21–30 of 38 posts
Wow, chapeau to the author. What an elegant, interesting read. What I don't quite understand: Why is the Clickhouse bug not given more scrutiny? Like that escape bug was what made the RCE possible and certainly a core DB company like ClickHouse should be held accountable for such an oversight?
Earlier quoted context omitted.
Just because AI tools are involved doesn't mean it's "Vibe coding".
What does it mean?
Unfortunately a lot of people think it means any time an LLM helps write code, but I think we're winning that semantic battle - I'm seeing more examples of it used correctly than incorrectly these days.
It's likely that the majority of code will be AI assisted in some way in the future, at which point calling all of it "vibe coding" will lose any value at all. That's why I prefer the definition that specifies unreviewed.
Earlier quoted context omitted.
What does it mean?
The preferred definition of "vibe coding" is when you have AI generate code that you use without reviewing it first: https://simonwillison.net/2025/Mar/19/vibe-coding/ Unfortunately a lot of people think it means any time an LLM helps write code, but I think we're winning that semantic battle - I'm seeing more examples of it used correctly than incorrectly these days. It's likely that the majority of code will be AI…
Earlier quoted context omitted.
What does it mean?
The preferred definition of "vibe coding" is when you have AI generate code that you use without reviewing it first: https://simonwillison.net/2025/Mar/19/vibe-coding/ Unfortunately a lot of people think it means any time an LLM helps write code, but I think we're winning that semantic battle - I'm seeing more examples of it used correctly than incorrectly these days. It's likely that the majority of code will be AI…
Earlier quoted context omitted.
looking at their commits, there are about 300+ commits tagged with " Generated with https://claude.com/claude-code " attribution.
Just because AI tools are involved doesn't mean it's "Vibe coding".
> As it described on Clickhouse documentation, their API is designed to be READ ONLY on any operation for HTTP GET As described in the Clickhouse documentation, their API is designed to be READ ONLY on any operation for HTTP GET requests.
Out of interest, how much does ZDI pay for a bug like this?
Out of interest, how much does ZDI pay for a bug like this?
They probably don't accept something like this. Not that many Posthog self-hosted instances out there...
Does this require authenticated access to the posthog api to kick off? In that case I feel clickhouse and posthog both have their share of the blame here.
It looks like the entire class of bugs here are "if you have access to Posthog's admin dashboard, you can configure webhook URLs that hit Posthog's internal services". That's not particularly surprising for a self-hosted system like the author's, but I expect it would pretty bad if you were using their cloud-hosted product.