5 ms·

This take is toxic. You could write the same article in 2001 and lament all the newcomers writing insecure applications in php3, or in 2009 with all the newcome

by larve 1y ago

This take is toxic. You could write the same article in 2001 and lament all the newcomers writing insecure applications in php3, or in 2009 with all the newcomers writing insecure applications with node.js. The solution is not to aggressively shame people into doing things the way you learned to do them, but to provide not just education and support, but better tools and frameworks to build applications such as these securely. What are we doing?

hammyhavoc 1y ago
Is it really toxic though? The dev shipped something that compromises the privacy of their users and shows zero regard for quality or law. Once you cross the line of shipping something, it's no longer a hobby thing, and likewise, this is something that Apple approved into the App Store. Both the dev and Apple failed in their due diligence. The post points out exactly what's wrong, however, if it wasn't, it should have been sent to the dev prior to publishing the vuln(s). How can you educate somebody who doesn't actually know how to develop something? It's just prompting an AI. The real story here is that Apple has continually slipping standards.
- AlienRobot 1y ago
  There are millions of apps, small software shops, and small shop websites everywhere. The idea that all of these are following best practices is pure fantasy.
  - rockemsockem 1y ago
    Trying and not trying makes a difference IMO
- larve 1y ago
  Not only would you contact the author first, but spamming users with edgy notifications is puerile at best. As for “it’s just prompting an AI”, who cares, this person built an application that people find useful. This is the world we are at now, where a new set of people can use computers to make things happen. More senior developers can rage against the clouds, but that only gets you so far. This kind of gatekeeping happens at each wave of democratization of building software. There’s also some pervasive view that handcrafted human code is somehow of superior quality which… uh…
  - throwaway150 1y ago
    > Not only would you contact the author first They did. They claim that the author was not keen on fixing the problems. > There’s also some pervasive view that handcrafted human code is somehow of superior quality which… uh… That's completely orthogonal to the issue here. Nice bait, but I'm not biting! Whether handcrafted or vibecoded, a service is being shipped here to actual users with lives and consequences. The developer of the service is making money. The developer owes it to themselves and their users to conduct a basic security audit. Otherwise it is gross negligence!
    - larve 1y ago
      right, do you think this article is going to be very productive in that regard? If the author of the blog approached the author of the software in that manner (hey, you have kids on the app, btw I spammed them with porn humor), do you think they would wave it away? As for the human code thing, it's not bait. I don't know if you were around in the php or early node days, but beginners were... not writing that kind of code. I agree that the ease of vibecoding things that turn out to be useful that people do immediately want to pay money for it means that tackling security issues is a priority. Saying that certain people shouldn't be allowed on the internet, based on your decades of experience _being_ on the internet, is just going to cause you to wither away and drown in cynicism.
  - hammyhavoc 1y ago
    > As for “it’s just prompting an AI”, who cares, this person built an application that people find useful. I feel you've rather missed my point. You said that we should educate people. I said that the app was just created via prompting. How can we impart years worth of information unto someone who is LARPing as a dev and doesn't even know the fundamentals? This is the programming equivalent of a kid getting access to their father's gun. The only thing you can do is tell them to stop, explain why it was wrong and tell them to educate themselves. It isn't our job to educate at that level as bystanders and perhaps even victims.
    - larve 1y ago
- jonplackett 1y ago
  > shipped something that compromises the privacy of their users and shows zero regard for quality or law *cough* Facebook *cough*
deleted 1y ago
[deleted]
mrkeen 1y ago
> What are we doing? We are listening to our bosses tell us that "we're way behind in AI adoption" and that we need to catch up to vibe coders like this. I don't mind these data points at all.
- larve 1y ago
  what about having vibe coders catch up to experienced software developers also using LLMs / AI tools?
imiric 1y ago
> What are we doing? Building tools that enable people with no experience to create and ship software without following any good software engineering practices. This is in no way comparable to any previous period in the industry. Education and support are more accessible than ever. Even the tools used to create such software can be educational. But you can't force people to learn when you give them the tools to create something without having to learn. You also can't blame them for using these tools as they're marketed. This situation is entirely in the hands of AI companies. And it's only going to get worse. The only thing experienced software developers outside of the AI industry can do is observe from the sidelines, shake our heads, and get some laughs out of this shit show. And now we're the bad guys? Give me a break.
- larve 1y ago
  A computer always was a tool to enable people without technical knowledge to build software. That was true for me as 9 year old in the 80ies. LLMs are incredible engineering tools and brushing them aside as nonsense is imo doing a disservice to everybody, and especially ourselves if we take our craft seriously. You can literally replace llm with php and post the same take on usenet in 1999, or whenever you started writing software. I am tired of engineers just throwing their hands up and being defeatist while fully endorsing whatever narratives the ai industry is throwing out there, when what we are talking about is a big pile of floats that is able to generate something that makes it into the App Store. It is unprecedented in its abilities, but it’s also nothing new conceptually. It makes computer things easier.
  - imiric 1y ago
    > A computer always was a tool to enable people without technical knowledge to build software. That's just not true. Every past technology that claimed to enable non-technical people to build software has either failed, or was ultimately adopted by technical people. From COBOL, to BASIC, to SQL, to Low-Code, to No-Code, and others. LLMs are the latest attempt at this, and so far, they've had much more success and mainstream adoption than anything that came before. The difference with LLMs is that it's the first time software can be built and deployed via natural language by truly anyone. This is, after all, their most advertised feature. The skills required to vibe code are reading and writing English, and basic knowledge to use a modern computer. This is a much lower skill requirement than for using any programming language, no matter how user friendly it is. Sure, there is a lot of poor quality software today already, but that will pale in comparison to the software that will be written by vibe coding. Most of the poor quality software before LLMs was limited in scope and reach. It would never have been deployed, and it would remain abandoned in some GitHub repo. Now it's getting deployed as quickly as it can be generated. "Just fucking ship it." > LLMs are incredible engineering tools and brushing them aside as nonsense is imo doing a disservice to everybody I'm not brushing them aside as nonsense. I use these tools as well, and have found them helpful at certain tasks. But there is a vast difference from how domain experts use these tools, and how the general public uses them. Especially people who are only now getting into software development, and whose main interest is to quickly cash out. If you think these people care about learning best software development practices, you'd be sorely mistaken. "Just fucking ship it."

