Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vibe code is legacy code

blog.val.town

Post reply on HN
Print view View original

431–440 of 473 posts

Re: Vibe code is legacy code

#431

Post by parliament32 »

doesnt_know wrote: post #119
CharlieDigital wrote: post #67

A story about a non-technical friend: friend vibe coded a SaaS last year and started generating revenue with almost no marketing; all word of mouth and inbound in a niche industry. Used Replit and Supabase to build the thing; I am still really impressed by what he was able to do given how complex the app ended up becoming as he interacted with customers. What I think happened: there are two incumbents in this space t…

The fact your friend is suffering no consequences and is able to just carry on is exactly what is wrong with this industry. In a perfect world the creation of software would have been locked down like other engineering fields, with developers and companies suffering legal consequences for exposing customer information.

...and this is where compliance comes in, and is the exact reason real companies won't talk to you unless you have (at minimum) SOC2. There's billions of products out there, how do you know if it's actually good software developed by a team, or some idiot like above vibe-coding slop into what appears to be a functional application? We all make fun of audits and checklist-based-security but it would've almost certainly prevented the above from happening.

Re: Vibe code is legacy code

#432

Post by dneighbo »

I think the real risk isn't AI-generated technical debt, but the opportunity cost of not adapting fast enough.

The engineers I see thriving aren't those maintaining perfect understanding of every line, they're developing what I call "the adaptation advantage": knowing when to dig deep vs. when to trust the process and iterate.

This connects to a broader pattern I've been exploring, AI is creating a skill gap between those who see it as amplifying capabilities vs. those who see it as threatening their identity. https://www.derekneighbors.com/series/ai-excellence-gap/

The "vibe code" concern is valid for maintainability, but we might be optimizing for the wrong risk.

Re: Vibe code is legacy code

#434

Post by galaxyLogic »

ehnto wrote: post #285
galaxyLogic wrote: post #280

That is a great insight, AI code is like legacy code, which is "legacy" because it was written long time ago and hasn't been worked on by anybody, so nobody knows and it is hard to learn how the code does its thing. But so why couldn't AI-generated code be maintained by AI? Why couldn't AI in general be used to fix and evolve legacy code?

My two insights are: Legacy code is difficult to work with because the reasons "why" something has to be some way are missing. The "whys" can change over time, be interwoven with business requirements not in the codebase, and compound/nest with other whys that have come and gone. Often only humans in the business know, and you have to figure out who and what to ask. Second insight is that LLMs have so far been very b…

Good point. Whys are lost because whys are often never written down. World around us always changes, so the whys change too.

This may have something to so with the AI "frame-problem".We can't document all "whys" in the current "frame" because they depend on other "frames" like the current legislation. We don't write down "this will work because ..." . We just assume it, and asume many other causally related things.

In other wrods it would very hard or impossible to document "what must not change" for our system to continue to be useful. For instance Sun must still exist and air must be breathable for this system to be useful.

Re: Vibe code is legacy code

#435

Post by omgwalt »

The problem I have with this post is that it equates vibe coding with stupidity. You don't have to be stupid to be a vibe coder, and you can actually do things smarter than a traditional coder ... if you take the time to learn how to do it. His mistake wasn't being a vibe coder. His mistake was in not learning the proper way to connect it via API and failing to use tools to check the security.

Re: Vibe code is legacy code

#436

Post by bagacrap »

CharlieDigital wrote: post #430
NoGravitas wrote: post #418

Earlier quoted context omitted.

> I've learned that there's only one thing that matters: solving valuable problems and getting that in front of customers. To quote another recent article: That is to say, it turns out that the core competency of smiling and promising people things that you can't actually deliver is highly transferable.

He's already delivery it and they already see the value in it though?

All your replies in this thread make sense only if you see zero value in security. Security is not about being "technically pristine".

Re: Vibe code is legacy code

#437

Post by exe34 »

eddythompson80 wrote: post #120
WD-42 wrote: post #110

Earlier quoted context omitted.

