Related: Show HN: Draw a fish and watch it swim with the others - https://news.ycombinator.com/item?id=44719222 - July 2025 (233 comments)
DrawAFish.com Postmortem
aldenhallak.com
DrawAFish.com Postmortem
1–10 of 113 posts
Re: DrawAFish.com Postmortem
#2I was one of the “lucky” few to witness the school of slur-fish.
Being in security I laughed because of how egregious it was but also because I knew someone on HN with some actual time on their hands to help properly would be along soon.
I also appreciate this post mortem. Vibe-coded anything in prod is a lot of my work load in IR these days but it was nice to see such a low stakes project properly documented.
Re: DrawAFish.com Postmortem
#3Wild that some random used a security hole to try and counter the malicious actions actively lol
Re: DrawAFish.com Postmortem
#4Wild that some random used a security hole to try and counter the malicious actions actively lol
this was awesome. people are surprising
Re: DrawAFish.com Postmortem
#5[flagged]
Re: DrawAFish.com Postmortem
#6Wild that some random used a security hole to try and counter the malicious actions actively lol
This has happened a number of times that I remember - one was a worm/exploit that would patch the hole.
Re: DrawAFish.com Postmortem
#7I was one of the “lucky” few to witness the school of slur-fish. Being in security I laughed because of how egregious it was but also because I knew someone on HN with some actual time on their hands to help properly would be along soon. I also appreciate this post mortem. Vibe-coded anything in prod is a lot of my work load in IR these days but it was nice to see such a low stakes project properly documented.
People will be quick to jump on the "it was vibe coding's fault" but at least two of the issues are pretty common even in designed systems without AI - leaving in a "test admin" access and verifying tokens but not cross-checking them.
Re: DrawAFish.com Postmortem
#8Wild that some random used a security hole to try and counter the malicious actions actively lol
I remember reading about 5 or so years ago that the FBI was doing exactly this to counter the EternalBlue exploit (I might be getting the exploit name wrong)
Re: DrawAFish.com Postmortem
#9I am sure someone somewhere works on making LLMs commit code. Aside from that it was great witnessing the site in action and reading the postmortem. I wonder how the "hacker" made the connection to the user acount on neopets.com but maybe they just tried something like "ahallak"?
Re: DrawAFish.com Postmortem
#10On the allure of vide coding the author says,
> It is really fun to just have high velocity, and it is really fun to not do code reviews and to just push stuff.
Was slurfish fun?
Looks like if you don't like doing deep and thorough code reviews, LLM-generated code is not for you.
As the author concludes, "...LLMs are a tool. They let you generate a lot of code really fast...it is up to you to review it"