Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe code is legacy code

blog.val.town

Post reply on HN
Print view View original

341–350 of 473 posts

Re: Vibe code is legacy code

#341

Post by motorest »

_Algernon_ wrote: post #340
motorest wrote: post #265

Earlier quoted context omitted.

> I wouldn't call that stealing. It is a forced refund. If someone took money out of your pocket would you call it stealing? What if they gave it to someone else, like a past employer or your parents or a humanitarian organization? By the way, you should check a dictionary. The definition of "stealing" is literally taking something away without permission.

Being in the possession of a password or key implies having permission to use that key. When generating a key you give everyone with access to that key the permission to use it to perform actions on your account. Protect your keys.

> Being in the possession of a password or key implies having permission to use that key.

No, it doesn't.

Re: Vibe code is legacy code

#342

Post by encom »

JackFr wrote: post #235
eddythompson80 wrote: post #120

Earlier quoted context omitted.

Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.

I have a strictly hobby web app that I work on. 6-7 years ago I inadvertently pushed AWS email service credentials to GitHub. Half an hour after the push I got an email and text from GitHub that I had exposed credentials. I quickly logged in to my AWS to turn off the service, to see that AWS had suspended that service because the bounce rate on the 80000 emails sent in that 15 minute period was too high. It was crazy…

Here's an amusing thing to try on anything with SSH exposed. These log files go back a month.

  # zcat -f /var/log/auth.log* | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $6}' | sort | uniq -c | sort -bnr | head -n 30
     5190 #redacted: my domain name
     3063 admin
     1891 #redacted: another domain name
      931 user
      724 ubuntu
      287 test
      268 solv
      206 odoo15
      200 solana
      197 sol
      184 ubnt
      173 wialon
      170 Antminer
      169 guest
      168 odoo17
      159 oracle
      157 postgres
      151 git
      150 support
      142 ftp
      135 ftpuser
      120 debian
      118 pi
       91 nginx
       85 baikal
       82 docker
       81 perl
       74 operator
       74 deploy
       72 dev

Re: Vibe code is legacy code

#343

Post by CharlieDigital »

pishpash wrote: post #273
dudeinhawaii wrote: post #263

Earlier quoted context omitted.

Everyone is slamming you but the reality is that you could use AI models + a competent developer or security engineer to _very_ quickly shore up the entire codebase and fix every single hole -- getting it to a place where it's comparable with everything else out there. It's really not that hard (and there is already a bit of research around the defensive coding capabilities of tools like Codex and Claude Code)[1]. I…

You don't know what you don't know. How was a non-technical glorified PM supposed to know to ask for these things in the first place? Such technical practices developed over time in the history of software engineering, as problems arose.

This is the main problem with AI and vibe coding right now: it does what you ask (and sometimes does related things in the line of that ask).

It doesn't look at the big picture of multiple entry into the software. For example he had one vulnerability which required a hop through email which would create an entry into a table that ended up elevating permissions temporarily.

Hopefully platforms like Replit, Firebase Studio, et Al one day just include a security audit agent.

Re: Vibe code is legacy code

#344

Post by CharlieDigital »

rainonmoon wrote: post #243
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

That’s not a viable business, it’s a walking liability. Besides which, why would anyone trust your friend (as an investor or customer) ever again when they’ve shown such profound disregard for user data and their IP? If your metric of success is “I have no idea what I’m doing and still made money from it” your friend would have a better time starting a podcast.

On the contrary, he's solving a real business need for these small businesses at a fraction of the cost with a product that's easier to use and with better features.

The customers know there was a hack because the hacker emailed them (I had a test account and received the same email). Yet he's had no churn because there's so much value being delivered.

I think there's something to be said for that.

Re: Vibe code is legacy code

#345

Post by fc417fc802 »

AlecSchueler wrote: post #304
QuiDortDine wrote: post #254

Earlier quoted context omitted.

I see that you're not alone in your position clearly, but still, this is such a strange take to me. Do people not seriously not see, nay, instinctively understand the ontological difference between the difference between using code someone no longer understands and deploying code no one ever understood? I'm not saying the code should be up to any specific standards, just that someone should know what's going on.

I don't actually see the difference. If someone writes the code and understands it but then becomes unavailable, what's the practical difference with no one having understood it?

Someone at some point had a working mental model of the code and a reputation to protect and decided that it was good enough to merge. Someone vetted and hired that person. There's a level of familiarity and history that leads others to extend trust.

