AI doesn't produce bad software, people do.

It's up to the people involved in the process, to gatekeep AI to not *ship* bad software.

You cannot just turn the saw on (if electric), point it at some wood and expect anything resembling furniture.

AI tools are complex systems that definitely can have agency, even though that is mostly human controlled. Bad controls = bad outcomes.

Yes, I totally agree that humans have the most control over them, but that doesn’t mean it’s completely off the hook.

If we really have to draw simplified real life comparisons, maybe a car or a gun would be more suitable “systems” that we can metaphorically compare AI to.

Does your IDE of choice produce bad software?

Know what changes? The amount of human effort needed to produce increasingly sophisticated software keeps falling. And know what doesn't change? People are still inputting requirements into the machine, testing what comes out, and iterating until it works as they'd like it to. That's the software production process in a nutshell. Doesn't matter if it takes a few thousand iterations over many months, or a single iteration that takes a few hours. It's still people who actually produce software, not the IDE nor the LLM (both of course generate code to help in the production process).

Before LLMs, only incredibly few programs were written by "inputting requirements into the machine", most code was about inputting instructions that fulfill requirements. Usually code is/was related to the requirements, but for anything non-trivial it was almost never a direct translation of the requirements.

So as far as I can see, you're trying to gaslight here.

Few programs were written in the past because the effort required was huge. Can you imagine how long it'd take to correctly code a simple calculator using only 0's and 1's? Or even hexadecimal? And then suddenly it took just a few lines of C. The transformation scale is similar now we can use natural language instead of having to learn a programming language.

> Few programs were written in the past because the effort required was huge.

What are you talking about, who mentioned anything remotely close to this?

The primary reason why programmers are/were needed is because humans and machines speak different languages natively, and someone/something needs to bridge the communication gap. That bridge is done via translating instructions/requirements into the many programming languages we've developed. Now we have LLMs to also do the translation.

> A lot of programs were written in the past

Yes, comprehensively, but also only "recently" (given any 2+ slices of advancement in tools used for software development). Somehow you missed the - I think - very clear "0's and 1's"/"hexadecimal" -> "C" and "programming language" -> "natural language" references.

I understand you perfectly well, I'm just calling out your misrepresentation of these words, because they are very much distinct in our industry, even today. Trying to say differently is simply gaslighting.

"Communication is commonly defined as the transmission of information. [...] A common way to classify communication is by whether information is exchanged between humans, members of other species, or non-living entities such as computers." - https://en.wikipedia.org/wiki/Communication

How did you find the page on communication, but not the one on programming?

What point are you trying to make?

>> AI definitely produces bad software

> Does your IDE of choice produce bad software?

is fundamentally wrong, because your arguments rely on equivocating concepts that have well-defined qualitative differences.

[0]: https://news.ycombinator.com/item?id=50464721

AI makes producing bad software easier.

In particular they offer their owner a high maintenance decaying shelf life, or an explosion.

Of the 2,476 explosions to date, two were used specifically to kill people, some of the others did kill people, although such things were supposedly unintentional.

They have not afforded a better way to make canals, mine in a controlled manner, or fart a starship to space .. although people have desired such affordances.

Always review the code an LLM creates.

(When I told Claude that this is very bad, its reply was “Good catch!”)

It's always up to the skill of the human.

LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart" cousin and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.

But in this case, they seem to have skipped that as well.

If not, company is not viable and will crash badly soon. Market forces and all that.

No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.

git pull [email protected]:allofit/allthethings.git engineering patterns is what created this mess to begin with

I've seen people build great software but fail to evolve it.

All the lessons from agile, clean code, TDD and testable architectures, CI/CD, DevOps are really about building software that can evolve, yet most of those get ignored from time to time due to cost (frequently called time) pressures.

GenAI stresses this loop even more, and no human can effectively deal with the level of output you need to fit in to continue effectively shipping. This can only mean more bugs rather than fewer bugs.

Yes, in a well executed project, LLM agents can bring immediate value and find and fix bugs: because the system has the good feedback loop built in. As soon as you lose that (over shorter time with LLMs than with humans), it starts getting exponentially worse.

And this is all even before you stop and think if you are even building the right thing.

It’s exhausting, but so often, my mush-brain has to concede that it has a point.

On any given day, several hundred decisions in to what I’d imagined would be a sensitive but straightforward spec, I’m keenly tempted to just accept its default judgements…

By now, I’ve encountered the whole of all 3 official bodies’ standards in anger. For sure that’s not the same as real understanding or hard-earned experience. But I sure understand the formalities of the problem space a hell of a lot better than I did when I started this particular vibe coding adventure.