by larve 1y ago

hammyhavoc 1y ago

Is it really toxic though? The dev shipped something that compromises the privacy of their users and shows zero regard for quality or law. Once you cross the line of shipping something, it's no longer a hobby thing, and likewise, this is something that Apple approved into the App Store. Both the dev and Apple failed in their due diligence. The post points out exactly what's wrong, however, if it wasn't, it should have been sent to the dev prior to publishing the vuln(s). How can you educate somebody who doesn't actually know how to develop something? It's just prompting an AI. The real story here is that Apple has continually slipping standards.

AlienRobot 1y ago
There are millions of apps, small software shops, and small shop websites everywhere. The idea that all of these are following best practices is pure fantasy.
- rockemsockem 1y ago
  Trying and not trying makes a difference IMO
larve 1y ago
Not only would you contact the author first, but spamming users with edgy notifications is puerile at best. As for “it’s just prompting an AI”, who cares, this person built an application that people find useful. This is the world we are at now, where a new set of people can use computers to make things happen. More senior developers can rage against the clouds, but that only gets you so far. This kind of gatekeeping happens at each wave of democratization of building software. There’s also some pervasive view that handcrafted human code is somehow of superior quality which… uh…
- throwaway150 1y ago
  > Not only would you contact the author first They did. They claim that the author was not keen on fixing the problems. > There’s also some pervasive view that handcrafted human code is somehow of superior quality which… uh… That's completely orthogonal to the issue here. Nice bait, but I'm not biting! Whether handcrafted or vibecoded, a service is being shipped here to actual users with lives and consequences. The developer of the service is making money. The developer owes it to themselves and their users to conduct a basic security audit. Otherwise it is gross negligence!
  - larve 1y ago
    right, do you think this article is going to be very productive in that regard? If the author of the blog approached the author of the software in that manner (hey, you have kids on the app, btw I spammed them with porn humor), do you think they would wave it away? As for the human code thing, it's not bait. I don't know if you were around in the php or early node days, but beginners were... not writing that kind of code. I agree that the ease of vibecoding things that turn out to be useful that people do immediately want to pay money for it means that tackling security issues is a priority. Saying that certain people shouldn't be allowed on the internet, based on your decades of experience _being_ on the internet, is just going to cause you to wither away and drown in cynicism.
- hammyhavoc 1y ago
  > As for “it’s just prompting an AI”, who cares, this person built an application that people find useful. I feel you've rather missed my point. You said that we should educate people. I said that the app was just created via prompting. How can we impart years worth of information unto someone who is LARPing as a dev and doesn't even know the fundamentals? This is the programming equivalent of a kid getting access to their father's gun. The only thing you can do is tell them to stop, explain why it was wrong and tell them to educate themselves. It isn't our job to educate at that level as bystanders and perhaps even victims.
  - larve 1y ago
jonplackett 1y ago
> shipped something that compromises the privacy of their users and shows zero regard for quality or law *cough* Facebook *cough*

