Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe code is legacy code

blog.val.town

Post reply on HN
Print view View original

331–340 of 473 posts

Re: Vibe code is legacy code

#331

Post by mrkeen »

datameta wrote: post #112
mr_donk wrote: post #61

Don't you think the next step is a programming language that isn't even meant to be human readable? What's the point of using an LLM to generate python or Swift or whatever? The output of the LLM should be something that runs and does whatever it's been asked to do... why should the implementation be some programming language that was designed for humans to grok? Once that's true the idea of it being maintainable bec…

That begs the question of what abstraction layer is necessary beyond an assembler, if any? If human handcrafted ASM outcompetes compiled C then why not give LLMs the wheel on ASM? Then another question is - are there enough good ASM publically available as examples?

There's certainly enough ASM available if the LLMS-can-reason hypothesis is true.

You'd only need one accurate ASM manual per variant.

Re: Vibe code is legacy code

#332

Post by csomar »

CharlieDigital wrote: post #134
WD-42 wrote: post #110

Earlier quoted context omitted.

I would not default to assuming it was his competitors, that sounds like scapegoating to deflect responsibility. What most likely happened is his site was scanned by one of the increasingly sophisticated exploit crawlers (anyone who runs an internet facing site and can view traffic knows what I'm talking about). His site got flagged as vulnerable, the hacker found out it was built like swiss cheese and had fun with i…

It's def a hacker from a the incumbent because: 1) They took action after getting the Stripe key by refunding all customers 2) They drafted an email to all customers after a hack that got the mailing list and API route to send emails 3) Not once has the hacker asked for compensation of any kind nor a ransom

Please don't consider becoming a judge. Also, try re-reading what you wrote a few times.

Re: Vibe code is legacy code

#333

Post by lonelyasacloud »

otabdeveloper4 wrote: post #298
mvkel wrote: post #239

Earlier quoted context omitted.

"Tech debt" is a misnomer. It implies that at some point it should be paid down. There are very few examples where dedicating real efforts exclusively to paying down tech debt led to anything beneficial for the customer. Some of the software we know and love today started with someone writing their very first line of PHP code, or Rails. Vibe coding is ultimately about getting ideas shipped faster. Code quality is an…

> Vibe coding is ultimately about getting ideas shipped faster. Studies show that using LLMs for coding results in negative net productivity gains on average.

There have been a few studies that show that in certain circumstances this is the case. But doing a literature review will illustrate the bulk support the alternative hypothesis.

Ultimately, whatever the hype factor there is a large number of clever people putting their time and money into it for a reason.

Re: Vibe code is legacy code

#335

Post by csomar »

doesnt_know wrote: post #119
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

Right. Because the solution to all of this madness is SOC2 compliance or something along those lines.

What happened is a perfect natural selection. The friend is a very small actor with probably a dozen customers not a multi-billion $$ company with millions of customers.

Re: Vibe code is legacy code

#336

Post by graemep »

WD-42 wrote: post #110
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

I would not default to assuming it was his competitors, that sounds like scapegoating to deflect responsibility. What most likely happened is his site was scanned by one of the increasingly sophisticated exploit crawlers (anyone who runs an internet facing site and can view traffic knows what I'm talking about). His site got flagged as vulnerable, the hacker found out it was built like swiss cheese and had fun with i…

> anyone who runs an internet facing site and can view traffic knows what I'm talking about

Most of what I see is looking for very specific vulnerabilities - a very high proportion are looking for hidden files and directories being served (e.g. .git, .env) or specific software (e.g. Wordpress), or similar.

In over 20 years of dealing with many mostly smallish businesses the compromises have been:

1. A client who insisted on using Wordpress for one of their sites (against my advice) because they had people who knew it so it was the cheap option. It was easy to see what would happen because those people were not available long term. 2. A very carefully set up server with a hardened kernel etc. I did not set it up so cannot give all details and neither do I know how it was compromised. It was carefully set up because it was a target for political reasons so I would guess it was a targetted attack.

On the other hand I know there have been many vulnerabilities. There have been many vulnerabilities in the applications - the outstanding examples being creating queries by concatenating user input with SQL (no escaping at all) in multiple places across a small site (years ago), and (recently) finding code that called (python) exec on user input. Many other flaws that have been present for years. Not updating OSes, server software and frameworks for many years is usual.

In spite of all that, just those two compromises. You will probably get away with a high degree of bad code and bad practices in deployment and maintenance with a small site.

Re: Vibe code is legacy code

#337

Post by sharperguy »

CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

So in the hands of someone whose main expertise is in writing the secure login and data protection part of an application, maybe it is a bit better? At least they could eliminate much of the low hanging fruit. Of course anything put together quickly by a small team is going to be full of vulnerabilities until it gets battle tested and security checked.

Re: Vibe code is legacy code

#338

Post by kalaksi »

doesnt_know wrote: post #119
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

I don't remember the specifics well, but under GDPR they'd be required to give breach notification to customers, maybe write a report and get audited and possibly get fined depending on the situation. Customers could demand compensation (probably doesn't make sense here).

Re: Vibe code is legacy code

#339

Post by CharlieDigital »

csomar wrote: post #329
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

> I think indeed, vibe-coded software in the hands of the inexperienced is instant tech debt. But at the same time, he was able to prove out a viable business in a matter of a few months with no engineering background and no technical capability. Wait, if there are competitors, how was he able to prove a viable business when there were two viable businesses out there?

In the same way that Figma and Canva had to prove that there was a business model with a browser-first alternative.

They are legacy incumbents using desktop software in an ostendibly solved space.

The question here is whether was appetite for a lighter, web-based solution.

Re: Vibe code is legacy code

#340

Post by _Algernon_ »

motorest wrote: post #265
therein wrote: post #204

Earlier quoted context omitted.

I wouldn't call that stealing. It is a forced refund. A hacker could even justify it to himself that these people were unknowingly paying for a shitty product that was built like Swiss cheese, time to give them a refund. Another plausible one is "this guy shouldn't be allowed to run a website, I can't believe he made money for it, it is going back". I am not saying it is the most likely case or even ethically justifi…

> I wouldn't call that stealing. It is a forced refund. If someone took money out of your pocket would you call it stealing? What if they gave it to someone else, like a past employer or your parents or a humanitarian organization? By the way, you should check a dictionary. The definition of "stealing" is literally taking something away without permission.

Being in the possession of a password or key implies having permission to use that key. When generating a key you give everyone with access to that key the permission to use it to perform actions on your account.

Protect your keys.

Post reply on HN