21–30 of 47 posts
Earlier quoted context omitted.
I do. I care. And there are dozens of us. Lots of infected programs provide value. It has nothing to do with being or not being infected. If a project was vibecoded in a weekend - there are less chances that it will still be maintained in a, say, year or two.
But if it is open source you could maintain it? It could be "done" for a given state of affairs (protocol/API versions etc)?
Earlier quoted context omitted.
I do. I care. And there are dozens of us. Lots of infected programs provide value. It has nothing to do with being or not being infected. If a project was vibecoded in a weekend - there are less chances that it will still be maintained in a, say, year or two.
Don't give programs unnecessary access - problem solved
These concerns were great valid even before vibecoding becoming a thing, but now the estimated probabilities of malicious code's presence have changed, simply because nowadays the cost/effort of writing software plummeted.
Looks well done, nice looking TUI. Does not specify if it's vibe coded or not, which I think should be normal practice now ;(
why would it be normal? the code is there for you to look at and use or not. It is open-source, licensed as open source and is very clear about that. Why would you feel that the author(s) should need to specify anything else at all to satisfy your curiosity?
I have been using LLMs since August last year, and I know the output they can produce. And I know that the initial output requires refinement in most cases. And that's coming from someone experienced in Software development. LLMs in the hands of people who are not experienced lead to skip a proper review process.
Additionally, it's unreasonable to assume one can take a large codebase and will spend hours on examining the code before. It's not only unreasonable but downright ridiculous.
LLMs are a part of reality right now and they're not going away. Code should be labeled as such. Not doing that is inconsiderate.
Earlier quoted context omitted.
I do. I care. And there are dozens of us. Lots of infected programs provide value. It has nothing to do with being or not being infected. If a project was vibecoded in a weekend - there are less chances that it will still be maintained in a, say, year or two.
But if it is open source you could maintain it? It could be "done" for a given state of affairs (protocol/API versions etc)?
I'm definitely not going to jump in on a vibe-coded project. I'd much rather start from scratch if I found the use-case to be relevant.
Not to say vibe-coded projects can't be alright. If the engineer behind it knows their stuff, it's fine to me. But we don't know that. So to get a general idea, I think it's fair to ask how this was done.
Earlier quoted context omitted.
why would it be normal? the code is there for you to look at and use or not. It is open-source, licensed as open source and is very clear about that. Why would you feel that the author(s) should need to specify anything else at all to satisfy your curiosity?
because it matters. Why would you intentionally choose to ignore that fact if it was provided? I have been using LLMs since August last year, and I know the output they can produce. And I know that the initial output requires refinement in most cases. And that's coming from someone experienced in Software development. LLMs in the hands of people who are not experienced lead to skip a proper review process. Additional…
> it's unreasonable to assume one can take a large codebase and will spend hours on examining the code before.
This seems to be an issue with your security posture that exists regardless of how the software was written. Do you think malicious or broken software was invented with the advent of LLMs?
People and organizations serious about security absolutely do evaluate unknown software before use. You don’t have to read the code, there are many other ways to evaluate software depending on your risk profile.
Earlier quoted context omitted.
This is a ridiculous analogy. Test the app. Read its source code. Developers could always write toxic instruction in your tools. AI may write inefficient or messy code, but it’s far from nefarious. “Asbestos” code is written intentionally by humans, not unintentionally AI.
That's a good way to guarantee nobody will use it. Who is going to test the app in a sandbox with godknowswhat kind of tooling needed to find malicious behavior and read the code? For a tool that's convenient once per decade?
Software security assessments exist for this very purpose. You may personally lack the rigor to do this at home but those who have rigorous security processes absolutely do implement security reviews.
There is a whole industry of professionals who do this work.
Everyone asking was this vibe coded should calm down. Instead we should just have automated ways to audit the code to see if it’s secure, see if it’s going to steal our keys, etc. If it provides value who cares? I mean we could read the code to see if it does anything nefarious. Or have a bought do a check or checks. But asking every time there’s a show HN is it vibe coded is such gatekeeping elitest nonsense it make…
To make it really funny, that extension should be vibe coded.
Seriously though, it should just be against HN guidelines. It's annoying to see that 90% of the comments are just people fighting over vibe coding on a completely unrelated topic. On this submission? There's only 1 (one) on-topic comment.
Nice to see first-class RDAP support. Feature Request: BGP route lookup using looking glasses of your choice, and Peeringdb lookup for the ASN. https://www.peeringdb.com/apidocs/
Earlier quoted context omitted.
I do. I care. And there are dozens of us. Lots of infected programs provide value. It has nothing to do with being or not being infected. If a project was vibecoded in a weekend - there are less chances that it will still be maintained in a, say, year or two.
Don't give programs unnecessary access - problem solved
So, permissions are always going to be more general than what a program actually needs and, therefore, exploitable.
Producing incorrect information is an insidious example of this. We can't simply restrict the program's permissions so that it only yields correct outputs -- we'd need to understand the outputs themselves to make that work. But, then, we're in a situation where we're basing our choices on potentially incorrect and unverified outputs from the program.
Everyone asking was this vibe coded should calm down. Instead we should just have automated ways to audit the code to see if it’s secure, see if it’s going to steal our keys, etc. If it provides value who cares? I mean we could read the code to see if it does anything nefarious. Or have a bought do a check or checks. But asking every time there’s a show HN is it vibe coded is such gatekeeping elitest nonsense it make…
You are trying to rationalize with people who hold irrational beliefs. It won't work because their objections aren't based on reason. It's ok for people to just hate things. I hate spinach for example. Listing all the reasons that my distaste for spinach is irrational won't change that. Similarly, explaining to the new amish that AI with TDD writess better code than most of the devs I know isn't going to get you anyw…