Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An AI Vibe Coding Horror Story

tobru.ch

Post reply on HN
Print view View original

101–110 of 224 posts

Re: An AI Vibe Coding Horror Story

#101

Post by BrissyCoder »

kuboble wrote: post #92
BrissyCoder wrote: post #83

Earlier quoted context omitted.

Yeah because every medical practice I go to, I'm always able to investigate all of their systems.

I live in Switzerland. Sounds pretty normal. There are plenty of small medical practices with 1-2 doctors and a front desk. On my last visit i actually casually discussed their IT system with a doctor.

> On my last visit i actually casually discussed their IT system with a doctor.

Oh right, cool. Did it have a public-facing web-portal that you were able to "investigate" and that "Thirty minutes in, I had full read and write access to all patient data".

The level of credulity in these comments is immense.

Re: An AI Vibe Coding Horror Story

#102

Post by seethishat »

I saw something very similar a few months ago. It was a web app vibe coded by a surgeon. It worked, but they did not have an index .html file in the root web directory and they would routinely zip up all of the source code which contained all the database connection strings, API credentials, AWS credentials, etc.) and place the backup in the root web directory. They would also dump the database to that folder (for backup). So web browsers that went to https://example.com/ could see and download all the backups.

The quick fix was a simple, empty index.html file (or setting the -Indexes option in the apache config). The surgeon had no idea what this meant or why it was important. And the AI bots didn't either.

The odd part of this to me was that the AI had made good choices (strong password hashes, reasonable DB schema, etc.) and the app itself worked well. Honestly, it was impressive. But at the same time, they made some very basic deployment/security mistakes that were trivial. They just needed a bit of guidance from an experienced devops security guy to make it Internet worthy, but no one bothered to do that.

Edit: I do not recommend backing up web apps on the web server itself. That's another basic mistake. But they (or the AI) decided to do that and no one with experience was consulted.

Re: An AI Vibe Coding Horror Story

#103

Post by piokoch »

VanTodi wrote: post #20
mikojan wrote: post #6

Hard to believe... This activity should certainly land you in a German prison?!

since its a .ch domain, i believe its in swiss. In germany we have our DSGVO (GDPR), and you can report it too. If a breach happen, you have to inform all your customers. if its a first time and you tried to your own best, the punishment is not that hard, but since these are medical infos they should have known better. Lets really hope they learned from their mistakes

Switzerland is very liberal in terms of business-oriented regulations to the point that you could crate a new year party in a closed cellar without emergency exists, not to mention anti-fire installation and burn people alive there.

Re: An AI Vibe Coding Horror Story

#104

Post by abc123abc123 »

fainpul wrote: post #55
spaniard89277 wrote: post #7

I did something similar to a local company here in Spain. Not medical, but a small insurance company. Believe it or not, yes, they vibecoded their CRM. I sent them an email and they threatened to sue me. I was a bit in shock from such dumb response, but I guess some people only learn the hard way, so I filed a report to the AEPD (Data protection agency in Spain) for starters, known to be brutal. I've also sent them a…

> AEPD […] known to be brutal. Nice. I wish more countries had something like that. Many of these organizations are lethargic and have to be forced into action by civilian efforts or the press.

Thta's wonderful! Most of europes GDPR/Data protection autohrities are completely worthless and seem to constantly side with big corps.

Only when they start to side with the people, actually fining business billions and billions will things start to change. I hope we'll see this happen in europe at large, and not only in a few countries.

Re: An AI Vibe Coding Horror Story

#105

Post by grey-area »

trick-or-treat wrote: post #68
grey-area wrote: post #11

Earlier quoted context omitted.

Usually they would just use an off the shelf product and extend it, so they wouldn’t produce the absolute horror story described in the article, no. I’m not even sure what your last comment means, are you contending that it is a good thing this company violated multiple laws with sensitive patient data?

> Usually they would just use an off the shelf product and extend it AI does the same thing an agency or dev would do. Those vibe coding platforms have a template for these things which is usually Vite + React with Supabase for the backend, the same as a dev might use because surprise the LLM trained on the dev's work. OP's point is that you're not guaranteed a good outcome hiring an agency or solo dev either, in fac…

Apparently your assumptions about AI are completely wrong, if you read the article it produced terrible code.

Re: An AI Vibe Coding Horror Story

#106

Post by Arch-TK »

seethishat wrote: post #102

I saw something very similar a few months ago. It was a web app vibe coded by a surgeon. It worked, but they did not have an index .html file in the root web directory and they would routinely zip up all of the source code which contained all the database connection strings, API credentials, AWS credentials, etc.) and place the backup in the root web directory. They would also dump the database to that folder (for ba…

The fix is to not let users download the credentials. In fact, ideally the web server wouldn't have access to files containing credentials, it would handle serving and caching static content and offloading requests for dynamic content to the web application's code.

Disabling auto-indexing just makes it harder to spot the issue. (To clarify, also not a bad idea in principle, just not _the_ solution.) If the file is still there and can be downloaded, that's strictly something which should not be possible in the first place.

Re: An AI Vibe Coding Horror Story

#107

Post by simianwords »

seethishat wrote: post #102

I saw something very similar a few months ago. It was a web app vibe coded by a surgeon. It worked, but they did not have an index .html file in the root web directory and they would routinely zip up all of the source code which contained all the database connection strings, API credentials, AWS credentials, etc.) and place the backup in the root web directory. They would also dump the database to that folder (for ba…

Agent-Native DevOps tools are probably necessary. There should be no reason they would do it manually.

How I see it happening: agents like CC have in built skills for deployment and uses building blocks from either AWS or other simpler providers. Payment through OAuth and seamless checkout.

This should be standardised

Re: An AI Vibe Coding Horror Story

#108

Post by cmiles8 »

There’s another version of the Mythos narrative that reads like:

AI companies realized that all this vibe coding has released a shitstorm of security vulnerabilities into the wild and so unless they release a much better model to fix that mess they’ll be found out and nobody will touch AI coding with a 100ft pole for the next 15 years. This article points more towards this narrative.

Re: An AI Vibe Coding Horror Story

#109

Post by simianwords »

freakynit wrote: post #57

I think vibe-coding is cool, but it runs into limits pretty fast (at least right now). It kinda falls apart once you get past a few thousand lines of code... and real systems aren't just big, they're actually messy...shit loads of components, services, edge cases, things breaking in weird ways. Getting all of that to work together reliably is a different game altogether. And you still need solid software engineering…

I suggest actually using Claude code and make a sample app using it. It absolutely can make apps even if you don’t know any fundamentals. I think it can work up to 20k LOC from my experience. You do need a human to give feedback but not someone who understands software principles.

Re: An AI Vibe Coding Horror Story

#110

Post by croemer »

abrookewood wrote: post #27
BrissyCoder wrote: post #15

This reads like internet fiction to me. Very vague and short.

Given the subject matter, it would be highly unethical to reveal the name of the company before verifying it was indeed fixed. I'd be wary of getting sued.

Company should just take down the whole thing. One vuln might be fixed but how many others might be there.
Post reply on HN