It's a continuation of the Shai Halud worm and the lack of security around developer dependnecy installations, which has existed for a very long time.
Hackers have figured out that developers themselves are an ideal target due to how easy it is to trick them into installing something and how much private information they have on their machines (creds, cloud clis, mcps, etc.).
You have tools from large corporations where the official installation procedure involves copy pasting a command from a random blog post, run it with sudo and watch it download and execute a script from a random filehost. This is somehow deemed acceptable by everyone involved.
Meanwhile I can't use teams in our meeting rooms, since any form of internet access was deemed a security risk in rooms where customer projects could be discussed. This is in a day and age where 90% of customer meetings are done over the internet.
Anyone trying to follow sane practices in this industry just asks to end up in a padded cell.
By some, not all. It's been crazy from the start and it is still crazy to pipe a script to bash!
Same as it ever was.
I hope this is in jest. Are you saying in order to discuss any customer project you have to book a meeting room? So no discussions of customer projects at the open plan desks or even in your boss' office for fear that something might overhear that conversation? Or is this only when the customer happens to be on-site to discuss their project? Does your organization assign U.S. Military style NICKA code names to everything?
Welp.
Unfortunately, most developers don't like them so it is a though sell.
Edit: I realize in hindsight this comes across as overly negative. I think those are great solutions to have available for when you are working with a suboptimal local setup for whatever reason. I just don't think they're the default choice let alone any sort of ideal to strive for.
You make it sound like you are surprised, but everyone who has tried this knows it's crap and a band aid at best.
I couldn't find anything about it that was even half as good as a real text editor.
It made writing code feel like a chore. I usually love writing code.
I use VSCode/Codium since I maintain a GUI stack for general usage. But I have all the terminal tools installed for my work there as well. I hate customizing things too, which I find is necessary if you want to get the most out of terminal text editors. VSCode is pretty good out of the box, with terminal access and everything built in.
Jeez, I hope this doesn't turn into a text editor flame war...
It doesn't happen in MS Terminal (new Windows Terminal) and it doesn't happen in Tabby (which is also Electron+xterm.js), so it's a recent unique to VS Code bug... and it's annoying to no end for me. I actually rely on the integrated code terminal a lot.
You could argue this is probably on GitHub for creating a token here that gives blanket access to all repos vs a scoped token for just the repo.
Why not set up proper containers (or VMs) locally? And why not wait a little till local LLMs catch up?
Maybe just a personal itch, but having your dev environment elsewhere feels so gross to me..
On the other hand ephemeral cloud environment with proper security controls makes a lot of sense if the goal is to isolate and control.
If everyone was following the protocol we wouldn't have had the problem to begin with.
I am against proprietary SAAS online in browser dependencies.
I personally think the, perhaps confusingly named, capability based security models are the way of The Future.
Gonna be a hard nut to crack to implement this across the supply chain.
Transitive dependencies are a bitch.
Idiots must suffer.
I am not saying vibe coding is the issue. The issue is that a typical developer might be working on a lot more projects that run concurrently then they used to. And because of the various nature of the project the risk is significantly increased.
Scale this across the workforce and you not just doubled the problem.
In the end it can just be a culture thing. A dev who was going to write docs and tests before is going to have a LLM generate docs and tests today. Same with safe practices and defensive coding. The machine does whatever you want from it, for most that's "just get the job done I don't care". So that's the output.
13 million swe roles with .01% is 130,000 compromised devices.
Process problem
In any case, fair enough. The concern is that organizations will build processes around AI where many people do not review outputs carefully. I do not disagree with this.
I also agree that my particular workflow is anecdotal and does not work at scale.
Yes 1%
Yes in our place too. "You better do as much as possible with AI or you will be left behind" dogmas etc.
It's the stupid IoT hype all over again. No concern for security, just trying to be the first in the pack.
https://www.reddit.com/r/BSG/comments/12e31w3/so_i_was_today...
I have used agents for a few components externally, that I've adopted/used internally... but those were 100% code reviewed, not vibe coded. One was an intro animation using a couple SVGs and CSS. Another was an image zoom control where I needed some behaviors and not a lot extra. Both significantly tweaked by hand as well.
I'm more a proponent of working as a gatekeeper as opposed to vibe coding... Though I think a better term would be nice.
Again, I am not saying it is related but I think it has an impact.
Now in many places it is encouraged by coders and managers to vibe stuff on their own devices. Soon or later it will become a problem, especially for those that have no idea what they are doing.
I am not saying it is related but I feel that it coincides perfectly.
I just cannot believe there is no underlaying thread going through all of these recent supply chain issues, and yes there are some hacking groups that specialise in this, sure, but it is because the bounty is plentiful.