Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe code is legacy code

blog.val.town

Post reply on HN
Print view View original

391–400 of 473 posts

Re: Vibe code is legacy code

#391

Post by __MatrixMan__ »

api wrote: post #197
doesnt_know wrote: post #119

Earlier quoted context omitted.

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

In that world we’d just be transitioning to 32-bit software and still running MS-DOS since it’s certified. Linux would never ever have broken through. Who can trust code developed by open source cowboys? Have we verified all their credentials? There are some industries where the massive cost of this type of lock down — probably innovation at 1/10th the speed at 100X the cost — is needed. Medicine comes to mind. It’s…

I disagree. Mature open source projects last long enough without significant disruption to still be relevant after they make it onto the certification exam. Products, not so much.

Investing time building familiarity with proprietary software is already a dubious move for a lot of other reasons, but this would be just one more: why would I build curriculum around something that I'm just going to have to change next year when the new CEO does something crazy?

And as bad as it might be for many of us who hang out here, killing off proprietary software would be a great step forward.

Re: Vibe code is legacy code

#392

Post by ralferoo »

WJW wrote: post #313
eddythompson80 wrote: post #120

Earlier quoted context omitted.

Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.

You don't scan just a single website, you code up the bot once and then scan every site you can find. Your friends' service was just the proverbial paper car in a thunderstorm: the thunderstorm doesn't care about the paper car but destroys it just the same.

My website has a "public" directory for things I wanted to be publicly accessible, but there's an index.html there so you can't trivially discover what files are there.

I was mirroring this to another machine, and I'd foolishly already configured haproxy to serve from either machine. In the 10 minutes (guesstimate) between starting to populate the directory and closing off access, I had one bot scrape every single file in there. What was worse was that it'd cached the index, and continued scraping these files from the other backend too, so I had to shut off access to that directory on the live server as well as the backup.

Whilst technically, all of these files were "public" because I wanted to share them, some of them weren't publicly linked to (things like my CV etc) which I'd rather hadn't been scraped by some random bot (that of course, didn't identify itself or respect robots.txt).

Re: Vibe code is legacy code

#393

Post by CharlieDigital »

nerdjon wrote: post #390
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

If whatever this SaaS can be so easily built with no technical knowledge... why would a company not just build it themselves with "vibe coding" and cut out our friend completely? That is what is so broken about this whole vibe coding to riches thing. Ignoring the very real problems with the quality of the code and security issues, if you can vibe code it what is stopping someone else from doing the exact same thing.…

One of the first things he told me after he got it up was that this is the end of SaaS.

The thing is, not everyone knows about these tools. Many small businesses are focused on their day to day. Even if you can build it yourself, there is still some operational overhead. Even if you don't have to be technical as an engineer, you still need to know a bit about apps -- what's React? What's a database?

Re: Vibe code is legacy code

#394

Post by hiatus »

pydry wrote: post #382
zerkten wrote: post #248

Earlier quoted context omitted.

>> It was crazy just how fast it was exploited. People underestimate the speed, but also the number of pivots that advanced attackers will make. Sure, these kinds of problems are easy to exploit, but with major organizations that employ reasonable defenses, the attackers will pivot through 50+ exploits/machines/layers to get to the target(s). This can take place over weeks or months.

It still doesn't make sense that advanced attackers would go to those lengths in order to... refund the customers.

Plenty of hackers do it "for the lolz".

Re: Vibe code is legacy code

#395

Post by hansvm »

pydry wrote: post #382
zerkten wrote: post #248

Earlier quoted context omitted.

>> It was crazy just how fast it was exploited. People underestimate the speed, but also the number of pivots that advanced attackers will make. Sure, these kinds of problems are easy to exploit, but with major organizations that employ reasonable defenses, the attackers will pivot through 50+ exploits/machines/layers to get to the target(s). This can take place over weeks or months.

It still doesn't make sense that advanced attackers would go to those lengths in order to... refund the customers.

There are lots of smart kids who don't particularly need reasons for causing mayhem. Suppose it was somebody profit-motivated though. They might be:

1. Distracting from a more important vulnerability

2. Later contacting customers, advising them of the "accidental" refund and redirecting them to a more appropriate payment mechanism (one without the KYC Stripe does, were they to try to steal funds directly)

3. Testing stolen credit cards before using them elsewhere

Etc. Scamming people is a big industry, and not all of the plots are immediately obvious.

Re: Vibe code is legacy code

#396

Post by 1718627440 »

JackFr wrote: post #235
eddythompson80 wrote: post #120

Earlier quoted context omitted.

Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.