Re: Vibe code is legacy code

#346

Post by CharlieDigital »

zerotolerance wrote: post #157
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

Did he need it to prove a business viable if there were already players in the market? No. Do you ever need to validate that people would switch providers of a commodity product or service if presented with a cheaper option? Also no. What did he learn then, that he can create a partial solution that people might pay for initially (no data on renewals) but will ultimately have to actually hire people to build a real p…

That's like saying Canva and Figma didn't need to prove there was a market because PowerPoint and Photoshop existed.

It's the opposite, right? When a dominant incumbent exists, you have to prove that there is a market for an alternative that can compete with more mature, established software.

Re: Vibe code is legacy code

#347

Post by rwmj »

encom wrote: post #342
JackFr wrote: post #235

Earlier quoted context omitted.

I have a strictly hobby web app that I work on. 6-7 years ago I inadvertently pushed AWS email service credentials to GitHub. Half an hour after the push I got an email and text from GitHub that I had exposed credentials. I quickly logged in to my AWS to turn off the service, to see that AWS had suspended that service because the bounce rate on the 80000 emails sent in that 15 minute period was too high. It was crazy…

Here's an amusing thing to try on anything with SSH exposed. These log files go back a month. # zcat -f /var/log/auth.log* | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $6}' | sort | uniq -c | sort -bnr | head -n 30 5190 #redacted: my domain name 3063 admin 1891 #redacted: another domain name 931 user 724 ubuntu 287 test 268 solv 206 odoo15 200 solana 197 sol 184 ubnt 173 wialon 170 Antminer 169 guest 168 od…

I'm wondering what 'seekcy' is. Possibly a Chinese security product?

  $ journalctl | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $8}' | sort | uniq -c | sort -bnr | head -n 30
     34 admin
     26 oracle
     21 postgres
     20 user
     18 test
     18 seekcy
     17 ftpuser
     15 ubuntu
     15 inspur
      9 zabbix
      8 nginx
      8 mysql
      8 jenkins
      8 hadoop
      7 server
      7 nagios
      6 teste
      6 amax
      5 support
      5 backup
      5 administrator
      4 git
      4 demo
      4 a
      3 zyfwp
      3 usuario
      3 tomcat
      3 testuser
      3 test1
      3 teamspeak

Re: Vibe code is legacy code

#348

Post by bartread »

WD-42 wrote: post #110
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

I would not default to assuming it was his competitors, that sounds like scapegoating to deflect responsibility. What most likely happened is his site was scanned by one of the increasingly sophisticated exploit crawlers (anyone who runs an internet facing site and can view traffic knows what I'm talking about). His site got flagged as vulnerable, the hacker found out it was built like swiss cheese and had fun with i…

It's 100% this. Anyone who's run a website or web app for any length of time in recent years and makes a habit of inspecting their logs will quickly realise that they're being scanned by bots looking for vulnerabilities multiple, or even many, times per day. The search for vulnerabilities is entirely automated and will pick up any domain that has a website or web app attached to it.

One those vulnerabilities are found, the hackers will pounce, and, whilst ransomware is one potential outcome, they might instead do all of the kinds of things GP has described. They don't care what the site is for or what industry you're in.

Re: Vibe code is legacy code

#349

Post by motorest »

encom wrote: post #342
JackFr wrote: post #235

Earlier quoted context omitted.

I have a strictly hobby web app that I work on. 6-7 years ago I inadvertently pushed AWS email service credentials to GitHub. Half an hour after the push I got an email and text from GitHub that I had exposed credentials. I quickly logged in to my AWS to turn off the service, to see that AWS had suspended that service because the bounce rate on the 80000 emails sent in that 15 minute period was too high. It was crazy…

Here's an amusing thing to try on anything with SSH exposed. These log files go back a month. # zcat -f /var/log/auth.log* | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $6}' | sort | uniq -c | sort -bnr | head -n 30 5190 #redacted: my domain name 3063 admin 1891 #redacted: another domain name 931 user 724 ubuntu 287 test 268 solv 206 odoo15 200 solana 197 sol 184 ubnt 173 wialon 170 Antminer 169 guest 168 od…

> 118 pi

I wonder why this features so low in the list. The default user:pass combo for Raspbian/Raspberry Pi OS is pi:raspberry

https://forums.raspberrypi.com/viewtopic.php?t=151745

Re: Vibe code is legacy code

#350

Post by graemep »

zerotolerance wrote: post #157
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

Did he need it to prove a business viable if there were already players in the market? No. Do you ever need to validate that people would switch providers of a commodity product or service if presented with a cheaper option? Also no. What did he learn then, that he can create a partial solution that people might pay for initially (no data on renewals) but will ultimately have to actually hire people to build a real p…

He validated that he could get customers. The comment says he started generating revenue so he had real customers.

If he had been unable to get customer he would have known it was not worth building a real product.

Post reply on HN