Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe code is legacy code

blog.val.town

Post reply on HN
Print view View original

381–390 of 473 posts

Re: Vibe code is legacy code

#381

Post by pydry »

bartread wrote: post #348
WD-42 wrote: post #110

Earlier quoted context omitted.

I would not default to assuming it was his competitors, that sounds like scapegoating to deflect responsibility. What most likely happened is his site was scanned by one of the increasingly sophisticated exploit crawlers (anyone who runs an internet facing site and can view traffic knows what I'm talking about). His site got flagged as vulnerable, the hacker found out it was built like swiss cheese and had fun with i…

It's 100% this. Anyone who's run a website or web app for any length of time in recent years and makes a habit of inspecting their logs will quickly realise that they're being scanned by bots looking for vulnerabilities multiple, or even many, times per day. The search for vulnerabilities is entirely automated and will pick up any domain that has a website or web app attached to it. One those vulnerabilities are foun…

>One those vulnerabilities are found, the hackers will pounce

...and work to exploit your code to their own benefit. They don't do this just so that they can refund your customers.

Re: Vibe code is legacy code

#382

Post by pydry »

zerkten wrote: post #248
JackFr wrote: post #235

Earlier quoted context omitted.

I have a strictly hobby web app that I work on. 6-7 years ago I inadvertently pushed AWS email service credentials to GitHub. Half an hour after the push I got an email and text from GitHub that I had exposed credentials. I quickly logged in to my AWS to turn off the service, to see that AWS had suspended that service because the bounce rate on the 80000 emails sent in that 15 minute period was too high. It was crazy…

>> It was crazy just how fast it was exploited. People underestimate the speed, but also the number of pivots that advanced attackers will make. Sure, these kinds of problems are easy to exploit, but with major organizations that employ reasonable defenses, the attackers will pivot through 50+ exploits/machines/layers to get to the target(s). This can take place over weeks or months.

It still doesn't make sense that advanced attackers would go to those lengths in order to... refund the customers.

Re: Vibe code is legacy code

#384

Post by darick »

Ferret7446 wrote: post #233
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

This is morally equivalent to building a house with no engineering experience and someone coming around and kicking it down. The problem isn't vibe coding per se, but lacking some key knowledge to be able to make important judgements which may (should) result in legal liability

Conflating a scenario that will likely result in many deaths with leaking some customer emails is kind of crazy to me. How are they morally equivalent? Both are bad, but there is a significant difference in how bad IMO.

Re: Vibe code is legacy code

#385

Post by alzoid »

MrGilbert wrote: post #7

And what you will get in return is professional software developers looking at vibe-coded modules that already went into production, stating that "we will never ever touch this", as they don’t want to be responsible for something they would have never put into production in the first place. Now, they see themselves challenged to defend against the non-technical departments, because all they see are some elitist devel…

I ran into an AI coded bug recently the generated code had a hard coded path that resolved another bug. My assumption is the coder was too lazy to find the root cause of the bug and asked the LLM to "make it like this". The LLM basically set a flag to true so the business logic seems to work. It shouldn't have got past the test but whatever.

In another code base, all the code was written with this pattern. Its like the new code changed what the old code did. I think that 'coder' kept a big context window and didn't know how to properly ask for something. There was 150 line function that only needed to be 3 lines, a 300 line function that could be done in 10 etc. There were several a sections where the LLM moved the values of a list to another list and then looped through the new list to make sure the values were in the new list. It did this over and over again.

Re: Vibe code is legacy code

#386

Post by conradfr »

doesnt_know wrote: post #119
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

Well his customers got a refund, that's nice ;)

But I guess the lesson is to vibe code to test the market while factoring a real developer cost upfront and hiring one as soon as the product gets traction.

Re: Vibe code is legacy code

#387

Post by eythian »

encom wrote: post #342
JackFr wrote: post #235

Earlier quoted context omitted.

I have a strictly hobby web app that I work on. 6-7 years ago I inadvertently pushed AWS email service credentials to GitHub. Half an hour after the push I got an email and text from GitHub that I had exposed credentials. I quickly logged in to my AWS to turn off the service, to see that AWS had suspended that service because the bounce rate on the 80000 emails sent in that 15 minute period was too high. It was crazy…

Here's an amusing thing to try on anything with SSH exposed. These log files go back a month. # zcat -f /var/log/auth.log* | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $6}' | sort | uniq -c | sort -bnr | head -n 30 5190 #redacted: my domain name 3063 admin 1891 #redacted: another domain name 931 user 724 ubuntu 287 test 268 solv 206 odoo15 200 solana 197 sol 184 ubnt 173 wialon 170 Antminer 169 guest 168 od…

Interestingly, I have a server that only has IPv6 SSH open to the outside world, and it has exactly zero that aren't me fat-fingering a password. It does have an externally visible hostname, which says to me that the bots aren't looking at hostnames for SSH, just IP(v4) addresses.

Re: Vibe code is legacy code

#388

Post by ralferoo »

motorest wrote: post #259
JackFr wrote: post #235

Earlier quoted context omitted.

I have a strictly hobby web app that I work on. 6-7 years ago I inadvertently pushed AWS email service credentials to GitHub. Half an hour after the push I got an email and text from GitHub that I had exposed credentials. I quickly logged in to my AWS to turn off the service, to see that AWS had suspended that service because the bounce rate on the 80000 emails sent in that 15 minute period was too high. It was crazy…

> It was crazy just how fast it was exploited. The internet is a wild place in any aspect of it. You should try spinning up a random virtual private server on any cloud provider, plug in a public IP address,and listen to traffic. Sometimes it takes seconds to get your first traffic from vulnerability scanners.

Years ago back in 2001, I had a /29 giving my 5 real IP addresses from my ISP.

Back then, I mostly only ran Linux, but for some reason, I needed to run something on a Windows machine, so started installing Windows 98 SE onto a machine, and set it up with a public IP address without even thinking about it. It crashed before it'd even finished installing [0], and investigation showed that it'd been whacked by an automated RCE exploit scanner.

I immediately decided it was never worth the risk of putting a Windows machine on a public IP, and set up a NAT even though I had 3 spare public IPs.

[0] There was already a published update to protect against this exploit, but I was scanned and hacked between the base install exposing the bug and the automatic update patching it.

Re: Vibe code is legacy code

#389

Post by __MatrixMan__ »

doesnt_know wrote: post #119
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

In our imperfect world, by the time the government could get together a reasonable certification process the content you're tested on would be out of date. Maybe when the industry is older it'll change slow enough to do that, but I don't think that'll happen so long as there's so much money aimed at disrupting everything and monetising the disruption.

Were going in circles far too fast to have licensure that hinges on being up to date.

Re: Vibe code is legacy code

#390

Post by nerdjon »

CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

If whatever this SaaS can be so easily built with no technical knowledge... why would a company not just build it themselves with "vibe coding" and cut out our friend completely?

That is what is so broken about this whole vibe coding to riches thing. Ignoring the very real problems with the quality of the code and security issues, if you can vibe code it what is stopping someone else from doing the exact same thing.

It sure isn't like security is any better... clearly.

Post reply on HN