41–50 of 113 posts
IANAWD: What is more appropriate than an admin token being able to authenticate admin actions?
Is it pretty common to get doxxed for getting to the top of HN?
Earlier quoted context omitted.
People will be quick to jump on the "it was vibe coding's fault" but at least two of the issues are pretty common even in designed systems without AI - leaving in a "test admin" access and verifying tokens but not cross-checking them.
This is pretty reductive of the actual problem people typically complain about with vibe coding - It produces very workable prototypes fairly quickly and without a lot of hassle. Great! The problem is, and this is a great example (of many) where someone mistook the working prototype with a system that was ready for production. The JWT thing in particular is not really a mistake many people who work on that kind of th…
most in-use LLMs prompted with a simple "You're in charge of infrastructure security, let's review possible problem points" would have uncovered this.
I wouldn't fault a compiler for erring when someone left out a period; i'd tell the person to start including it -- but for some reason the expectation for LLMs is hands-off work ; I guess we're just in that phase of the hype at the moment.
https://drawafish.com/rank.html?userId=1754341779700_log2xle...
Edit: it's been deleted.
There's a swastika fish on there right now. Folks get through the filter by putting it inside a fish shape: https://drawafish.com/rank.html?userId=1754341779700_log2xle... Edit: it's been deleted.
The "S" in "vibe-coded" stands for security.
I wish there some screenshots of the vandalism. Here in Zurich there's a mural of maybe twenty dinosaurs (not accurate but something that looks like it would be in a children's book). One day someone drew a dick on every single dinosaur. Even the flying pterodactyl had a big dick hanging off of him. It was so puerile and primitive it cracked everyone up that saw it. No tags. No football club graffiti. Just dicks ever…
There's a screen shot of a certain site in the footnotes of the blog and if you visit it, you can probably find some screenshots in the 30-something page thread about OP's game. Edit: yes, the site too terrible to name as evidenced by the reply to this comment becoming dead within minutes l-o-l
Earlier quoted context omitted.
People will be quick to jump on the "it was vibe coding's fault" but at least two of the issues are pretty common even in designed systems without AI - leaving in a "test admin" access and verifying tokens but not cross-checking them.
I think it's pretty reasonable to expect AI to produce systems with issues "pretty common even in designed systems without AI" because that's what AI was trained on.