4 ms·

Great effort, thanks for that. But do we still trust the open source software that is created now everything is vibe coded? Recently there was a thread about

by frevib 2mo ago

Great effort, thanks for that. But do we still trust the open source software that is created now everything is vibe coded? Recently there was a thread about Chatto [1], a Slack replacement completely vibe coded by one person. It works and looks nice. But looking at the code, I wouldn’t trust any of my personal information to it. It’s just tousands of lines of skills and vague instructions. It seems that trust in OSS is eroding and big SaaS might win here because they have the reputation. [1] https://github.com/chattocorp/chatto https://github.com/chattocorp/chatto

movedx 2mo ago
Code is simply math. It either works or it does not. Does your calculator work? Then use it. Does your AI agent of choice produce code that works? Then use it. Or don't. It's up to you. You're as free to walk away as you are to embrace what's been made here.
- Citizen_Lame 2mo ago
  Not really, something can work and be full of security holes.
- _under_scores_ 2mo ago
  This is a bit of an uncharitable take. "It either works or it does not" is an oversimplification when you consider that code often doesn't work in the way it was intended - that's what bugs are. Are vibe coded apps inherently more buggy? Not necessarily. But the I'd argue there's more surface in a vibe coded app that requires blind trust.
- dgellow 2mo ago
  Math isn’t known to rm -rf your drive or exfiltrate your private keys and secrets
- whstl 2mo ago
  This is dangerous advice on so many levels. “Is math” and “Either works or not” is only true with formal specifications and formal verification, which dwarfs the cost of producing said software.
- vccvxvccvvxc 2mo ago
  Code is, but running application aren't "math". They have side effects - like uploading your private keys to hostile servers - which "math" conveniently ignores.
- istoleabread 2mo ago
  > It either works or it does not. It also matters how it works.
ruuda 2mo ago
What makes you think big SaaS is not vibecoded?
- maybewhenthesun 2mo ago
  What makes you think we trust big SaaS :-P
- deleted 2mo ago
  [deleted]
make_it_sure 2mo ago
write code by hand then
miguelbemartin 2mo ago
I believe it varies; since it's merely a productivity tool, why not use it? However, if it's essential software that your business relies on, probably not.
realharo 2mo ago
On the other hand, it's also much less effort to do at least some rudimentary review. Or make a fork with only the minimim set of parts that your agent cherry picks.
zmmmmm 2mo ago
> But do we still trust the open source software that is created now everything is vibe coded? I guess my question is, why would you trust it when it is not vibe coded? My suggestion is, have an AI review the code for you.
xaitv 2mo ago
I judge it on a case-by-case basis by just looking at a few recent commits and the feel of clicking a few files in the repo. For OpenLogi I get the wrong type of vibe code vibes and at the very least that means the project might become an unmaintainable mess in a year and that means I don't want to come to rely on it. At worst it means security vulnerabilities. That being said: I wouldn't really trust SaaS to not be vibe-coded either. The only difference there is that SaaS likely has a financial incentive to stay maintainable so you could argue that helps.
- runsonrum 2mo ago
  Yeah but imagine how much more powerful AI will be by then. Command it to refactor it's sloppy code.
  - idbnstra 2mo ago
    yeah just create a fork, problem solved
m00dy 2mo ago
great effort ? bro just sniff the traffic and feed into Claude.
xlii 2mo ago
> But do we still trust the open source software that is created now everything is vibe coded? If I think tool/software would be useful I throw GLM 5.2 (now 5.3) at it and ask to do an audit ;-)
Ikatza 2mo ago
I don't see the issue. The beauty of OSS is that you can audit the code yourself and evaluate it according to your standards. Do you trust all OSS repos coded before 2024? AI-generated code is no different than code written by a human with different levels of seniority, different levels of focus, or different levels of discipline. A human is perfectly capable of generating spaghetti code too.
midtake 2mo ago
So you trusted 22-year-old coffee junkies copying and pasting from stack overflow 10 years ago but when a language model does it it's suddenly offensive? We should be instead celebrating how we have a mini software company at our fingertips ready to fix the broken hobbyist shit we've never had time for. OpenLogi is a perfect example of this use case and that it's open source makes it more trustworthy not less. Now if only there was one for Razer.
- tgv 2mo ago
  I don't think stackoverflow contains code to integrate a keylogger in a mouse driver. Copy-paste isn't that bad. Most of the (coding) LLMs however probably do know how to do that. They enable script kiddies to make more dangerous tools. So yes, vibe coding is a danger.
  - palata 2mo ago
    > So yes, vibe coding is a danger. Running code is dangerous. I don't really see how its provenance matters: you should not run code you don't trust, period.
    - velox_neb 2mo ago
      > you should not run code you don't trust, period. This reduces to "you should not use a computer, period." No-one can audit all the code they run daily.
      - palata 2mo ago
        Where did I say you should audit all the code you run daily? Not sure if you're being manipulative on purpose or if you genuinely did not understand my point. I was talking about "trust", which is a whole concept in itself.
        monsieurbanana 2mo ago
        I understood your comment the same way as the guy you're replying to. Maybe it'll help if you expand on whether we can trust vibe coded software? That's really the crux of the issue, and if you're not addressing that your comment is just a truism
matheusmoreira 2mo ago
Ask your AI of choice to audit the codebase.
- vccvxvccvvxc 2mo ago
  This is an underappreciated possibility that opened up. It now becomes at least viable to thoroughly inspect large code bases. It's not easy and never will be, but now we're not limited to the amound of literal eyeballs available.
  - matheusmoreira 2mo ago
    Indeed. I've been doing it a lot. Be careful of prompt injection. Some people think nothing of adding harmful instructions to their repositories. Sol and Opus seem to be smart enough not to fall for it, but I don't know about other models.
palata 2mo ago
You shouldn't trust open source software because it is open source. You should trust open source software because it has been audited, and only when it has been audited by people you trust (it may be yourself). Whether it's vibe-coded or not doesn't change that. If it is vibe-coded and unreadable, how is it different from manually-written and unreadable? If it is vibe-coded and readable, how is it different from manually-written and readable? Judge the code by its quality, not by its provenance.
qiine 2mo ago
> because they have the reputation. reputation of what? sucking your soul dry?
parkersweb 2mo ago
If I was going to make a keylogger this is pretty much how I'd do it - no need to sneak an application onto a user's machine to capture keystrokes when they'd willingly install it because it's better than the terrible official software. I hate Options+ as much as the next guy - but don't have the time / technical knowledge to audit thoroughly enough to establish trust in this. I'm nearing the replacement point on my current MX Master - so is there a better alternative to Logitech?
matula 2mo ago
I did a random spot-check of some of the code, like https://github.com/AprilNEA/OpenLogi/blob/master/crates/openlogi-agent/src/main.rs https://github.com/AprilNEA/OpenLogi/blob/master/crates/open... and it seems... fine? SO MANY comments, but that seems pretty standard for LLM code these days.
mbesto 2mo ago
> It seems that trust in OSS is eroding and big SaaS might win here because they have the reputation. Yes because everyone trusts what SalesForce is doing with their data..
TSiege 2mo ago
It's never been easier to audit open source code than now. Why not just have a model examine it for you?
otterley 2mo ago
> But do we still trust the open source software that is created now everything is vibe coded? The provenance of the code matters insofar as how much you should initially trust it, but the fact that it's open source means it's still verifiable. The increase in productivity that AI has unlocked means there is now much more output to verify.
abustamam 2mo ago
> big SaaS might win here because they have the reputation. Big SAAS is doing the same thing at scale. One would hope they put a bit more diligence in it but we know that's not the case.
hendrikmans 1mo ago
Hi, I'm the Chatto maintainer. What issues did you find with the source code?

