I continue to maintain that the best metaphor for the current situation in software development is "The Sorcerers Apprentice" in Fantasia:
Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
21–30 of 39 posts
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#22The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not. Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things out, but that's no longer the case. There's a lot of cool stuff being built, but also as a user, it's a scary time to be trying new things.
The frequency with which I see contemporary apps updating (sometimes multiple times a day) says there's a change in culture that also makes professionals prone to mistakes.
I get that we'll never ship a perfect release, but if you have to push fixes once a day it seems you've lost perspective.
Vibe coding slopiness is more acceptable now because we've lowered our standards
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#23Earlier quoted context omitted.
Developers with decades of experience still make basic security holes. The general public are screwed once they start hosting their own apps and serving on the Internet.
There's something so innocent about the early days when even Microsoft thought we'd be running Personal Web Servers and hosting our own websites in a peer-to-peer fashion. Although cynically, in 1996 Microsoft would probably tell you anything you wanted to hear if it got you using Internet Explorer. The Personal Web Server is ideal for intranets, homes, schools, small business workgroups and anyone who wants to set u…
I always held the belief that we (as programmers and industry) failed the initial premise of the "distributed internet". On one hand, the core of the internet (whether its arpanet or even tcp/ip) was designed to be fully distributed, trustless, selfhostable, etc. The idea that you if you want an email you do a `pkg_add email`, want a file server, `pkg_add file-server`, want remote access, `pkg_add openssh` and you're done. But what we have today is [1].
Securing all that got very technical and nuanced with hundreds of complex scenarios and tools and protocols. Tech companies raced to produce services the mass public can use, hiring hordes of very smart, expensive and technical developers to develop and secure, and they still get it wrong frequently. While the FOSS community adopted the "get good or gtfo" approach as in [1].
The average person has no chance. That's why closed wall-gardened platforms like iOS and Android are winning.
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#24One dev of a Lovable competitor pointed me to the rules thats supposed to ensure queries are limited to that user's data. This seems like "pretty please?" to my amateur eyes.
https://github.com/dyad-sh/dyad/blob/de2cc2b48f2c8bfa401608c...
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#25The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not. Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things out, but that's no longer the case. There's a lot of cool stuff being built, but also as a user, it's a scary time to be trying new things.
Yeah, my trust for new open source projects is in the toilet. Hopefully we will eventually start taking security seriously again after the vibe code gold rush.
This applies to all software not just open source.
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#26Earlier quoted context omitted.
I don't think you know what democracy means, democracy means that users can reject poorly made apps. If you can't reject or destroy something, it's not a democratic process. Having someone dump shitty wares onto the public is only democracy if you think being held unaccountable as democratic.
One of the meanings of the word "democratization" is "the action of making something accessible to everyone", which is clearly the sense meant here.
It has a more broad meaning of sharing like when a factory is dumping waste in a river, they are democratizing pollution. (i.e they get the benefits but everybody pays the cost.)
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#27I've been thinking a bit about how to do security well with my generated code. I've been using tools that check deps for CVEs, static tools that check for sql injection and similar problems, and baking some security requirements into the specs I hand claude. I can't tell yet if this is better than what I did before or just theater. It seems like in this case you'd need/want to specify some tests around access. I'm in…
Ask the LLM to create for you a POC for the vulnerability you have in mind. Last time I did this I had to repeatedly make a promise to the LLM that it was for educational purposes as it assumed this information is "dangerous".
This is actually pretty interesting. I guess I knew you could do this offensively but it didn’t occur to me to use it OWASP style to test my own work.
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#28The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not. Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things out, but that's no longer the case. There's a lot of cool stuff being built, but also as a user, it's a scary time to be trying new things.
The frequency with which I see contemporary apps updating (sometimes multiple times a day) says there's a change in culture that also makes professionals prone to mistakes. I get that we'll never ship a perfect release, but if you have to push fixes once a day it seems you've lost perspective. Vibe coding slopiness is more acceptable now because we've lowered our standards
Devs' newfound ability to patch on the fly is absolutely being overleveraged. It's a wonderful capability to have that can do wonders in terms of disaster mitigation, but it's clearly become a crutch and has resulted in a situation where software has become a horrific amalgamation of haphazardly-developed panic-patches, taking the classic "ball of mud" problem and putting it into overdrive.
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#29Earlier quoted context omitted.
One of the meanings of the word "democratization" is "the action of making something accessible to everyone", which is clearly the sense meant here.
It has a more broad meaning of sharing like when a factory is dumping waste in a river, they are democratizing pollution. (i.e they get the benefits but everybody pays the cost.)
I believe the phrase is "socialize the risk, privatize the profits". I have never heard used with the word "democratize".
Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users
#30Lovable is marketed to non developers, so their core users wouldn't understand a security flow if it flashed red. A lot of my non dev friends were posting their cool new apps they built on LinkedIn last year [0]. Several were made on lovable. It's not on their users to understand these flaws The apps all look the same with a different color palette, and makes for an engaging AI post on LinkedIn. Now they are mostly a…
Developers with decades of experience still make basic security holes. The general public are screwed once they start hosting their own apps and serving on the Internet.
> Developers with decades of experience still make basic security holes.
You see this type of template response copy pasted basically under any post/comment of this kind.
I think at the end of the day we’ll be able to look back and see what/who fared better, based on actual data.