Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe code is legacy code

blog.val.town

Post reply on HN
Print view View original

351–360 of 473 posts

Re: Vibe code is legacy code

#351

Post by CharlieDigital »

randmeerkat wrote: post #187
CharlieDigital wrote: post #131

Earlier quoted context omitted.

It's a win for the customers. From what he's told me, there's zero churn so far despite the hacks ( including one where the hacker emailed every customer about the hack ). It's because the software is that much of an improvement over the incumbents at a fraction of the cost. Better features, more flexible, easier to use, faster, etc. Everything about it is better than the two major vendors. The rebuild will likely en…

> The rebuild will likely end up easier, IMO, because the screens and the logic is all done. Most of it just has to be moved to strict backend and then have the APIs secured correctly. How to draw an owl… Step 1. Draw a circle. Step 2. Draw the rest of the owl…

The hardest thing about most business software is rarely technical. CRUD apps are CRUD apps.

In this case, it's understanding the use cases and flows that the customers value and where the incumbents are coming up short.

Re: Vibe code is legacy code

#352

Post by d4v3 »

pishpash wrote: post #273
dudeinhawaii wrote: post #263

Earlier quoted context omitted.

Everyone is slamming you but the reality is that you could use AI models + a competent developer or security engineer to _very_ quickly shore up the entire codebase and fix every single hole -- getting it to a place where it's comparable with everything else out there. It's really not that hard (and there is already a bit of research around the defensive coding capabilities of tools like Codex and Claude Code)[1]. I…

You don't know what you don't know. How was a non-technical glorified PM supposed to know to ask for these things in the first place? Such technical practices developed over time in the history of software engineering, as problems arose.

Everyone knows that hackers exist and exploit security lapses. Everyone. You might not know the details and such, but you should responsible enough to at least ask if you are taking people's money. I just don't think the ignorance card is plausible here

Re: Vibe code is legacy code

#353

Post by quantum_state »

CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

Would add that in the hands of experienced developers, vibe coding is of not much help either. Coding would be much minimized with a good framework and re-use, while keeping the entire codebase maintainable.

Re: Vibe code is legacy code

#354

Post by _Algernon_ »

motorest wrote: post #341
_Algernon_ wrote: post #340

Earlier quoted context omitted.

Being in the possession of a password or key implies having permission to use that key. When generating a key you give everyone with access to that key the permission to use it to perform actions on your account. Protect your keys.

> Being in the possession of a password or key implies having permission to use that key. No, it doesn't.

Yes, it does.

Re: Vibe code is legacy code

#355

Post by oc1 »

extr wrote: post #35

IMO, the time of "code as math" is over. No sufficiently large software system that interacts with the real world is provable to be correct like a mathematical statement is. They are all complicated, engineered systems that are backed by a mix of formal guarantees, earned design principals, experimental testing, rules of thumb, acceptable performance envelopes, etc This is what all software will become, down to the s…

> Cost: $50K of API tokens

What? It costs exactly $200

Re: Vibe code is legacy code

#356

Post by laurent_du »

stevage wrote: post #271
pmontra wrote: post #258

Earlier quoted context omitted.

A dozen years ago a company hired me to maintain an ecommerce system that had been built for them by a guy that left soon after. They told me "he is not even a developer." That was my assessment too. The system mostly worked but it didn't run fast enough to process their daily load. It was a mess but it would cost too much to rewrite. I managed to fix the worst parts, then switched to other customers. No idea if they…

I guess when you put it like that there is a long history of production systems being built by people who had no business doing it. An access database running a whole company etc.

A friend of mine was doing modelling (as in, being a model) in a large European city. He then worked as a product manager for a well-known luxury company. He ended up writing a system in visual basic that was responsible for a large amount of internal plumbing. He had no experience in programming.

Re: Vibe code is legacy code

#357

Post by vaylian »

Ferret7446 wrote: post #234
bravesoul2 wrote: post #198

Earlier quoted context omitted.

It's also "worth it" to start a burger stand and make $1000 a day by vibing and not wasting time on food hygiene training or practices. Gotta move fast and test the market after all. I predict 2030: all sites in most countries will need a license to operate and something like SOC2 certification. Even for your blog.

I think it should only apply to commercial services FWIW. Amateur sites should be caveat emptor

In practice politicians don't care (or understand) commercial versus non-commercial internet services. Just look at the garbage fire that the UK online safety act is.

Re: Vibe code is legacy code

#359

Post by BoxOfRain »

CharlieDigital wrote: post #131
dashdotme wrote: post #121

Earlier quoted context omitted.

> Was it worth it? Yes, it is terrible, shoddy, insecure code, but he proved out a viable business with just a few hundred dollars of investment. This feels like less of a win for the customers though. They're paying money and exposing their data insecurely, all for a product that maybe does what it's trying to do. > Now he's hiring a developer to shore it up. This is going to be way harder than it sounds... I'm all…

It's a win for the customers. From what he's told me, there's zero churn so far despite the hacks ( including one where the hacker emailed every customer about the hack ). It's because the software is that much of an improvement over the incumbents at a fraction of the cost. Better features, more flexible, easier to use, faster, etc. Everything about it is better than the two major vendors. The rebuild will likely en…

>The rebuild will likely end up easier, IMO, because the screens and the logic is all done. Most of it just has to be moved to strict backend and then have the APIs secured correctly.

Atlas can finally be relieved of holding up the sky, since the 'just' in that sentence is capable of even heavier lifting.

Re: Vibe code is legacy code

#360

Post by soco »

bruce511 wrote: post #286
motorest wrote: post #259

Earlier quoted context omitted.

> It was crazy just how fast it was exploited. The internet is a wild place in any aspect of it. You should try spinning up a random virtual private server on any cloud provider, plug in a public IP address,and listen to traffic. Sometimes it takes seconds to get your first traffic from vulnerability scanners.

This 100%. I'm in a space with developers and customers deploying web servers for the first time. This traffic freaks them out. Basically a simple server listening on a port will experience hundreds of random script-probing attacks per day. And if any of them show the slightest hint of succeeding then that escalates quickly to thousands per minute. You don't need a DNS entry to "expose" the IP address (there are only…

Short related story: some customer wanted an API with a basic firewall, they said they don't need filter rules as it won't be used or something. I put a dumb API online (doing nothing) and showed them the request logs after one day. They approved the filter rules immediately.
Post reply on HN