Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe code is legacy code

blog.val.town

Post reply on HN
Print view View original

261–270 of 473 posts

Re: Vibe code is legacy code

#261

Post by oc1 »

CharlieDigital wrote: post #131
dashdotme wrote: post #121

Earlier quoted context omitted.

> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. This feels like less of a win for the customers though. They're paying money and exposing their data insecurely, all for a product that maybe does what it's trying to do. > Now he's hiring a developer to shore it up. This is going to be way harder than it sounds... I'm all…

It's a win for the customers. From what he's told me, there's zero churn so far despite the hacks ( including one where the hacker emailed every customer about the hack ). It's because the software is that much of an improvement over the incumbents at a fraction of the cost. Better features, more flexible, easier to use, faster, etc. Everything about it is better than the two major vendors. The rebuild will likely en…

God, i'm living in a dilbert comic.

I would have never thought i would one day envy licensed professionals like lawyers who have a barrier for entry into their profession.

Re: Vibe code is legacy code

#262

Post by willjp »

rainonmoon wrote: post #243
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

That’s not a viable business, it’s a walking liability. Besides which, why would anyone trust your friend (as an investor or customer) ever again when they’ve shown such profound disregard for user data and their IP? If your metric of success is “I have no idea what I’m doing and still made money from it” your friend would have a better time starting a podcast.

> I have no idea what I’m doing and still made money from it

I feel like this describes most people that start their own business at first. It just usually isn’t a lack of experience in producing the product. It’s a constant tradeoff of what skill to invest more time into to keep it afloat. They’ll learn sooner or later.

Re: Vibe code is legacy code

#263

Post by dudeinhawaii »

CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

Everyone is slamming you but the reality is that you could use AI models + a competent developer or security engineer to _very_ quickly shore up the entire codebase and fix every single hole -- getting it to a place where it's comparable with everything else out there. It's really not that hard (and there is already a bit of research around the defensive coding capabilities of tools like Codex and Claude Code)[1].

I have personally taken this approach with web dev, granted I'm a very senior developer. First, develop features, then ask a larger/smarter model (o3, o3-pro, gemini-2.5 pro) to analyze the entire codebase (in sections if needed) and surface every security issue, vulnerability, attack vector, etc. I then pass that back to agents to execute refactors that clean up the code. Repeat until all your keys are in the proper place, all your calls are secured, all your endpoints are locked down, all your db calls are sanitized, etc etc etc.

Now, this should have been done PRIOR to release and would have only taken a few more days (depending on app complexity and the skill of the developer).

[1]: https://arxiv.org/html/2505.15216 - "OpenAI Codex CLI: o3-high, OpenAI Codex CLI: o4-mini, and Claude Code are more capable at defense, achieving higher Patch scores of 90%, 90%, and 87.5%"

Re: Vibe code is legacy code

#264

Post by motorest »

doix wrote: post #240
CharlieDigital wrote: post #134

Earlier quoted context omitted.

It's def a hacker from a the incumbent because: 1) They took action after getting the Stripe key by refunding all customers 2) They drafted an email to all customers after a hack that got the mailing list and API route to send emails 3) Not once has the hacker asked for compensation of any kind nor a ransom

Not sure how to word this, but are you "new" on the internet? People used to break stuff "for the lulz" since the dawn of time. I remember when I was a kid running a tiny forum with phpbb or something, and some script kiddies from g00nsquad (can't remember exact spelling, but something like that) defaced it. They didn't ask for money, they just did it for fun. Sure things have changed now and the internet has become…

> Sure things have changed now and the internet has become more corporate, but I reckon there are still people out there doing this stuff l because they can.

I recall a while back there was a story here about a recipe app that used LLMs to generate recipes. It didn't took long before posters started showcasing recipes they tricked the LLM to generate, involving ingredients such as cyanide and computer chips.

The pull is always there.

Re: Vibe code is legacy code

#265

Post by motorest »

therein wrote: post #204
SecretDreams wrote: post #180

Earlier quoted context omitted.

Breaking things is fun. Effectively stealing money (the refunds) is highly illegal, immoral, and malicious. Who knows who did it, but that aspect is just dickhead territory.

I wouldn't call that stealing. It is a forced refund. A hacker could even justify it to himself that these people were unknowingly paying for a shitty product that was built like Swiss cheese, time to give them a refund. Another plausible one is "this guy shouldn't be allowed to run a website, I can't believe he made money for it, it is going back". I am not saying it is the most likely case or even ethically justifi…

> I wouldn't call that stealing. It is a forced refund.

If someone took money out of your pocket would you call it stealing? What if they gave it to someone else, like a past employer or your parents or a humanitarian organization?

By the way, you should check a dictionary. The definition of "stealing" is literally taking something away without permission.

Re: Vibe code is legacy code

#266

Post by [deleted] »

Ferret7446 wrote: post #233
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

This is morally equivalent to building a house with no engineering experience and someone coming around and kicking it down. The problem isn't vibe coding per se, but lacking some key knowledge to be able to make important judgements which may (should) result in legal liability

[deleted]

Re: Vibe code is legacy code

#267

Post by stouset »

woooooo wrote: post #168
doesnt_know wrote: post #119

Earlier quoted context omitted.

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

The 80s and 90s devs who built our current software infra were, on average, FAR less credentialed than today's juniors and mids who mostly don't understand what they're building on.

The difference is we didn’t know any better back then. We do now.

Re: Vibe code is legacy code

#268

Post by atleastoptimal »

doesnt_know wrote: post #119
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

Let's say it was coded extremely well, but nevertheless a more advanced exploiter wreaked similar havoc. Would they still be liable in your perfect world? To some degree the principle of caveat emptor should apply in some tiny, nascent business, otherwise only large juggernaut monopolistic incumbents would have the means to have any stake in software.

Re: Vibe code is legacy code

#269

Post by danielrico »

the_af wrote: post #150
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

What he built was, almost by definition, a prototype. The problem is that, as it often happens, the prototype was then deployed to production. In this case, it was partly the fault of your non-technical friend who didn't know better, but software engineering history shows us this sometimes happens because of customer/boss pressure. So it's often the case prototypes designed to prove feasibility or to demo to customer…

Something I learned is prototype never should be shown to non technical C-tier officials.

They will push out to the moon even after all the technical staff had signed a report saying why it's a price of trash and why shouldn't be done.

Double that down of they are financial or research. Commercials are much more practical and understand you needed a real product for client retention.

Maybe we get something good of this push for AI and people begins to understand the difference between product and prototype.

Re: Vibe code is legacy code

#270

Post by Frieren »

atleastoptimal wrote: post #268
doesnt_know wrote: post #119

Earlier quoted context omitted.

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

Let's say it was coded extremely well, but nevertheless a more advanced exploiter wreaked similar havoc. Would they still be liable in your perfect world? To some degree the principle of caveat emptor should apply in some tiny, nascent business, otherwise only large juggernaut monopolistic incumbents would have the means to have any stake in software.

> Let's say it was coded extremely well, but nevertheless a more advanced exploiter wreaked similar havoc.

A doctor kills a patient because malpractice. Could that patient have died anyway if the patient had a more critical condition?

That is a non sequitur argument.

> Would they still be liable in your perfect world?

Yes. The doctor would be liable because did not meet the minimum quality criteria. In the same way that the developer is liable for not taking into account any risks and providing a deeply flawed product.

It is impossible in practice to protect software from all possible attacks as there are attackers with very deep pockets. That does not mean that all security should be scrapped.

Post reply on HN