Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe code is legacy code

blog.val.town

Post reply on HN
Print view View original

321–330 of 473 posts

Re: Vibe code is legacy code

#321

Post by jjani »

CharlieDigital wrote: post #127
risyachka wrote: post #117

Earlier quoted context omitted.

It’s not a “hack” when you have your stripe keys in the frontend. It’s called a skill issue and to prevent these you have to actually spend time learning instead of vibing. It’s literally the same as driving a car without license. Everyone can do it - but shouldn’t.

It's a hack because he had an admin route and API endpoint which was only checking for authenticated users. He thought no one could see the route because it wasn't in a sitemap (of course, everyone could see the route). Hacker found the API route to insert themselves into an admin table (Supabase RLS was not deployed correctly) and from there, started adding himself to other orgs in the DB.

> Supabase RLS was not deployed correctly

What a surprise.. This has become the new "the default password was admin and no one changed it". And I remember vendors getting enough flak for those defaults that most of them changed them.

Re: Vibe code is legacy code

#322

Post by [deleted] »

doesnt_know wrote: post #119
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

[deleted]

Re: Vibe code is legacy code

#323

Post by energy123 »

raincole wrote: post #171
doesnt_know wrote: post #119

Earlier quoted context omitted.

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

People really want to bring down the growth of the USA's software industry to EU level.

It's a textbook case study of market failure in neoclassical economics caused by information asymmetry. If customers knew about the vulnerabilities, they wouldn't have paid money, or they would have demanded a lower price.

Re: Vibe code is legacy code

#324

Post by laurent_du »

ww520 wrote: post #156

Vibe coding can get very far. Years ago I interviewed with a company whose business was doing price modeling on retail products. It was couple guys, who were not developers, writing some Excel VBA scripts and Access VBA scripts. They got big customers. Their system won't scale and was not robust; it's basically a proof of concept. They got tens of millions in funding. They hired a seasoned team of developers to build…

This is unironically the kind of project I love. My first job was a little bit like that, and I loved being the guy who was saving the day for everyone.

Re: Vibe code is legacy code

#325

Post by wiredfool »

bruce511 wrote: post #286
motorest wrote: post #259

Earlier quoted context omitted.

> It was crazy just how fast it was exploited. The internet is a wild place in any aspect of it. You should try spinning up a random virtual private server on any cloud provider, plug in a public IP address,and listen to traffic. Sometimes it takes seconds to get your first traffic from vulnerability scanners.

This 100%. I'm in a space with developers and customers deploying web servers for the first time. This traffic freaks them out. Basically a simple server listening on a port will experience hundreds of random script-probing attacks per day. And if any of them show the slightest hint of succeeding then that escalates quickly to thousands per minute. You don't need a DNS entry to "expose" the IP address (there are only…

Yesterday it was 4 seconds from a LE cert -> scans for .env and other low hanging info leak/vulnerabilities from at least 4 different scanners.

There are groups out there just looking at the certificate transparency logs to get the newly added certs to scan.

Re: Vibe code is legacy code

#327

Post by brokegrammer »

Vibe coding is only a problem when non-programmers do it. As a programmer, I know how to give precise instruction to models so that they end up writing high quality code. I also have the knowledge to manually fix code that models generate.

Non-programmers can't do any of that. That's why I believe that programmers should use vibe coding to get work done faster, but non-programmers should restrict vibe coding high quality projects to their dreams only.

Re: Vibe code is legacy code

#328

Post by benterix »

eddythompson80 wrote: post #120
WD-42 wrote: post #110

Earlier quoted context omitted.

I would not default to assuming it was his competitors, that sounds like scapegoating to deflect responsibility. What most likely happened is his site was scanned by one of the increasingly sophisticated exploit crawlers (anyone who runs an internet facing site and can view traffic knows what I'm talking about). His site got flagged as vulnerable, the hacker found out it was built like swiss cheese and had fun with i…

Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.

> Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.

I could offer some anecdata as a counterargument but I'm a bit ashamed about how it happened so I'll just say, you friend was lucky it only ended at that.

Re: Vibe code is legacy code

#329

Post by csomar »

CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

> I think indeed, vibe-coded software in the hands of the inexperienced is instant tech debt. But at the same time, he was able to prove out a viable business in a matter of a few months with no engineering background and no technical capability.

Wait, if there are competitors, how was he able to prove a viable business when there were two viable businesses out there?

Re: Vibe code is legacy code

#330

Post by dragonwriter »

trymas wrote: post #326

All code is legacy code. As soon as you write it (no matter how) - it’s legacy. You need to maintain it.

That's a broader definition of legacy than I’ve usually seen used; usually, “legacy code” is a fuzzy categort of code that lacks some significant subset of the maintainability properties expected as the norm in the category of “existing, actively maintained code”, such that issues in that code requiring working around the code, replacing code units wholesale, or expending extra effort research, document, develope tests for, or otherwise bring the code into a maintainable state to enable diagnosing and resolving issues with it.
Post reply on HN