Live data from Hacker News

DrawAFish.com Postmortem

aldenhallak.com

51–60 of 113 posts

Re: DrawAFish.com Postmortem

#51
post #40
post #21

Earlier quoted context omitted.

That's actually intentional desgin - I think you can like a fish a little or like a fish a lot, and therefore should be able to upvote/downvote to your hearts content :)

The only potential risk I see with anonymous voting is some 4chaner is apt to create a bunch of fish with horrific names and use distributed IPs to upvote them to the top. I guess regular moderation could filter that out.

Any button a human can touch is a vector for abuse...

Re: DrawAFish.com Postmortem

#52

Earlier quoted context omitted.

I think it's pretty reasonable to expect AI to produce systems with issues "pretty common even in designed systems without AI" because that's what AI was trained on.

But that isn’t the expectation or what is being marketed

Being marketed by who? Be specific.

Re: DrawAFish.com Postmortem

#53
post #25

Great post-mortem, especially since it's a vibe-coded app. Curious if you were inspired by Lego's build-a-fish* exhibit at the Lego House? I visited recently and it is ridiculously addictive to see a fish you create swim with others :) https://www.youtube.com/watch?v=KYs3ne0HCwM

Oh! I hadn't seen this. I was more inspired by the St Louis aquarium (where you color a fish and it swims) and Google's Quickdraw (a memory from like 2016)

TeamLabs also has this in both of their main Tokyo art installations (Borderless & Planets).

Re: DrawAFish.com Postmortem

#54

Earlier quoted context omitted.

I think it's pretty reasonable to expect AI to produce systems with issues "pretty common even in designed systems without AI" because that's what AI was trained on.

But that isn’t the expectation or what is being marketed

I expect these AI and LLM to be, basically, a middle of the bell-curve type producer of code. Just like their other output. Not terrible, not exceptional, just what a Mid could do - only faster.

Not sure what's being marketed, but I expect mediocre.

Re: DrawAFish.com Postmortem

#55
post #52

Earlier quoted context omitted.

But that isn’t the expectation or what is being marketed

Being marketed by who? Be specific.

“Be specific.”

Am I the only one that feels like it’s really condescending when people say this on the internet?

It sounds like something you would see on a community college writing assignment

Re: DrawAFish.com Postmortem

#56

> You may have heard differently, especially if you saw my doxxing[4b] on the unsavory website. Is it pretty common to get doxxed for getting to the top of HN?

It is not.

But if you show HN something... and it makes HN-reading KF users think "OH EXPLOITABLE!!!111!" so they post it to KF... they're basically going to test if your moderation works or not. If you only have some automated rules or even "AI" as the moderation, not humans, then they're very quickly going to work out what gets past your automated filter and what doesn't, faster than 4chan can make Microsoft's Tay say "Hitler did nothing wrong".

Then the KF users will gloat about the slur-ridden fish they've made.

Then KF-reading Sharty users will learn about it, the rest of the Sharty will join in the game.

Then they'll get angry that your "normie" userbase has given a Palestine flag fish named "River to the Sea" the most upvotes, and an Israel flag fish the most downvotes, they'll want to cheat and hack their own creations to the top. So they'll start looking for an admin interface.

When they find one, but find it needs credentials, the first place they'll go looking for password clues is all your socials, all your previous forums, basically your whole identity. And if they hit paydirt, of course they'll post whatever they find, because for them, doxxing people is fun too.

Re: DrawAFish.com Postmortem

#57
Got a killer original idea, got it built, learned a ton, is embarrassed about a few failures because he’s actually a solid professional. Well done, mate. If it didn’t cost you $100k, take down the network or lose you your job, you’re ahead and will laugh in a year.

Re: DrawAFish.com Postmortem

#58
post #3

Wild that some random used a security hole to try and counter the malicious actions actively lol

I remember reading about 5 or so years ago that the FBI was doing exactly this to counter the EternalBlue exploit (I might be getting the exploit name wrong)

I've seen multiple articles where Microsoft does this by taking over C&C domains with court orders

Re: DrawAFish.com Postmortem

#59
post #40
post #21

Earlier quoted context omitted.

That's actually intentional desgin - I think you can like a fish a little or like a fish a lot, and therefore should be able to upvote/downvote to your hearts content :)

The only potential risk I see with anonymous voting is some 4chaner is apt to create a bunch of fish with horrific names and use distributed IPs to upvote them to the top. I guess regular moderation could filter that out.

IP based breaks users with CGNAT and people connecting from corporate networks

In those cases you'd be denied votes since someone else used them up

Re: DrawAFish.com Postmortem

#60
I've noticed with nearly all of these "Vibe Code" security fatalities, they're nearly ALWAYS using Firebase as a backend. I get it, I've used Firebase for a number of enterprise and personal projects, its convenient and easy to setup.

But even before LLM coding, I had team members walk into its numerous footguns - especially around public buckets and bad firestore rules. How many of these stories are really to be blamed on the AI tooling, and how many could be blamed on the very poor default settings of Firebase?

Post reply on HN