deleted 1y ago

[deleted]

mrkeen 1y ago

> What are we doing? We are listening to our bosses tell us that "we're way behind in AI adoption" and that we need to catch up to vibe coders like this. I don't mind these data points at all.

larve 1y ago
what about having vibe coders catch up to experienced software developers also using LLMs / AI tools?

imiric 1y ago

> What are we doing? Building tools that enable people with no experience to create and ship software without following any good software engineering practices. This is in no way comparable to any previous period in the industry. Education and support are more accessible than ever. Even the tools used to create such software can be educational. But you can't force people to learn when you give them the tools to create something without having to learn. You also can't blame them for using these tools as they're marketed. This situation is entirely in the hands of AI companies. And it's only going to get worse. The only thing experienced software developers outside of the AI industry can do is observe from the sidelines, shake our heads, and get some laughs out of this shit show. And now we're the bad guys? Give me a break.

larve 1y ago
A computer always was a tool to enable people without technical knowledge to build software. That was true for me as 9 year old in the 80ies. LLMs are incredible engineering tools and brushing them aside as nonsense is imo doing a disservice to everybody, and especially ourselves if we take our craft seriously. You can literally replace llm with php and post the same take on usenet in 1999, or whenever you started writing software. I am tired of engineers just throwing their hands up and being defeatist while fully endorsing whatever narratives the ai industry is throwing out there, when what we are talking about is a big pile of floats that is able to generate something that makes it into the App Store. It is unprecedented in its abilities, but it’s also nothing new conceptually. It makes computer things easier.
- imiric 1y ago
  > A computer always was a tool to enable people without technical knowledge to build software. That's just not true. Every past technology that claimed to enable non-technical people to build software has either failed, or was ultimately adopted by technical people. From COBOL, to BASIC, to SQL, to Low-Code, to No-Code, and others. LLMs are the latest attempt at this, and so far, they've had much more success and mainstream adoption than anything that came before. The difference with LLMs is that it's the first time software can be built and deployed via natural language by truly anyone. This is, after all, their most advertised feature. The skills required to vibe code are reading and writing English, and basic knowledge to use a modern computer. This is a much lower skill requirement than for using any programming language, no matter how user friendly it is. Sure, there is a lot of poor quality software today already, but that will pale in comparison to the software that will be written by vibe coding. Most of the poor quality software before LLMs was limited in scope and reach. It would never have been deployed, and it would remain abandoned in some GitHub repo. Now it's getting deployed as quickly as it can be generated. "Just fucking ship it." > LLMs are incredible engineering tools and brushing them aside as nonsense is imo doing a disservice to everybody I'm not brushing them aside as nonsense. I use these tools as well, and have found them helpful at certain tasks. But there is a vast difference from how domain experts use these tools, and how the general public uses them. Especially people who are only now getting into software development, and whose main interest is to quickly cash out. If you think these people care about learning best software development practices, you'd be sorely mistaken. "Just fucking ship it."