Contrast with my young friend whose approach was “make me a first person shooter, in Los Angeles, I want {some kind of weapon} and cars, make it super polished and fun”. And his follow-ups along the lines of “I don’t care, make it awesome, whatever’s most awesome.” I hate to say he’s holding it wrong (as he did get some sort of Unity/Godot thing out of it), but… does my neuroticism elevate my LLM-hectored coding out of “vibe” territory?

At the very least, if these are indeed different groups of morons, one group is shutting up whenever the other is spewing their flavor of bullshit.

Vibe coding is such an overused term now. Stats say what, 80% of programmers use AI to generate code? 90%? So everything is vibe coded. If you do well, no, it's still engineering. Someone makes a mistake? Cuts a corner somewhere? Vibe coded.

Given the sentiment that software is getting worse, buggier, and overall less stable, that isn't a comforting statement.

I am extremely skeptical that those numbers are even close to accurate.

Or more possibly the person incompetent one.

Because it allows you to produce so much code that it's not viable to carefully review each line/module, and get the benefits of the fast output.

Writing code yourself forces your brain to start creating pathways in your brain and you can verify the correctness of those pathways in your mind (e.g. am I actually doing this right, if I have seen such API would I be happy to use it,...)

Not saying we should write code manually, just showing the differences.

Programmers don't just write code. They also understand why they're writing the code and what it's supposed to do.

On the other hand, people incompetent enough to ship this couldn't have produced a working website if they had to handwrite the code, so in that sense LLMs are at fault.

Whether that says more about me or about LLMs These Days, I’m not sure…

That's vibe coding. So yes, I'm going to blame a process that is essentially no process at all.

I wondered why I did not get email code from them for login. Then it arrive one hour later... Seems like pretty big oversight...

I've been involved in many "rewrites". Almost exclusively, the result is worse for users at release.

Especially with "big bang releases". Where a team is working behind the scenes for months or longer, attempting to rewrite the old system "bug for bug". Releasing and then finding out that some users would "hold the space bar to make the CPU heat up, and configuring emacs to interpret that as 'control'" (XKCD 1172). First, users don't see any improvements for all the time that the new system was being built. Secondly, they get all the new stuff bundled. So while they may even get value from the rewrite, it is bundled with the stuff that makes it worse. Three new features, one new bug. And all everyone sees is that new bug.

But even rewrites where parts are swapped out and released immediately, (strangler vine pattern!) are worse for the users. They do get value fast. And in small increments. They can give feedback early. But the (much longer) period in which the replacements are implemented, is almost always one of confusion, complexity, and "having to learn new things every week". We all know the systems where "change email" is a link that leads to a form on some other site, in an old design rather than part of the "edit account" page. Because the "account service" has been extracted, but the "notification service" replacement on the backlog still.

"rewrites" are almost always for the benefit of the business, the technical team, or other internal reasons. If "benefit to the users" is a part of it, it's almost always secondary: so that we can build and release and scale new features and cool stuff for users faster than with the old legacy spaghetti debt.

You want to do a crime, subtly hint your AI about it.

This is decidedly not a "questionable" decision. I really, really shouldn't be held accountable for the conduct of any company in my ETF portfolio, as I have zero influence on their operations and zero insight into them (beyond what any member of the public has).

What do you suppose those shares you bought are for? "I decided to launder my accountability through a third party" doesn't have quite the same ring to it.

As to insight: a shareholder having information beyond what the public has is called "insider trading", so that's not going to happen. But nothing is stopping you from pushing the board to release more information to the public. At the moment there's little reason to do so as companies being secretive provides a competitive advantage, which is in the shareholder's interest - but that equation would obviously change when that same secrecy exposes the shareholder to risks of unknown size, and when all companies are forced to be transparent it is no longer a competitive disadvantage.

> THEREFORE A COMPUTER MUST NEVER MAKE AN ARTISTIC DECISION

i thought i'd be hearing about downsides?.. elaborate plz

Is this actually illegal in a jurisdiction or against ToS of payment providers and they can get permanently banned from using card payments?

This last month has set my expectation that next month + next month is too many CVE's and I'm plugging the dam hole with my finger.

It was pretty frustrating not being able to download the things I'd paid for.

Without evidence, accusations like this are, ironically, just vibes-based.

I removed the automatic payment process from paypal so at least that's safe, I'd recommend others to do the same at this point.

