11–20 of 224 posts
Do you think if the agency hired a consultant to build this , a consultant couldn’t have made the same mistakes? Lack of security theater is a good thing for most businesses
I’m not even sure what your last comment means, are you contending that it is a good thing this company violated multiple laws with sensitive patient data?
Kinda crazy but hopefully the future holds a Clippy-esque thing for people who don’t know to set up CI, checkpoints, reviews, environments, etc. that just takes care of all that. It sorta should do this anyway given that the user intent probably wasn’t to dump everyone’s data into Firebase or whatever. I personally would like this as well since it gets tiring specifying all the guardrails and double-checking myself.…
Vibe coding is just a bad idea, unless you’re willing and able to vet the output, which most people doing it are not.
> Welcome to VibeToolX.
> By pressing Confirm you accept all responsibility for user data stewardship as regulated in every country where your users reside.
Would that be scary enough to nudge some risk analysis on the user's part? I am sure that would drop adoption by a lot, so I don't see it happening voluntarily.
Do you think if the agency hired a consultant to build this , a consultant couldn’t have made the same mistakes? Lack of security theater is a good thing for most businesses
> All "access control" logic lived in the JavaScript on the client side, meaning the data was literally one curl command away from anyone who looked.
They are not the same thing.
I did something similar to a local company here in Spain. Not medical, but a small insurance company. Believe it or not, yes, they vibecoded their CRM. I sent them an email and they threatened to sue me. I was a bit in shock from such dumb response, but I guess some people only learn the hard way, so I filed a report to the AEPD (Data protection agency in Spain) for starters, known to be brutal. I've also sent them a…
Kinda crazy but hopefully the future holds a Clippy-esque thing for people who don’t know to set up CI, checkpoints, reviews, environments, etc. that just takes care of all that. It sorta should do this anyway given that the user intent probably wasn’t to dump everyone’s data into Firebase or whatever. I personally would like this as well since it gets tiring specifying all the guardrails and double-checking myself.…
This problem is unrelated to CI and dev practices etc, this is about trusting the output of generative AI without reading it, then using it to handle patient data. Vibe coding is just a bad idea, unless you’re willing and able to vet the output, which most people doing it are not.
In these cases you don’t necessarily care too much about the code itself, as long as it looks reasonable at a glance.
Kinda crazy but hopefully the future holds a Clippy-esque thing for people who don’t know to set up CI, checkpoints, reviews, environments, etc. that just takes care of all that. It sorta should do this anyway given that the user intent probably wasn’t to dump everyone’s data into Firebase or whatever. I personally would like this as well since it gets tiring specifying all the guardrails and double-checking myself.…
This problem is unrelated to CI and dev practices etc, this is about trusting the output of generative AI without reading it, then using it to handle patient data. Vibe coding is just a bad idea, unless you’re willing and able to vet the output, which most people doing it are not.
Hard to believe... This activity should certainly land you in a German prison?!
Lets really hope they learned from their mistakes