Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

theregister.com

Post reply on HN
Print view View original

31–39 of 39 posts

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#31

Post by Flashtoo »

kimixa wrote: post #10
carlgreene wrote: post #7

Earlier quoted context omitted.

Of course there were. Don't be pedantic. Anybody could write a program and put it on the internet. But to get a reasonably polished version with decent features and an enjoyable enough UX for someone to sign up and even pay money more, it generally took people who kind of knew what they were doing. Of course shortcuts were taken. They always were and always will be. But don't try to compare shipping software today to…

Yes - AI has completely destroyed the set of "Signals" people used to judge quality of much software. They weren't ever 100% accurate, sure, but they were often pretty good heuristics for "level of care", what the devs considered important (or didn't consider important) and similar. And I mean that as both "end user" software signals, and "library" signals for other devs. I assume that set of signals will slowly be u…

This is true beyond software. It used to be that the proof of the thinking process was in the resulting artifact. No longer can you estimate from the existence of a piece of text and the level of polish behind it that the apparent author has put at least a reasonable amount of thought into it. This applies to comments, blogs, emails, and most troublingly I've seen this happen at my job with things like requirement specs. Now, the veneer of quality makes it much harder to know what is the appropriate amount of skepticism to judge the contents with. And it's too tiring to be maximally skeptical about everything.

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#32

Post by dizhn »

warkdarrior wrote: post #29
dizhn wrote: post #26

Earlier quoted context omitted.

It has a more broad meaning of sharing like when a factory is dumping waste in a river, they are democratizing pollution. (i.e they get the benefits but everybody pays the cost.)

I believe the phrase is "socialize the risk, privatize the profits". I have never heard used with the word "democratize".

I think I encountered in Chomsky's writings but I might be wrong.

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#33

Post by adampunk »

ch4s3 wrote: post #5

I've been thinking a bit about how to do security well with my generated code. I've been using tools that check deps for CVEs, static tools that check for sql injection and similar problems, and baking some security requirements into the specs I hand claude. I can't tell yet if this is better than what I did before or just theater. It seems like in this case you'd need/want to specify some tests around access. I'm in…

So the problem I'm having is I don't know what I'm doing vis a vis security, so I can't audit my own understanding by just sitting in a chair, but here's what I've been doing.

I'm building a desktop app that has has authentication needs because we need to connect our internal agents and also allow the user to connect theirs. We pay for our agents, the user pays for theirs (or pays us to use ours etc.). These are, relatively speaking, VERY SIMPLE PROBLEMS, nevertheless agents are happy to consume and leak secrets, or break things in much stranger ways, like hooking the wrong agent up to the wrong auth which would have charged a user for our API calls. That seemed very unlikely to me until I saw it.

So far what has "worked" (made me feel less anxious, aside from the niggling worry that this is theater) is: 1. Having a really strong and correct understanding of our data flows. That's not about security per se so at least that I can be ok at it. This allows me to... 2. Be aggressive and paranoid about not doing it at all, if it can be helped. Where I actually handle authentication is as minimal as possible (one should have some reasonable way to prove that to yourself). Done right the space is small enough to reason about.

How do I do 1 & 2 while not knowing anything? Painfully and slowly and by reading. The web agents are good if you're honest about your level of knowledge and you ask for help in terms of sources to read. It's much more effective than googling. Ask, read what the agents say, press them for good recommendations for YOU to read, not anyone. Then go out and read those sources. Have I learned enough to supervise a frontier model? No. Absolutely not. Am I doing it anyway? Yes.

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#34

Post by general_reveal »

carlgreene wrote: post #2

The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not. Previously, you were able to have _some_ reasonable expectation of security in that trained engineers were the ones building these things out, but that's no longer the case. There's a lot of cool stuff being built, but also as a user, it's a scary time to be trying new things.

The hardest part about this stuff is that as a user, you don't necessarily know if an app is vibe-coded or not

Hah. Advert of the year. Can’t really tell the difference anymore huh …

Re: Vibe coded Lovable-hosted app littered with basic flaws exposed 18K users

#39

Post by drunken_thor »

This is a prime example of how lazy vibe coding makes people. Even if they were not technical, some of these bugs would have been caught if they just went through the behaviour by hand at least once. Not an ounce of QA just generate and ship.
Post reply on HN