Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe code is legacy code

blog.val.town

Post reply on HN
Print view View original

371–380 of 473 posts

Re: Vibe code is legacy code

#371

Post by lelanthran »

mrmincent wrote: post #98
starkparker wrote: post #88

Earlier quoted context omitted.

> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. How much is it costing him to hire someone to reimplement his idea correctly?

Probably a similar amount that it would have taken him to hire someone from the start, except he’s already validated the product and market.

> Probably a similar amount that it would have taken him to hire someone from the start, except he’s already validated the product and market.

He hasn't validated the market at the price point that includes the cost of a developer to build the product. He's validated a market in which it costs him close to zero to deliver. He's not validated a market which costs (say) a few months of dev time.

Re: Vibe code is legacy code

#372

Post by lelanthran »

dm3 wrote: post #277
dudeinhawaii wrote: post #263

Earlier quoted context omitted.

Everyone is slamming you but the reality is that you could use AI models + a competent developer or security engineer to _very_ quickly shore up the entire codebase and fix every single hole -- getting it to a place where it's comparable with everything else out there. It's really not that hard (and there is already a bit of research around the defensive coding capabilities of tools like Codex and Claude Code)[1]. I…

This approach to security is backwards. It's way harder to find security issues than to never include them in the first place. This approach might work for another webapp but I highly doubt a retroactive security analysis is practical for a more involved system.

Yeah. A lot of security issues are design issues, not "I reused a buffer for something else" issues.

Fixing design and/or architecture at a high level usually requires a signficant rewrite; sometimes even a switch in technology stacks.

Re: Vibe code is legacy code

#373

Post by astrobe_ »

ggregoryarms wrote: post #181
asadotzler wrote: post #100

Earlier quoted context omitted.

That's not what legacy means. Legacy means the people who understood it are gone and you're left with code that's hard to maintain because it's hard to understand because the people who understood it are gone.

I find this a bit like saying that we can't understand East of Eden because Steinbeck is dead.

A program is not a novel, despite the arguments of literate programming fans. It is more like interactive fiction. In the small, it is just short pieces of text. In the large, there is an invisible network connecting each of them. And the challenge you are facing when assigned to legacy code, is to make changes in the small pieces of text that are consistent with that network, or even sometimes changing the connections.

Re: Vibe code is legacy code

#374

Post by paffdragon »

achierius wrote: post #122
eddythompson80 wrote: post #120

Earlier quoted context omitted.

Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.

Why is it unbelievable? There is an entire industry of people trying to find vulnerable niche applications like this. There are bots which crawl the web, not to make an index, but just to find vulnerabilities. Nobody necessarily even had to 'point' anything at this at all, it just shows up on their dashboard one day and they get to dig in.

Yep. We once had left a socks proxy unprotected on a public IP, no cert, just a random IP and a fixed port. At one day the service stopped working. When looking into it, the network was overloaded with random IPs from all over the world surfing on the free proxy.

Re: Vibe code is legacy code

#375

Post by mewpmewp2 »

wiredfool wrote: post #325
bruce511 wrote: post #286

Earlier quoted context omitted.

This 100%. I'm in a space with developers and customers deploying web servers for the first time. This traffic freaks them out. Basically a simple server listening on a port will experience hundreds of random script-probing attacks per day. And if any of them show the slightest hint of succeeding then that escalates quickly to thousands per minute. You don't need a DNS entry to "expose" the IP address (there are only…

Yesterday it was 4 seconds from a LE cert -> scans for .env and other low hanging info leak/vulnerabilities from at least 4 different scanners. There are groups out there just looking at the certificate transparency logs to get the newly added certs to scan.

Yeah, one of the reasons why I started to for all my dev side projects to be under a single wildcard subdomain, because I used to create new certs automatically with letsencrypt and everytime this spam happened. If I do things right it shouldn't matter, but I still feel better with the wildcard if I was to make a mistake...

Re: Vibe code is legacy code

#376

Post by mewpmewp2 »

rwmj wrote: post #347
encom wrote: post #342

Earlier quoted context omitted.

