6 ms·

Hot on the wheels on the vibe-coded Tea breach. Things are looking great for vibe coding. Don't get me wrong, I have been been more hands off (though not compl

Hot on the wheels on the vibe-coded Tea breach. Things are looking great for vibe coding. Don't get me wrong, I have been been more hands off (though not completely, and very prescriptive) with an SPA side project and it's going great. Claude makes way better looking UIs than my dog ugly developer UIs. But vibing auth? That should seriously count as _legal_ gross negligence.

IanCal 1y ago
Nothing here says auth was vibe coded. It’s a platform for vibe coding.
- loupol 1y ago
  There's also nothing saying they are not dog fooding at least a little bit.
  - bee_rider 1y ago
    I wonder to what extent the vibe coding folks are dogfooding. Their platforms seem too basically work in the sense that they spit out some kind of code, so I guess there must not be too much dogfooding going on.
  - IanCal 1y ago
    There’s nothing saying they didn’t do this deliberately, but it’d still be an unsubstantiated accusation to say that’s why there was a problem with auth.
- JohnMakin 1y ago
  You don’t think they dog food their own app dev? Interesting
  - zahlman 1y ago
    Dogfooding doesn't normally produce artifacts that end up in production, surely?
- zamalek 1y ago
  From the founder himself: https://www.lennysnewsletter.com/p/the-base44-bootstrapped-startup-success-story-maor-shlomo https://www.lennysnewsletter.com/p/the-base44-bootstrapped-s...
_fat_santa 1y ago
I'm not sure I would even call what happened with Tea a breach. They just straight up didn't have any authentication around those endpoints.
belter 1y ago
"Vulnerability discovered in Google Gemini CLI, patch required" - https://www.techzine.eu/news/security/133402/vulnerability-discovered-in-google-gemini-cli-patch-required/ https://www.techzine.eu/news/security/133402/vulnerability-d...
sunaookami 1y ago
The Tea breach was not due to vibe-coding btw, the code was from the beginning of 2024 when vibe coding wasn't even possible.
- ryandrake 1y ago
  Whether it's strictly Vibe Coding™ or traditional coding by an incompetent amateur, the result is the same: defective and vulnerable slop.
  - Sherveen 1y ago
    Oh great, let's just say terms whenever, as long as they are adjacent in meaning to whatever we really mean. SMART!
- dingnuts 1y ago
  By Karpathy's definition it still isn't possible. But I've definitely been hearing about AI generated code being just as good as my code since 2022. Don't gaslight us about timelines. The boosters have been telling us amateurs can code and we're all worthless for three and a half years now. When ChatGPT was launched, they said we'd all be on the streets by now. What I don't understand is the gleeful receipt of that news by some programmers
  - bluefirebrand 1y ago
    > What I don't understand is the gleeful receipt of that news by some programmers I know there are very likely programmers that are gleeful about it, but I suspect that many of the gleeful voices we hear online are not programmers and are resentful of that fact I see this a lot with the type of people who are making AI "artwork". They often lacked the discipline to practice and learn to make art themselves, they seem to bear an underlying resentment to people who do make art. They are the sort of people who think making art is tied to some innate talent and not something that you can practice. Now they are gleeful about AI generators because it lets them create the pictures in their head without the effort of learning a skill, and they are celebrating that they no longer suffer under the tyranny of people who actually enjoy drawing and painting
jerf 1y ago
At the moment, I would call "writing secure code that can be put on the internet" to be a super-human task. That is, even our most highly skilled human beings currently can't be blindly trusted to accomplish it; it requires review by teams of experts. We already don't even trust humans, so trusting AIs for the forseeable future (as much as "the forseeable future" may be contracting on us) is not something we should be doing. And so as to avoid the reader binning this post into "oh just some human triumphalist AI denier", remember I just said I don't trust individual humans on this point either. Everyone, even experts at coding secure code, should be reviewed by other experts at this point. I suspect this is going to prove to be something that LLMs can't do reliably, by their architecture. It's going to be a next-generation AI thing, whatever that may prove to be.
- FiniteIntegral 1y ago
  Agreed. Security is a task that not even a group of humans can perform with upmost scrutiny or perfection. 'Eternal vigilance is the price of liberty' and such. People want to move fast and break things without the backing infrastructure/maintenance (like... actually checking what the AI wrote).
  - runlaszlorun 1y ago
    Ah yes... Move face and break things. Well Facebook didn't overpromise on that one...

