4 ms·
Do you think if the agency hired a consultant to build this , a consultant couldn’t have made the same mistakes? Lack of security theater is a good thing for m
by websap 6mo ago
Do you think if the agency hired a consultant to build this , a consultant couldn’t have made the same mistakes?
Lack of security theater is a good thing for most businesses
- grey-area 6mo agoUsually they would just use an off the shelf product and extend it, so they wouldn’t produce the absolute horror story described in the article, no. I’m not even sure what your last comment means, are you contending that it is a good thing this company violated multiple laws with sensitive patient data?
- trick-or-treat 6mo ago> Usually they would just use an off the shelf product and extend it AI does the same thing an agency or dev would do. Those vibe coding platforms have a template for these things which is usually Vite + React with Supabase for the backend, the same as a dev might use because surprise the LLM trained on the dev's work. OP's point is that you're not guaranteed a good outcome hiring an agency or solo dev either, in fact I would say you're almost guaranteed a bad outcome either way.
- grey-area 6mo agoApparently your assumptions about AI are completely wrong, if you read the article it produced terrible code.
- trick-or-treat 6mo agoRight, because the user provided terrible prompts. A dev / agency wouldn't have done much better.
- ginko 6mo agoThere's lack of security theater and there's: > All "access control" logic lived in the JavaScript on the client side, meaning the data was literally one curl command away from anyone who looked. They are not the same thing.
- voidUpdate 6mo agoIt is physically possible for a consultant to write bad code. But you'd hope that a consultant could understand that medical data is extremely important to keep secure, and actually write it to have some level of security
- trick-or-treat 6mo agoSure, but you'd hope that the LLM could understand that too.
- voidUpdate 6mo agoAnd yet it seems it didn't
- trick-or-treat 6mo agoI'll bet you anything it did. If you ask any recent coding model to do this project is will strongly advise you to give up.
- rightofcourse 6mo agoIt is possible. If you select consulting that you know nothing about, and they know nothing about programming and vibe coded it for you... and maybe you dont even have a contract to held them responsible and maybe they dont really have a company either... Then I can imagine something like this.
- miningape 6mo agoIf a consultant made the same mistakes I'd expect the consultant to be held accountable, not the client business that hired the consultancy - they knew they didn't have the requisite skills and so outsourced to an "expert" (and therefore can't be judged for not knowing how to secure their software since they did everything possible) In this case the "client" is fully liable for the security issues.