4 ms·

Not only would you contact the author first, but spamming users with edgy notifications is puerile at best. As for “it’s just prompting an AI”, who cares, this

by larve 1y ago

Not only would you contact the author first, but spamming users with edgy notifications is puerile at best. As for “it’s just prompting an AI”, who cares, this person built an application that people find useful. This is the world we are at now, where a new set of people can use computers to make things happen. More senior developers can rage against the clouds, but that only gets you so far. This kind of gatekeeping happens at each wave of democratization of building software. There’s also some pervasive view that handcrafted human code is somehow of superior quality which… uh…

throwaway150 1y ago
> Not only would you contact the author first They did. They claim that the author was not keen on fixing the problems. > There’s also some pervasive view that handcrafted human code is somehow of superior quality which… uh… That's completely orthogonal to the issue here. Nice bait, but I'm not biting! Whether handcrafted or vibecoded, a service is being shipped here to actual users with lives and consequences. The developer of the service is making money. The developer owes it to themselves and their users to conduct a basic security audit. Otherwise it is gross negligence!
- larve 1y ago
  right, do you think this article is going to be very productive in that regard? If the author of the blog approached the author of the software in that manner (hey, you have kids on the app, btw I spammed them with porn humor), do you think they would wave it away? As for the human code thing, it's not bait. I don't know if you were around in the php or early node days, but beginners were... not writing that kind of code. I agree that the ease of vibecoding things that turn out to be useful that people do immediately want to pay money for it means that tackling security issues is a priority. Saying that certain people shouldn't be allowed on the internet, based on your decades of experience _being_ on the internet, is just going to cause you to wither away and drown in cynicism.
hammyhavoc 1y ago
> As for “it’s just prompting an AI”, who cares, this person built an application that people find useful. I feel you've rather missed my point. You said that we should educate people. I said that the app was just created via prompting. How can we impart years worth of information unto someone who is LARPing as a dev and doesn't even know the fundamentals? This is the programming equivalent of a kid getting access to their father's gun. The only thing you can do is tell them to stop, explain why it was wrong and tell them to educate themselves. It isn't our job to educate at that level as bystanders and perhaps even victims.
- larve 1y ago
  I feel like it is. What should happen? Everybody born after 2015 is forbidden to use a computer? Or should only be allowed under strict supervision to be typing in code by hand? When people told me that in the nineties, with my linux, putting up shoddy cgi-bins, I just gave them the finger and said "whatever man". The people who made an influence in my life and taught me how to do things properly were those that took me seriously as someone building software. And this person built software, the same way I now build software without having to think about every byte and malloc, and knowing that I don't really have to gaf about how much memory i allocate. It's fine, because we have good GCs and a lot of resources to learn about memory management when things hit the limit. The solution wasn't to say that everybody not programming C or assembly would not be allowed near a computer.
  - cityofdelusion 1y ago
    What should happen? Probably what happened here — disclose and when the developer chooses to ignore it, bring in the shaming and pressure campaign. Someone’s right to tinker and learn doesn’t trump the rights of the victims they are exposing. Releasing code for public consumption has responsibilities and no one is entitled to make money at the expense of others. If I started selling dodgey go karts made from scrap metal to kids it would be the same principle. I am entitled to mess around and even ride it myself, but bringing other people into your orbit of incompetence is another thing.
rockemsockem 1y ago
You didn't read the article so your opinion is void. They spammed their girlfriend's account only which the author had them set up for exactly that purpose.
- larve 1y ago
  fair enough, i missed that part.
  - hammyhavoc 1y ago
    You seem to have missed plenty from that article. Did you use an LLM to summarize it or something?

by larve 1y ago

throwaway150 1y ago

> Not only would you contact the author first They did. They claim that the author was not keen on fixing the problems. > There’s also some pervasive view that handcrafted human code is somehow of superior quality which… uh… That's completely orthogonal to the issue here. Nice bait, but I'm not biting! Whether handcrafted or vibecoded, a service is being shipped here to actual users with lives and consequences. The developer of the service is making money. The developer owes it to themselves and their users to conduct a basic security audit. Otherwise it is gross negligence!

larve 1y ago
right, do you think this article is going to be very productive in that regard? If the author of the blog approached the author of the software in that manner (hey, you have kids on the app, btw I spammed them with porn humor), do you think they would wave it away? As for the human code thing, it's not bait. I don't know if you were around in the php or early node days, but beginners were... not writing that kind of code. I agree that the ease of vibecoding things that turn out to be useful that people do immediately want to pay money for it means that tackling security issues is a priority. Saying that certain people shouldn't be allowed on the internet, based on your decades of experience _being_ on the internet, is just going to cause you to wither away and drown in cynicism.

hammyhavoc 1y ago

> As for “it’s just prompting an AI”, who cares, this person built an application that people find useful. I feel you've rather missed my point. You said that we should educate people. I said that the app was just created via prompting. How can we impart years worth of information unto someone who is LARPing as a dev and doesn't even know the fundamentals? This is the programming equivalent of a kid getting access to their father's gun. The only thing you can do is tell them to stop, explain why it was wrong and tell them to educate themselves. It isn't our job to educate at that level as bystanders and perhaps even victims.

larve 1y ago
I feel like it is. What should happen? Everybody born after 2015 is forbidden to use a computer? Or should only be allowed under strict supervision to be typing in code by hand? When people told me that in the nineties, with my linux, putting up shoddy cgi-bins, I just gave them the finger and said "whatever man". The people who made an influence in my life and taught me how to do things properly were those that took me seriously as someone building software. And this person built software, the same way I now build software without having to think about every byte and malloc, and knowing that I don't really have to gaf about how much memory i allocate. It's fine, because we have good GCs and a lot of resources to learn about memory management when things hit the limit. The solution wasn't to say that everybody not programming C or assembly would not be allowed near a computer.
- cityofdelusion 1y ago
  What should happen? Probably what happened here — disclose and when the developer chooses to ignore it, bring in the shaming and pressure campaign. Someone’s right to tinker and learn doesn’t trump the rights of the victims they are exposing. Releasing code for public consumption has responsibilities and no one is entitled to make money at the expense of others. If I started selling dodgey go karts made from scrap metal to kids it would be the same principle. I am entitled to mess around and even ride it myself, but bringing other people into your orbit of incompetence is another thing.

rockemsockem 1y ago

You didn't read the article so your opinion is void. They spammed their girlfriend's account only which the author had them set up for exactly that purpose.

larve 1y ago
fair enough, i missed that part.
- hammyhavoc 1y ago
  You seem to have missed plenty from that article. Did you use an LLM to summarize it or something?