I would not default to assuming it was his competitors, that sounds like scapegoating to deflect responsibility. What most likely happened is his site was scanned by one of the increasingly sophisticated exploit crawlers (anyone who runs an internet facing site and can view traffic knows what I'm talking about). His site got flagged as vulnerable, the hacker found out it was built like swiss cheese and had fun with i…

Who else would spend the time and effort to figure out you leaked your stipe key to your front end? Sure people have bots to do that, but it’s kinda unbelievable someone would run such a bot on their vibe coded website.

The thing about bots is that it costs almost nothing to run them against millions of sites every day. It's got nothing with "but what are the odds?!", at large enough scale, unlikely things happen all the time.

Re: Vibe code is legacy code

#438

Post by sysmax »

danielbln wrote: post #314
sysmax wrote: post #241

There's a pretty good sweet spot in between vibe coding and manual coding. You still think out all the classes, algorithms, complexities in your head, but then instead of writing code by hand, use short prompts like "encapsulate X and Y in a nested class + create a dictionary where key is A+B". This saves a ton of repetitive manual work, while the results are pretty indistinguishable from doing all the legwork yourse…

I'm still finding the right sweet spot personally. I would love to only think in architecture, features and interfaces and algorithms, and leave the class and function design fully to the LLM. At this point this almost works, but requires handholding and some retroactive cleanup. I still do it because it's necessary, but I grow increasingly tired of having to think to close to the code level, as I see it more and mor…

Most of the AI hiccups come from the sequential nature of generating responses. It gets to a spot where adhering to code structure means token X, and fulfilling some common sense requirement means token Y, so it picks X and the rest of the reply is screwed.

You can get way better results with incremental refinement. Refine brief prompt into detailed description. Refine description into requirements. Refine requirements into specific steps. Refine steps into modified code.

I am currently experimenting with several GUI options for this workflow. Feel free to reach out to me if you want to try it out.

Re: Vibe code is legacy code

#439

Post by exe34 »

SecretDreams wrote: post #409
_Algernon_ wrote: post #340

Earlier quoted context omitted.

Being in the possession of a password or key implies having permission to use that key. When generating a key you give everyone with access to that key the permission to use it to perform actions on your account. Protect your keys.

> Being in the possession of a password or key implies having permission to use that key So if I get your house key I can use your bathroom? Seriously, what hill are you trying to die on here?

Depends - did I hand it out at the street corner?

Re: Vibe code is legacy code

#440

Post by api »

majormajor wrote: post #227
api wrote: post #197

Earlier quoted context omitted.

In that world we’d just be transitioning to 32-bit software and still running MS-DOS since it’s certified. Linux would never ever have broken through. Who can trust code developed by open source cowboys? Have we verified all their credentials? There are some industries where the massive cost of this type of lock down — probably innovation at 1/10th the speed at 100X the cost — is needed. Medicine comes to mind. It’s…

You, of course, say that like it's a bad thing. I'll say video games would certainly be worse. I don't know if we'd be worse off with a lot of other software and/or public internet sites of 20-to-30 years ago. A lot of people are unhappy with the state of modern consumer software, ad surveillance, etc. Probably a lot less identity theft and credit card/banking fraud. For social media, it depends on if that "regulate…

A lot of the things people are upset about are not related to this issue and not something licensing engineers would fix. They're products of things like market incentives.

What you're really talking about when you talk about "locking down the field" is skipping or suppressing the PC revolution. That would make things like opaqueness and surveillance worse, not better. There would be nothing but SaaS and dumb terminals at the endpoint and no large base of autodidact hacker types to understand what is happening.

I have wondered if medicine wouldn't be a lot more advanced without regulation, but I tend to think no. I think we have the AB test there. There are many countries with little medical regulation (or where it is sparsely enforced) and they do not export sci-fi transhumanist medical tech. They are at best no better than what more regulated domains have. Like I said, I think many things about medicine are very different from software. They're very different industries with very different incentives, problem domain characteristics, and ethical constraints. The biggest difference, other than ethics, is that autodidactism is easy in software and almost impossible in medicine, for deep complicated practical as well as ethical reasons.

For software we do have the AB test. More conservative software markets and jurisdictions are vastly slower than less conservative ones.

Post reply on HN