by frevib 2mo ago

movedx 2mo ago

Code is simply math. It either works or it does not. Does your calculator work? Then use it. Does your AI agent of choice produce code that works? Then use it. Or don't. It's up to you. You're as free to walk away as you are to embrace what's been made here.

Citizen_Lame 2mo ago
Not really, something can work and be full of security holes.
_under_scores_ 2mo ago
This is a bit of an uncharitable take. "It either works or it does not" is an oversimplification when you consider that code often doesn't work in the way it was intended - that's what bugs are. Are vibe coded apps inherently more buggy? Not necessarily. But the I'd argue there's more surface in a vibe coded app that requires blind trust.
dgellow 2mo ago
Math isn’t known to rm -rf your drive or exfiltrate your private keys and secrets
whstl 2mo ago
This is dangerous advice on so many levels. “Is math” and “Either works or not” is only true with formal specifications and formal verification, which dwarfs the cost of producing said software.
vccvxvccvvxc 2mo ago
Code is, but running application aren't "math". They have side effects - like uploading your private keys to hostile servers - which "math" conveniently ignores.
istoleabread 2mo ago
> It either works or it does not. It also matters how it works.

ruuda 2mo ago

What makes you think big SaaS is not vibecoded?

maybewhenthesun 2mo ago
What makes you think we trust big SaaS :-P
deleted 2mo ago
[deleted]

make_it_sure 2mo ago

write code by hand then

miguelbemartin 2mo ago

I believe it varies; since it's merely a productivity tool, why not use it? However, if it's essential software that your business relies on, probably not.

realharo 2mo ago

On the other hand, it's also much less effort to do at least some rudimentary review. Or make a fork with only the minimim set of parts that your agent cherry picks.

zmmmmm 2mo ago

> But do we still trust the open source software that is created now everything is vibe coded? I guess my question is, why would you trust it when it is not vibe coded? My suggestion is, have an AI review the code for you.

xaitv 2mo ago

I judge it on a case-by-case basis by just looking at a few recent commits and the feel of clicking a few files in the repo. For OpenLogi I get the wrong type of vibe code vibes and at the very least that means the project might become an unmaintainable mess in a year and that means I don't want to come to rely on it. At worst it means security vulnerabilities. That being said: I wouldn't really trust SaaS to not be vibe-coded either. The only difference there is that SaaS likely has a financial incentive to stay maintainable so you could argue that helps.