Here's an amusing thing to try on anything with SSH exposed. These log files go back a month. # zcat -f /var/log/auth.log* | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $6}' | sort | uniq -c | sort -bnr | head -n 30 5190 #redacted: my domain name 3063 admin 1891 #redacted: another domain name 931 user 724 ubuntu 287 test 268 solv 206 odoo15 200 solana 197 sol 184 ubnt 173 wialon 170 Antminer 169 guest 168 od…

I'm wondering what 'seekcy' is. Possibly a Chinese security product? $ journalctl | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $8}' | sort | uniq -c | sort -bnr | head -n 30 34 admin 26 oracle 21 postgres 20 user 18 test 18 seekcy 17 ftpuser 15 ubuntu 15 inspur 9 zabbix 8 nginx 8 mysql 8 jenkins 8 hadoop 7 server 7 nagios 6 teste 6 amax 5 support 5 backup 5 administrator 4 git 4 demo 4 a 3 zyfwp 3 usuario 3…

Googling it points to a Chinese IoT company, so I am thinking maybe they have some IoT software with known vulnerability where they have seekcy as the ssh username that is being actively scanned for.

Re: Vibe code is legacy code

#377

Post by mewpmewp2 »

motorest wrote: post #349
encom wrote: post #342

Earlier quoted context omitted.

Here's an amusing thing to try on anything with SSH exposed. These log files go back a month. # zcat -f /var/log/auth.log* | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $6}' | sort | uniq -c | sort -bnr | head -n 30 5190 #redacted: my domain name 3063 admin 1891 #redacted: another domain name 931 user 724 ubuntu 287 test 268 solv 206 odoo15 200 solana 197 sol 184 ubnt 173 wialon 170 Antminer 169 guest 168 od…

> 118 pi I wonder why this features so low in the list. The default user:pass combo for Raspbian/Raspberry Pi OS is pi:raspberry https://forums.raspberrypi.com/viewtopic.php?t=151745

Wouldn't say it is low if it is within the top 20 amongst other very popular services.

Re: Vibe code is legacy code

#378

Post by RHSeeger »

CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

> he proved out a viable business with just a few hundred dollars of investment

That statement is a bit of a stretch though, because

> charging a fraction of their monthly cost

I have to assume at least part of his success was the price point; and that price point was possible because he wasn't paying any software developers to do things right. So "having lots of vulnerabilities" was a core component of his business model. Once that part is removed, the model is no longer proven.

Re: Vibe code is legacy code

#379

Post by minaguib »

apimade wrote: post #126

All code is legacy code. And as someone who’s reviewed plenty of production scripts, functions, and services written by junior developers, including my own early work, this take is overly absolutist. The problem persists in the vast majority of organisations. You can write articles criticising LLM-generated code, but if you’ve spent most of your career fixing, extending, or re-architecting systems built by others, yo…

Agreed with you. I've always told people all code "rusts" (not a language reference) - in multiple ways: the original author's mental model, the contributors, institutional knowledge, and the supporting ecosystem and dependencies. All code atrophies towards being legacy and debt. The more the worse. AI Vibe coding simply creates much more of it, much faster.

Re: Vibe code is legacy code

#380

Post by NicolaiS »

motorest wrote: post #349
encom wrote: post #342

Earlier quoted context omitted.

Here's an amusing thing to try on anything with SSH exposed. These log files go back a month. # zcat -f /var/log/auth.log* | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $6}' | sort | uniq -c | sort -bnr | head -n 30 5190 #redacted: my domain name 3063 admin 1891 #redacted: another domain name 931 user 724 ubuntu 287 test 268 solv 206 odoo15 200 solana 197 sol 184 ubnt 173 wialon 170 Antminer 169 guest 168 od…

> 118 pi I wonder why this features so low in the list. The default user:pass combo for Raspbian/Raspberry Pi OS is pi:raspberry https://forums.raspberrypi.com/viewtopic.php?t=151745

was pi: raspberry, but it was changed a long time ago to have no default user:pass
Post reply on HN