I have a strictly hobby web app that I work on. 6-7 years ago I inadvertently pushed AWS email service credentials to GitHub. Half an hour after the push I got an email and text from GitHub that I had exposed credentials. I quickly logged in to my AWS to turn off the service, to see that AWS had suspended that service because the bounce rate on the 80000 emails sent in that 15 minute period was too high. It was crazy…

I think common people also underestimate how fast a computer really is nowadays, because they only know bloated MS Windows machines.

Re: Vibe code is legacy code

#397

Post by 1718627440 »

encom wrote: post #342
JackFr wrote: post #235

Earlier quoted context omitted.

I have a strictly hobby web app that I work on. 6-7 years ago I inadvertently pushed AWS email service credentials to GitHub. Half an hour after the push I got an email and text from GitHub that I had exposed credentials. I quickly logged in to my AWS to turn off the service, to see that AWS had suspended that service because the bounce rate on the 80000 emails sent in that 15 minute period was too high. It was crazy…

Here's an amusing thing to try on anything with SSH exposed. These log files go back a month. # zcat -f /var/log/auth.log* | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $6}' | sort | uniq -c | sort -bnr | head -n 30 5190 #redacted: my domain name 3063 admin 1891 #redacted: another domain name 931 user 724 ubuntu 287 test 268 solv 206 odoo15 200 solana 197 sol 184 ubnt 173 wialon 170 Antminer 169 guest 168 od…

I'm surprised there is no root there? In my experience this is by far the most common.

Re: Vibe code is legacy code

#398

Post by Karawebnetwork »

usui wrote: post #317
phplovesong wrote: post #295

Did anyone think otherwise? AI generated code is obviously tech debt / legacy / whatever you want to call it. This was the same as 10-15 years ago when we saw that php dev copypasta from stackoverflow. I expect code quality to be way, way worse in the coming decade. Its not legacy because of age, its legacy feom day one. Pure nightmare fuel.

What are you referring to with PHP dev copypasta from Stack Overflow?

From my experience and memory of that era, early versions of PHP had a very low barrier to entry and very simple and insecure methods for accessing a database. It was easy to program the CRUD logic of a website without knowing much about the rest of the pipeline, such as security or data cleansing.

This was also the era of jQuery with easy to use AJAX methods, which enabled almost anyone to create a front-end that calls backend code.

All of that was simple code that was easy to share with others on forums. This led to insecure websites where, to exaggerate slightly, every input field could be used for SQL injection attacks.

To be fair with PHP of that era, it was possible to create secure websites with it. It's that the ease of use created the illusion that once the website worked, you didn't have to tackle any other portions of development process such as quality control or security.

It was a glorious era.

Re: Vibe code is legacy code

#399

Post by bagacrap »

CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

Doesn't sound like it was worth it to the paying customers/guinea pigs whose data became vulnerable bc your friend said "security? Lol". But I guess that's true of normie-coded startups as well.

Re: Vibe code is legacy code

#400

Post by 71bw »

encom wrote: post #342
JackFr wrote: post #235

Earlier quoted context omitted.

I have a strictly hobby web app that I work on. 6-7 years ago I inadvertently pushed AWS email service credentials to GitHub. Half an hour after the push I got an email and text from GitHub that I had exposed credentials. I quickly logged in to my AWS to turn off the service, to see that AWS had suspended that service because the bounce rate on the 80000 emails sent in that 15 minute period was too high. It was crazy…

Here's an amusing thing to try on anything with SSH exposed. These log files go back a month. # zcat -f /var/log/auth.log* | awk '/sshd/ && /Invalid user/ && $6 != "from" {print $6}' | sort | uniq -c | sort -bnr | head -n 30 5190 #redacted: my domain name 3063 admin 1891 #redacted: another domain name 931 user 724 ubuntu 287 test 268 solv 206 odoo15 200 solana 197 sol 184 ubnt 173 wialon 170 Antminer 169 guest 168 od…

Meanwhile on my publicly available Oracle VPS...

  22307 admin
  19668 user
  15396 ubuntu
   7038 user2
   6954 test
   6375 debian
   3938 ftpuser
   3433 postgres
   3416 oracle
   3076 deploy
   3003 steam
   2917 user1
   2830 dev
   2570 test1
   2352 es
   2187 server
   1957 hadoop
   1680 alex
   1676 guest
   1517 testuser
   1494 sammy
   1392 mysql
   1228 minecraft
   1218 pi
   1184 support
   1148 sysadmin
   1140 ubnt
   1120 from
   1090 123456
   1035 test2
Post reply on HN