runsonrum 2mo ago
Yeah but imagine how much more powerful AI will be by then. Command it to refactor it's sloppy code.
- idbnstra 2mo ago
  yeah just create a fork, problem solved

m00dy 2mo ago

great effort ? bro just sniff the traffic and feed into Claude.

xlii 2mo ago

> But do we still trust the open source software that is created now everything is vibe coded? If I think tool/software would be useful I throw GLM 5.2 (now 5.3) at it and ask to do an audit ;-)

Ikatza 2mo ago

I don't see the issue. The beauty of OSS is that you can audit the code yourself and evaluate it according to your standards. Do you trust all OSS repos coded before 2024? AI-generated code is no different than code written by a human with different levels of seniority, different levels of focus, or different levels of discipline. A human is perfectly capable of generating spaghetti code too.

midtake 2mo ago

So you trusted 22-year-old coffee junkies copying and pasting from stack overflow 10 years ago but when a language model does it it's suddenly offensive? We should be instead celebrating how we have a mini software company at our fingertips ready to fix the broken hobbyist shit we've never had time for. OpenLogi is a perfect example of this use case and that it's open source makes it more trustworthy not less. Now if only there was one for Razer.

tgv 2mo ago
I don't think stackoverflow contains code to integrate a keylogger in a mouse driver. Copy-paste isn't that bad. Most of the (coding) LLMs however probably do know how to do that. They enable script kiddies to make more dangerous tools. So yes, vibe coding is a danger.
- palata 2mo ago
  > So yes, vibe coding is a danger. Running code is dangerous. I don't really see how its provenance matters: you should not run code you don't trust, period.
  - velox_neb 2mo ago
    > you should not run code you don't trust, period. This reduces to "you should not use a computer, period." No-one can audit all the code they run daily.
    - palata 2mo ago
      Where did I say you should audit all the code you run daily? Not sure if you're being manipulative on purpose or if you genuinely did not understand my point. I was talking about "trust", which is a whole concept in itself.
      - monsieurbanana 2mo ago
        I understood your comment the same way as the guy you're replying to. Maybe it'll help if you expand on whether we can trust vibe coded software? That's really the crux of the issue, and if you're not addressing that your comment is just a truism

matheusmoreira 2mo ago

Ask your AI of choice to audit the codebase.

vccvxvccvvxc 2mo ago
This is an underappreciated possibility that opened up. It now becomes at least viable to thoroughly inspect large code bases. It's not easy and never will be, but now we're not limited to the amound of literal eyeballs available.
- matheusmoreira 2mo ago
  Indeed. I've been doing it a lot. Be careful of prompt injection. Some people think nothing of adding harmful instructions to their repositories. Sol and Opus seem to be smart enough not to fall for it, but I don't know about other models.

palata 2mo ago

You shouldn't trust open source software because it is open source. You should trust open source software because it has been audited, and only when it has been audited by people you trust (it may be yourself). Whether it's vibe-coded or not doesn't change that. If it is vibe-coded and unreadable, how is it different from manually-written and unreadable? If it is vibe-coded and readable, how is it different from manually-written and readable? Judge the code by its quality, not by its provenance.

qiine 2mo ago

> because they have the reputation. reputation of what? sucking your soul dry?

parkersweb 2mo ago

If I was going to make a keylogger this is pretty much how I'd do it - no need to sneak an application onto a user's machine to capture keystrokes when they'd willingly install it because it's better than the terrible official software. I hate Options+ as much as the next guy - but don't have the time / technical knowledge to audit thoroughly enough to establish trust in this. I'm nearing the replacement point on my current MX Master - so is there a better alternative to Logitech?

matula 2mo ago

I did a random spot-check of some of the code, like https://github.com/AprilNEA/OpenLogi/blob/master/crates/openlogi-agent/src/main.rs https://github.com/AprilNEA/OpenLogi/blob/master/crates/open... and it seems... fine? SO MANY comments, but that seems pretty standard for LLM code these days.

mbesto 2mo ago

> It seems that trust in OSS is eroding and big SaaS might win here because they have the reputation. Yes because everyone trusts what SalesForce is doing with their data..

TSiege 2mo ago

It's never been easier to audit open source code than now. Why not just have a model examine it for you?

otterley 2mo ago

> But do we still trust the open source software that is created now everything is vibe coded? The provenance of the code matters insofar as how much you should initially trust it, but the fact that it's open source means it's still verifiable. The increase in productivity that AI has unlocked means there is now much more output to verify.

abustamam 2mo ago

> big SaaS might win here because they have the reputation. Big SAAS is doing the same thing at scale. One would hope they put a bit more diligence in it but we know that's not the case.

hendrikmans 1mo ago

Hi, I'm the Chatto maintainer. What issues did you find with the source code?