IanCal 1y ago

Nothing here says auth was vibe coded. It’s a platform for vibe coding.

loupol 1y ago
There's also nothing saying they are not dog fooding at least a little bit.
- bee_rider 1y ago
  I wonder to what extent the vibe coding folks are dogfooding. Their platforms seem too basically work in the sense that they spit out some kind of code, so I guess there must not be too much dogfooding going on.
- IanCal 1y ago
  There’s nothing saying they didn’t do this deliberately, but it’d still be an unsubstantiated accusation to say that’s why there was a problem with auth.
JohnMakin 1y ago
You don’t think they dog food their own app dev? Interesting
- zahlman 1y ago
  Dogfooding doesn't normally produce artifacts that end up in production, surely?
zamalek 1y ago
From the founder himself: https://www.lennysnewsletter.com/p/the-base44-bootstrapped-startup-success-story-maor-shlomo https://www.lennysnewsletter.com/p/the-base44-bootstrapped-s...

_fat_santa 1y ago

I'm not sure I would even call what happened with Tea a breach. They just straight up didn't have any authentication around those endpoints.

belter 1y ago

"Vulnerability discovered in Google Gemini CLI, patch required" - https://www.techzine.eu/news/security/133402/vulnerability-discovered-in-google-gemini-cli-patch-required/ https://www.techzine.eu/news/security/133402/vulnerability-d...

sunaookami 1y ago

The Tea breach was not due to vibe-coding btw, the code was from the beginning of 2024 when vibe coding wasn't even possible.

ryandrake 1y ago
Whether it's strictly Vibe Coding™ or traditional coding by an incompetent amateur, the result is the same: defective and vulnerable slop.
- Sherveen 1y ago
  Oh great, let's just say terms whenever, as long as they are adjacent in meaning to whatever we really mean. SMART!
dingnuts 1y ago
By Karpathy's definition it still isn't possible. But I've definitely been hearing about AI generated code being just as good as my code since 2022. Don't gaslight us about timelines. The boosters have been telling us amateurs can code and we're all worthless for three and a half years now. When ChatGPT was launched, they said we'd all be on the streets by now. What I don't understand is the gleeful receipt of that news by some programmers
- bluefirebrand 1y ago
  > What I don't understand is the gleeful receipt of that news by some programmers I know there are very likely programmers that are gleeful about it, but I suspect that many of the gleeful voices we hear online are not programmers and are resentful of that fact I see this a lot with the type of people who are making AI "artwork". They often lacked the discipline to practice and learn to make art themselves, they seem to bear an underlying resentment to people who do make art. They are the sort of people who think making art is tied to some innate talent and not something that you can practice. Now they are gleeful about AI generators because it lets them create the pictures in their head without the effort of learning a skill, and they are celebrating that they no longer suffer under the tyranny of people who actually enjoy drawing and painting

jerf 1y ago

At the moment, I would call "writing secure code that can be put on the internet" to be a super-human task. That is, even our most highly skilled human beings currently can't be blindly trusted to accomplish it; it requires review by teams of experts. We already don't even trust humans, so trusting AIs for the forseeable future (as much as "the forseeable future" may be contracting on us) is not something we should be doing. And so as to avoid the reader binning this post into "oh just some human triumphalist AI denier", remember I just said I don't trust individual humans on this point either. Everyone, even experts at coding secure code, should be reviewed by other experts at this point. I suspect this is going to prove to be something that LLMs can't do reliably, by their architecture. It's going to be a next-generation AI thing, whatever that may prove to be.

FiniteIntegral 1y ago
Agreed. Security is a task that not even a group of humans can perform with upmost scrutiny or perfection. 'Eternal vigilance is the price of liberty' and such. People want to move fast and break things without the backing infrastructure/maintenance (like... actually checking what the AI wrote).
- runlaszlorun 1y ago
  Ah yes... Move face and break things. Well Facebook didn't overpromise on that one...