UTC

bdangubic wrote: post #138

I have been SWE for almost three decades now - have read all the comments in this post and almost every negative comment about vibe coding holds true about almost every single ‘human-coded’ codebase I’ve ever seen ( some notable exceptions of course :) )

Kind of but vibe coding lets you attempt at tackling problems without bothering to do any research to understand what the solution needs to look like or how the existing codebase is structured.

Just yesterday a coworker who knows little Rust vibe coded a new feature that “worked” but is actually horribly broken (lots of synchronous I/O/locks/channels in a tokio async context). On top of everything else, they created their own bad abstractions for things that already had safe async abstractions.

If they’d had to actually do this themselves they either would have asked for help sooner so they could be guided or they would have done research in the code which already had examples on how to do things.

Re: Vibe code is legacy code

#212

Post by _ea1k » Thu, Jul 31, 2025, 1:30 AM UTC

The fundamental issue is that most AI tools are solving the wrong problem. We've never had a hard time writing code for well defined requirements.

What we've had a hard time with is understanding what this article calls legacy code, and also understanding where our new changes fit into a larger context.

It isn't at all dissimilar from the paintbrush analogy that all the (neo)vimmers love. We spend more time reading and navigating than we do writing.

AI needs to help with that.

Re: Vibe code is legacy code

#213

Post by QuadmasterXLII » Thu, Jul 31, 2025, 1:34 AM UTC

CharlieDigital wrote: post #127

risyachka wrote: post #117

Earlier quoted context omitted.

It’s not a “hack” when you have your stripe keys in the frontend. It’s called a skill issue and to prevent these you have to actually spend time learning instead of vibing. It’s literally the same as driving a car without license. Everyone can do it - but shouldn’t.

It's a hack because he had an admin route and API endpoint which was only checking for authenticated users. He thought no one could see the route because it wasn't in a sitemap (of course, everyone could see the route). Hacker found the API route to insert themselves into an admin table (Supabase RLS was not deployed correctly) and from there, started adding himself to other orgs in the DB.

I’d take even odds that that’s what his vibe assistant said happened but it has no relation to the actual sequence of events

Re: Vibe code is legacy code

#214

Post by ben-schaaf » Thu, Jul 31, 2025, 1:34 AM UTC

YokoZar wrote: post #161

risyachka wrote: post #117

Earlier quoted context omitted.

It’s not a “hack” when you have your stripe keys in the frontend. It’s called a skill issue and to prevent these you have to actually spend time learning instead of vibing. It’s literally the same as driving a car without license. Everyone can do it - but shouldn’t.

Just because it's an easy hack doesn't mean it isn't one. It's still lockpicking when it's MasterLock.

Maybe more accurately: it's still theft if the door was left open.

Re: Vibe code is legacy code

#215

Post by mattxxx » Thu, Jul 31, 2025, 1:35 AM UTC

all code is legacy code; git repos are mausoleums

Re: Vibe code is legacy code

#216

Post by RogerL » Thu, Jul 31, 2025, 1:36 AM UTC

0xEF wrote: post #206

api wrote: post #197

Earlier quoted context omitted.

In that world we’d just be transitioning to 32-bit software and still running MS-DOS since it’s certified. Linux would never ever have broken through. Who can trust code developed by open source cowboys? Have we verified all their credentials? There are some industries where the massive cost of this type of lock down — probably innovation at 1/10th the speed at 100X the cost — is needed. Medicine comes to mind. It’s…

A reliable, un-bloated OS? Sign me the eff up.

Go check out VxWorks or the like. only 20K a seat, build tools at a similar price, and then oh joy, runtime licenses required to deploy the sw you wrote.

Which are reasonable prices when lives are at risk.

Yes, I know RTOS are not general purpose, this is NOT apples to apples, but that is what that kind of reliability, testing, safety certification, etc. costs.

Re: Vibe code is legacy code

#217

Post by throwaway422432 » Thu, Jul 31, 2025, 1:43 AM UTC

therein wrote: post #204

SecretDreams wrote: post #180

Earlier quoted context omitted.

Breaking things is fun. Effectively stealing money (the refunds) is highly illegal, immoral, and malicious. Who knows who did it, but that aspect is just dickhead territory.

I wouldn't call that stealing. It is a forced refund. A hacker could even justify it to himself that these people were unknowingly paying for a shitty product that was built like Swiss cheese, time to give them a refund. Another plausible one is "this guy shouldn't be allowed to run a website, I can't believe he made money for it, it is going back". I am not saying it is the most likely case or even ethically justifi…

Refund or chargeback? The processing fees for a chargeback on every transaction could put him out of business.

He's lucky they didn't find a way to use it for card washing.

Re: Vibe code is legacy code

#218

Post by khaledh » Thu, Jul 31, 2025, 1:47 AM UTC

8note wrote: post #208

khaledh wrote: post #55

I'm an experienced software engineer (20+ years experience). I really liked the agentic coding capabilities, especially Claude Code. In addition to using it at work (data engineering), I used it for a hobby project (that I intended to contribute as open source). It was a new systems programming language built from scratch, including the backend. It was not fully fledged, but it had the core pieces: a static type syst…

ive been finding that letting an LLM write its own memory bank tends to have it regurgiate your prompts more than keep something actually useful.

That is also true. Occasionally I would go in and clean up the docs and refocus them, but in the end I realized that I'm baby sitting the agent rather than relying on it to help me.

Re: Vibe code is legacy code

#219

Post by CharlieDigital » Thu, Jul 31, 2025, 1:48 AM UTC

8note wrote: post #191

CharlieDigital wrote: post #134

Earlier quoted context omitted.

It's def a hacker from a the incumbent because: 1) They took action after getting the Stripe key by refunding all customers 2) They drafted an email to all customers after a hack that got the mailing list and API route to send emails 3) Not once has the hacker asked for compensation of any kind nor a ransom

what was in this email though?

Telling customers it was built with AI and insecure.

Re: Vibe code is legacy code

#220

Post by wlesieutre » Thu, Jul 31, 2025, 1:50 AM UTC

WD-42 wrote: post #176

YokoZar wrote: post #159

Earlier quoted context omitted.

If you were a criminal trolling the Internet for vulnerable servers and found stripe keys... would your first instinct be to refund customers rather than do some other sort of crime? Like what's the motivation you envision here?

"Because I can" or "Because it's funny" are more than enough reason for most people. The fact that the hacker refunded all the customers, then emailed them to warn them that they were using a terrible app actually sounds like a pretty tame troll to me. If the hacker was truly hired by the competition to act maliciously, they could have done far, far worse. Your friend should take this as a lesson instead of trying to…

> Because it's funny

I think you mean “for the lulz”