Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe code is legacy code

blog.val.town

Post reply on HN
Print view View original

271–280 of 473 posts

Re: Vibe code is legacy code

#271

Post by stevage »

pmontra wrote: post #258
stevage wrote: post #249

One of my current clients vibe coded an app then hired me to assess it, and ultimately rewrite it. I'm really curious whether that will become a trend.

A dozen years ago a company hired me to maintain an ecommerce system that had been built for them by a guy that left soon after. They told me "he is not even a developer." That was my assessment too. The system mostly worked but it didn't run fast enough to process their daily load. It was a mess but it would cost too much to rewrite. I managed to fix the worst parts, then switched to other customers. No idea if they…

I guess when you put it like that there is a long history of production systems being built by people who had no business doing it. An access database running a whole company etc.

Re: Vibe code is legacy code

#272

Post by jamesfinlayson »

eddythompson80 wrote: post #120
WD-42 wrote: post #110

Earlier quoted context omitted.

I would not default to assuming it was his competitors, that sounds like scapegoating to deflect responsibility. What most likely happened is his site was scanned by one of the increasingly sophisticated exploit crawlers (anyone who runs an internet facing site and can view traffic knows what I'm talking about). His site got flagged as vulnerable, the hacker found out it was built like swiss cheese and had fun with i…

Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.

I've seen it happen - a key was leaked in a stacktrace somewhere and it took a scraper a couple of days to find it. Stripe helpfully prefixes their keys with sk_prod_ so you can completely automate something to iterate over every IPv4 address and see if something in the output matches.

Re: Vibe code is legacy code

#273

Post by pishpash »

dudeinhawaii wrote: post #263
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

Everyone is slamming you but the reality is that you could use AI models + a competent developer or security engineer to _very_ quickly shore up the entire codebase and fix every single hole -- getting it to a place where it's comparable with everything else out there. It's really not that hard (and there is already a bit of research around the defensive coding capabilities of tools like Codex and Claude Code)[1]. I…

You don't know what you don't know. How was a non-technical glorified PM supposed to know to ask for these things in the first place? Such technical practices developed over time in the history of software engineering, as problems arose.

Re: Vibe code is legacy code

#274

Post by pishpash »

Ferret7446 wrote: post #233
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

This is morally equivalent to building a house with no engineering experience and someone coming around and kicking it down. The problem isn't vibe coding per se, but lacking some key knowledge to be able to make important judgements which may (should) result in legal liability

That's why that person was non-technical. Maybe software engineering will finally require licensing like for real engineers when AI is unleashed on the world with serious consequences.

Re: Vibe code is legacy code

#275

Post by pishpash »

atleastoptimal wrote: post #268
doesnt_know wrote: post #119

Earlier quoted context omitted.

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

Let's say it was coded extremely well, but nevertheless a more advanced exploiter wreaked similar havoc. Would they still be liable in your perfect world? To some degree the principle of caveat emptor should apply in some tiny, nascent business, otherwise only large juggernaut monopolistic incumbents would have the means to have any stake in software.

That's always the double-edged sword with regulation, but sooner or later people will demand it, or much more of it.

Re: Vibe code is legacy code

#276

Post by pishpash »

Frieren wrote: post #270
atleastoptimal wrote: post #268

Earlier quoted context omitted.

Let's say it was coded extremely well, but nevertheless a more advanced exploiter wreaked similar havoc. Would they still be liable in your perfect world? To some degree the principle of caveat emptor should apply in some tiny, nascent business, otherwise only large juggernaut monopolistic incumbents would have the means to have any stake in software.

> Let's say it was coded extremely well, but nevertheless a more advanced exploiter wreaked similar havoc. A doctor kills a patient because malpractice. Could that patient have died anyway if the patient had a more critical condition ? That is a non sequitur argument. > Would they still be liable in your perfect world? Yes. The doctor would be liable because did not meet the minimum quality criteria. In the same way…

Yes, parent is arguing like, what if medical licensing protects the juggernaut hospitals at the expense of the street corner quack?

Re: Vibe code is legacy code

#277

Post by dm3 »

dudeinhawaii wrote: post #263
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

Everyone is slamming you but the reality is that you could use AI models + a competent developer or security engineer to _very_ quickly shore up the entire codebase and fix every single hole -- getting it to a place where it's comparable with everything else out there. It's really not that hard (and there is already a bit of research around the defensive coding capabilities of tools like Codex and Claude Code)[1]. I…

This approach to security is backwards. It's way harder to find security issues than to never include them in the first place. This approach might work for another webapp but I highly doubt a retroactive security analysis is practical for a more involved system.

Re: Vibe code is legacy code

#278

Post by pishpash »

stouset wrote: post #267
woooooo wrote: post #168

Earlier quoted context omitted.

The 80s and 90s devs who built our current software infra were, on average, FAR less credentialed than today's juniors and mids who mostly don't understand what they're building on.

The difference is we didn’t know any better back then. We do now.

Surprisingly, 80's and 90's developers were quite skilled low-level developers who knew very well all the ways things could go wrong. The difference was the stakes were not high then. The blast radius was maybe a hundred thousand people and the worst was they lost their own files. Now some AI-controlled process or apparatus could ruin everyone's credit and maybe even kill you and all your neighbors.

Re: Vibe code is legacy code

#279

Post by akoboldfrying »

therein wrote: post #204
SecretDreams wrote: post #180

Earlier quoted context omitted.

Breaking things is fun. Effectively stealing money (the refunds) is highly illegal, immoral, and malicious. Who knows who did it, but that aspect is just dickhead territory.

I wouldn't call that stealing. It is a forced refund. A hacker could even justify it to himself that these people were unknowingly paying for a shitty product that was built like Swiss cheese, time to give them a refund. Another plausible one is "this guy shouldn't be allowed to run a website, I can't believe he made money for it, it is going back". I am not saying it is the most likely case or even ethically justifi…

>I wouldn't call that stealing. It is a forced refund.

Can you name an instance of stealing that could not be described as a forced refund?

Re: Vibe code is legacy code

#280

Post by galaxyLogic »

That is a great insight, AI code is like legacy code, which is "legacy" because it was written long time ago and hasn't been worked on by anybody, so nobody knows and it is hard to learn how the code does its thing.

But so why couldn't AI-generated code be maintained by AI? Why couldn't AI in general be used to fix and evolve legacy code?

Post reply on HN