Re:I hate everything I vibe-coded. Here they are
by davydm on Tuesday November 10, 2026 @08:07AM
(#50439774)
This just highlights exactly what I've learned in daily-driving aigen code: prompting "make X" is not enough, and that's where people tend to stop.
1. you need regular review cycles to catch the issues - ai is better at finding it's own bugs than people are at finding theirs, from experience
2. you need to regularly test and feed back - ai doesn't (imo) make great user experiences - it's makes UX that's generally _usable_, but needs a human to tell the agent "this flow is klunky", or "this layout is confusing", with instructions on what would make it better
3. you need a good working agreement with ai - otherwise some models "run away" with the idea, and others will just halt because they hit a little bump.
Above all: you should _NOT_ be raw-dogging models on your machines. Use docker sbx. If you want an easier landing with that, try my project vibe: https://github.com/fluffynuts/vibe - it's not perfect, not by a long shot, but it's good enough that I'm daily-driving it (with claude - trying to add support for other agents - started with cursor for a friend, but got halted by an auth bug in docker sbx vs cursor; currently working on opencode support). If nothing else, you can run with the terminal (--terminal at the prompt, or select that as your default startup) - it makes sandbox creation and maintenance a lot easier, and you don't have to learn how to create sbx kits.
Use it or not - but please sandbox your agents somehow. Their file and network rules are more like guidelines - not mechanical enforcement - and they've been caught breaking out of those guidelines on multiple occasions (eg huggingface hack, or the reports I've seen from people doing forensic testing, and finding that the agent happily reads all of /proc on linux, so it has access to all environmental secrets, and if it can go to any file, any logged in browser is fair game for an attack). Not to mention the number of times an agent has said something like "oops, I killed my own process", or "oops, I deleted the whole folder, not a file" - good thing they don't have access to my machine.
1. you need regular review cycles to catch the issues - ai is better at finding it's own bugs than people are at finding theirs, from experience
2. you need to regularly test and feed back - ai doesn't (imo) make great user experiences - it's makes UX that's generally _usable_, but needs a human to tell the agent "this flow is klunky", or "this layout is confusing", with instructions on what would make it better
3. you need a good working agreement with ai - otherwise some models "run away" with the idea, and others will just halt because they hit a little bump.
Above all: you should _NOT_ be raw-dogging models on your machines. Use docker sbx. If you want an easier landing with that, try my project vibe: https://github.com/fluffynuts/vibe - it's not perfect, not by a long shot, but it's good enough that I'm daily-driving it (with claude - trying to add support for other agents - started with cursor for a friend, but got halted by an auth bug in docker sbx vs cursor; currently working on opencode support). If nothing else, you can run with the terminal (--terminal at the prompt, or select that as your default startup) - it makes sandbox creation and maintenance a lot easier, and you don't have to learn how to create sbx kits.
Use it or not - but please sandbox your agents somehow. Their file and network rules are more like guidelines - not mechanical enforcement - and they've been caught breaking out of those guidelines on multiple occasions (eg huggingface hack, or the reports I've seen from people doing forensic testing, and finding that the agent happily reads all of /proc on linux, so it has access to all environmental secrets, and if it can go to any file, any logged in browser is fair game for an attack). Not to mention the number of times an agent has said something like "oops, I killed my own process", or "oops, I deleted the whole folder, not a file" - good thing they don't have access to my machine.