[deleted]
The VibeSec Reckoning
11–20 of 28 posts
Re: The VibeSec Reckoning
#12Vibe coding into production? You don't need to wait for scientists to produce research to know that's not a great idea. You played yaself
We do it, it’s fine. From what I can tell just about every company does it now.
Review your code, have integration tests, rollout feature incrementally with feature flags.
All the things we previously did for all the really bad human developers which AI is way better than
Re: The VibeSec Reckoning
#13[deleted]
Re: The VibeSec Reckoning
#14There are basically two kinds of people in the world, ones that create stuff, and ones that destroys stuff.
Defense is a toally different game, and requires a complete new mindset than creativity. Security is something that you miss one then you lose all.
AIs are good at choosing a good candidate based on a reward model, but it sucks hard at enumerating mundane attack surfaces and make combinations to exploit through.
Re: The VibeSec Reckoning
#15We will learn the hard way... like always.
More likely we simply won't learn. Or at least, the people in charge won't.
Re: The VibeSec Reckoning
#16There are basically two kinds of people in the world, ones that create stuff, and ones that destroys stuff. Defense is a toally different game, and requires a complete new mindset than creativity. Security is something that you miss one then you lose all. AIs are good at choosing a good candidate based on a reward model, but it sucks hard at enumerating mundane attack surfaces and make combinations to exploit through…
Good engineering is good engineering. Belief that someone else uniquely possesses the skill to engineer some critical part of a system you built is, for me, just abdicating responsibility. It's a learned helplessness.
Someone else blindly operating an llm on a corpus you created with an llm is comical.
Re: The VibeSec Reckoning
#17Something worth noting is that the types of vulnerabilities LLMs introduce are notably different from what humans introduce, way fewer local issues like syntax mistakes, simple memory problems, etc and far more broad issues like authn/authz
[deleted]
Re: The VibeSec Reckoning
#18> prompting your AI to “be secure” is not enough
I mean, yes, but I suppose we live in such a nonsensically thoughtless time that stating the obvious has some value.
> To combat this we need to write a security context file to guide the AI
And you've already lost the plot. The problem is not that you're pulling the arm of the slot machine without wearing your lucky underwear, the problem is that you're delegating security to the slot machine to begin with. Pack it up, you're done.
Re: The VibeSec Reckoning
#19There are basically two kinds of people in the world, ones that create stuff, and ones that destroys stuff. Defense is a toally different game, and requires a complete new mindset than creativity. Security is something that you miss one then you lose all. AIs are good at choosing a good candidate based on a reward model, but it sucks hard at enumerating mundane attack surfaces and make combinations to exploit through…
Good engineering is good engineering. Belief that someone else uniquely possesses the skill to engineer some critical part of a system you built is, for me, just abdicating responsibility. It's a learned helplessness. Someone else blindly operating an llm on a corpus you created with an llm is comical.
Are you the best choice to engineer everything your system does? There is no one in your company that might do a better job than you for a specific part of the system?
There is nothing wrong with asking for help or bouncing ideas of people with stronger skills.
I still have the responsibility to code XYZ well. But I don’t have to do it in a clean room.
Re: The VibeSec Reckoning
#20Vibe coding into production? You don't need to wait for scientists to produce research to know that's not a great idea. You played yaself
We do it, it’s fine. From what I can tell just about every company does it now. Review your code, have integration tests, rollout feature incrementally with feature flags. All the things we previously did for all the really bad human developers which AI is way better than
As far as I understand the terminology, if you're reviewing all the code then it's not "vibecoding" but just normal agent-based coding. Vibe coding has a strong implication for me that the code is not being read (hence the "vibe").