Cannot wait for some insider to tell us the story of how this came to be

Maybe they should finally change name to Edgy Bundle.

Let me do 2fa when i have to pay not to just login to services i care very little.

And yes blizzard my wow account is not worth anything either.

Plenty of other players would strongly disagree. Blizzard pushes so strongly for 2FA because the support costs associated with people complaining about their WoW accounts getting compromised and drained are massive. If every player were to just shrug and start over from scratch, Blizzard wouldn't have bothered with it.

IIRC it was only via email, which is a PITA. I don't want to switch to my email every time I login.

Nope, it was also the regular time-based ones.

You’d be surprised; a friend of mine had a battle.net account under one of his emails, because apparently his email was used to make a WoW account in college and was banned. He had never played wow before, contacted support, and they didn’t say what happened but revoked the ban

I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.

I doubt you have to fight anything to get there.

Do we blame the bulldozer if it bulldozes the wrong thing? We're just not used to bulldozing yet.

The people who make the bulldozer don't market it as "intelligent."

And yes, I also blame the people getting on that bulldozer, bulldozing like there's no tomorrow. But mainly I blame the first two groups.

That metaphor has been stretched about as far as I can take it, but it's the tools and people getting access to tools they've not been trained on to do tasks they have no prior experience with. As someone who just laid laminate flooring myself for the first time, I'm keenly aware of both having the right tool for the job and the knowledge of how to use it and knowledge of how to do the task in general affects the end product. The mistakes I made are my own, not the cause of the incorrect tools I used at times.

Which is what your parent comment is doing. They didn’t say AI was to blame, they said this wouldn’t have happened without it. It’s likely your fault if you blow up your hands with a firecracker, but it’s also true that it wouldn’t have happened if firecrackers weren’t a thing.

> Do we blame the bulldozer if it bulldozes the wrong thing?

That’s such a tired analogy. By this point it’s honestly hard to believe it is made in good faith.

There isn’t a massive industry with tendrils in every facet of society trying to sell you on autonomous bulldozers that do the bulldozing for you without interaction, is there? Caterpillar is working on autonomous bulldozers, but even those aren’t targeted and advertised at every household as something you have to use.

AI has caused a generational set back on how stakeholders view the value of expertise knowledge, but the gun is still people, AI is just one of the bullets along with things like obsessive cost cutting.

My large orgs entire marketing strategy is now run by an MBA using Claude to generate 'idea and best practice docs'.

The process that lead us to not having a CMO or any other marketing leadership with domain knowledge? Consulting partnerships using MBAs.

The reason we're not changing any strategies even though we're burning money pper CPA? MBAs concerned seeking alignment and having the right narrative to change course.

Thr planned new course? More Claude.

The technology itself is not to blame, but maybe the marketing around it should be. AI coding tools are marketed as magic tools that can somehow spit out perfect solutions even if the input spec is garbage. Of course that is impossible, and no amount of technology can solve that problem unless every AI coding agent is equipped with guardrails that makes it stop if it gets the impression that its user is an idiot.

Thought experiment. A startup is at the end of their runway. Need to show income or go down. Businessmodel is to sell "one off" sales, and vast majority of their accounts buy once or twice (a year or ever).

What if they "accidentally" make it easier for hackers to take over those accounts. Accidentally, as part of a large overhaul or rewrite of their systems. Then, at least for a while, their accounts suddenly "buy" much more products per month or year.

Cynical, I know. But not unthinkable.

If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.

People are rebuilding working things from scratch with AI just because they can.

AI eroded the greenfield advantage of rewriting a project from scratch because a rewrite generally meant that the code went through the fingers of the new developer. With AI that advantage is gone so you are better off incrementally improving the old code base to minimize overall maintenance costs and as a result reduce the headcount needed.

AI lowered the cost of rewriting which means that more shitty systems ship because the rewriters don't run out of money before the rewrite is canceled. But it doesn't the solve the underlying problem of the people in charge of rewriting not understanding what features in the old system were actually important and which had to go.

To save people time, you need to go here: https://dsar.humblebundle.com/

This reminds me a bit of trying to close a patreon account years ago. They said they could only do it if I accept data terms for a 3rd party which would clear my data. Of course I didn't want to give my data to ANOTHER party just to clear my data. I refused many times over and got nowhere. No idea where I could have gone really.

It showed me that they just don't care anymore.

