101–110 of 231 posts
That the original post to HN linked in the blog was done on a throwaway kind of implies a level of awareness (on the part of the dev) that the code/claims were rubbish :) https://news.ycombinator.com/item?id=46780837
Earlier quoted context omitted.
Reminds me of Cloudflare's OAuth library for Workers. >Claude's output was thoroughly reviewed by Cloudflare engineers with careful attention paid to security >To emphasize, this is not "vibe coded". >Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs. ...Some time later... https://github.com/advisories/GHSA-4pc9-x2fx-p7vj
What is the learning here? There were humans involved in every step. Things built with security in mind are not invulnerable, human written or otherwise.
The developer just "cleaned up the code comments", i.e. they removed all TODOs from the code: https://github.com/nkuntz1934/matrix-workers/commit/2d3969dd... Professionalism at its finest!
I also use this as a simple heuristic: https://github.com/nkuntz1934/matrix-workers/commits/main/ There exist only two commits. I've never seen a "real" project that looks like this.
Earlier quoted context omitted.
Reminds me of Cloudflare's OAuth library for Workers. >Claude's output was thoroughly reviewed by Cloudflare engineers with careful attention paid to security >To emphasize, this is not "vibe coded". >Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs. ...Some time later... https://github.com/advisories/GHSA-4pc9-x2fx-p7vj
What is the learning here? There were humans involved in every step. Things built with security in mind are not invulnerable, human written or otherwise.
so the "reviewing" process will be looking for the needles in the haystack
when you have no understanding, or mental model of how it works, because there isn't one
it's a recipe for disaster for anything other than trivial projects
Earlier quoted context omitted.
> Is it really worth it? Unequivocally yes. Fraud is fraud, and if your first instinct is to defend it in this manner, check yourself in the mirror.
[flagged]
That doesn't exist in our trade, so yeah, public shaming is the next best thing. I sincerely hope links to this incident will haunt him every time someone googles his name forevermore.
The developer just "cleaned up the code comments", i.e. they removed all TODOs from the code: https://github.com/nkuntz1934/matrix-workers/commit/2d3969dd... Professionalism at its finest!
It's kinda mindblowing. What even is the purpose of this? It's not like this is some post on the vibecoding subreddit, this is fricken Cloudflare. Like... What the hell is going on in there?
nkuntz1934 Senior Engineering TPM @ Cloudflare Of course, this is done by a manager. Classic corporate mindset, I can do what these smelly nerds do every day, hold my bear. He doesn't even know how git works, huh? What a clown.
TPM isn't manager. It's basically a PM, but they're (supposed) to be technical
Earlier quoted context omitted.
[flagged]
I’m plenty calm. There’s just nothing to debate here: the blog post and repo are a conscious, deliberate, and egregious misrepresentation of fact. I would absolutely say exactly the same things to the author’s face as I’m saying right now. I would never work for a company that condones this in a million years, as a matter of principle.
I just see a lot of comments from people who just seem happy to see that they can contribute to ruining someone else's day (or more).
Earlier quoted context omitted.
What is the learning here? There were humans involved in every step. Things built with security in mind are not invulnerable, human written or otherwise.
The learning is "they lied". After all, apart from marketing materials making a claim, where is the evidence?