But it still baffles me as to how an LLM could make it this worse, when they already had decent security measures. No top-of-the-line model should've done this. I guess it can only be concluded that they didn't even care to spend some money on SOTA models, even DeepSeek 4.1 Flash, instead turning to the cheaper but also much less capable models to save a few pennies.

You have to click through multiple primary cancel buttons, but the final one cancels the cancellation.

Interestingly, they didn't seem to set up much dark pattern for the cancellation of it - I recorded the automatically reinstated payment in a private rant post, but not a dark pattern in cancellation. To this point I don't really care to conspiracy this into the theory that they knew users who were angry enough to cancel couldn't be stopped, and/or the law might be against a dark cancellation pattern, but no so much as to a pause.

Even if they outsourced to devs that used AI, they are asking for a lawsuit to remove core security safeguards, while rolling old subscription plans onto the new plan in the same rewrite/migration.

With them killing the "classic" it doesn't really matter anymore. Better just to cancel.

Since when are one click payments illegal? Amazon's one-click payment patent expired in 2017

The server at www.humblebundle.com sent back an error: 431 Request Header Fields Too Large

Deleting cookies for the domain might solve it.

https://www.pcgamer.com/gaming-industry/humble-games-layoffs...

This seems to be mostly people who don't know what they are doing? I'd any model would default to requiring this since it's pretty much the default everywhere.

https://www.eurogamer.net/humble-games-confirms-restructurin...

All staff laid off?!

Update: see also https://en.wikipedia.org/wiki/Balor_Games

AI Companies: "AI is now amazing at spotting insecure code"

Implication: If it can spot it, all the code it writes must therefore be secure

Which is funny to anyone that's prompted one to review some code for security problems where that code is something it generated previously.

I've seen a number of companies (and HN contributors) explain that AI produces code that is better than coders. Which, of course, if you actually think about it carefully, doesn't guarantee anything about security, but that's not how executives understand the sentence.

It might have been some internal testing mechanism that's been corrupted. Or if they had an existing hole the AI probably convinced itself that was what was necessary.

That's one of the disadvantages of them hiding the "thinking" output they used to cycle through, sometimes you could spot that happening.

That's still dumber than I've come to expect from LLMs but as others have pointed out, I'm a developer who uses LLMs as a tool, not a manager using a LLM as a developer.

Yeah, I've seen so often the agent just getting rid of tests (either by removing them or by corrupting them) that it stopped being funny a long time ago.

If you ask it to rebuild a site that has x, y and z features, the AI will output an average outcome because it's doing broader implementations. Context and thinking only goes so far unless you have thousands upon thousands to burn in tokens.

1. Boss orders dev to use Claude for everything. Claims proudly "we're AI-native", "we're using an AI factory". Disincentivizes any kind of human review.

2. Dev eventually gives in.

3. Claude makes mistakes.

4. Dev gets blamed, because they're the "human [fuse] in the loop".

Scratch the "management" and replace it with "critical" and we probably have a near universal statement (maybe also add that no sole person should make such decisions).

The problem with vibe coding isn't the AI, it's how people use it. It's that people with no idea of what they're doing, now think they can do what used to require an expert.

To get what tfa is describing, you'd need to explicitly request a dumbed down system, use a really shitty LLM, or both.

Honestly I'd sooner believe this is the result of a highschooler than a LLM.

I've got no problem with people vibe coding a personal project or a prototype or something, but when you've got code in production, that a business depends on, you've got to be a massive idiot to blindly start rewriting it in this way.

Not sure why you couldn't take the "its easy with AI" path and actually refresh the current codebase.

This is hearsay mind you, I don't know how much of their old site is there...

Build and maintain our website. Add features as needed. Rewrite everything as needed. Deploy automatically. Make it compatible. Make it secure. Make it cyber. Make it cloud. Don't make mistakes.

But yeah, you description sounds pretty accurate from the outcome

In general I think it is obvious that logged-in users must need their password to change their email address, and forgot-password users must need access to their email address to change their password.

I would be a little surprised if any coding-focussed AI, frontier or otherwise, didn't offer that by default if not prompted, but I will have to test this now with the local models I use — has anyone else?

But for some reason not everyone agrees re: the first of these.

But it's true. I couldn't login no matter how I tried to do it. The thing is broken.

https://www.humblebundle.com/store

Immediately rotated password and unlinked everything. This is a shit show.

Started additing permission deny to claude instructions helped, however, not 100% fool proof

Regardless of AI use (which like others I do suspect), this needed several more weeks/months to cook before being released, this is atrocious.