News for hackers. Stuff that matters.
Re:Humble Bundle just killed most of their security through ... by solid_fuel on Thursday November 12, 2026 @02:59AM (#50464309)
This perspective on vibe coding is both funny and contradictory. The core issue with vibe coding is that people ship things they don’t understand. To flip it around and blame it on the humans involved only after something goes wrong as if the issue is them vibe-coding “wrong” is foolish. The issue is the vibe coding.
Re:Humble Bundle just killed most of their security through ... by cpa on Thursday November 12, 2026 @03:07AM (#50464356)
It’s never about the tool, but about the responsibility. In humans are those that take responsibility for the tool they use, be it vim or opencode.
Re:Humble Bundle just killed most of their security through ... by somenameforme on Thursday November 12, 2026 @03:09AM (#50464371)
For the vast majority of these issues, certainly including those mentioned here, simply testing before going live would make them beyond clear. So it's simply a bad developer likely working under bad management and, shockingly enough, producing a bad outcome.

LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart" cousin and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.

Re:Humble Bundle just killed most of their security through ... by bonoboTP on Thursday November 12, 2026 @03:24AM (#50464487)
Is it about MBA mantras or simply folks never sticking around in one spot to have long term consequences affect them and their reputations?
Re:Humble Bundle just killed most of their security through ... by _flux on Thursday November 12, 2026 @03:10AM (#50464378)
So as I understand it, vibecoding means (meant?) that you don't look at the code it produces, you case only about the end results, e.g. website through a browser.

But in this case, they seem to have skipped that as well.

Re:Humble Bundle just killed most of their security through ... by enronmusk on Thursday November 12, 2026 @06:21AM (#50465667)
You don't need to look at the code to see that the website is lacking 2FA, a "confirm password" field, etc.
Re:Humble Bundle just killed most of their security through ... by denkmoon on Thursday November 12, 2026 @03:12AM (#50464390)
[delayed]
Re:Humble Bundle just killed most of their security through ... by eddythompson80 on Thursday November 12, 2026 @03:26AM (#50464497)
Exactly, there were always shitty software teams. We should all strive to be that one day.
Re:Humble Bundle just killed most of their security through ... by kakacik on Thursday November 12, 2026 @03:23AM (#50464476)
Vibe coding is just a really big hammer, what you do with it and what you do with results is still up to humans. Even if this was result of it, fuckup is ultimately fully in hands of somebody responsible (for product, website, clients etc).

If not, company is not viable and will crash badly soon. Market forces and all that.

Re:Humble Bundle just killed most of their security through ... by p00ki3 on Thursday November 12, 2026 @03:37AM (#50464565)
If I had a dollar for every RoR coder who didn't understand the internals of the interpreter I would still not be richer than Musk because there are not that many coders.

No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.

git pull [email protected]:allofit/allthethings.git engineering patterns is what created this mess to begin with

Re:Humble Bundle just killed most of their security through ... by necovek on Thursday November 12, 2026 @03:56AM (#50464714)
Software is hard. But especially, evolving software over many years is hard.

I've seen people build great software but fail to evolve it.

All the lessons from agile, clean code, TDD and testable architectures, CI/CD, DevOps are really about building software that can evolve, yet most of those get ignored from time to time due to cost (frequently called time) pressures.

GenAI stresses this loop even more, and no human can effectively deal with the level of output you need to fit in to continue effectively shipping. This can only mean more bugs rather than fewer bugs.

Yes, in a well executed project, LLM agents can bring immediate value and find and fix bugs: because the system has the good feedback loop built in. As soon as you lose that (over shorter time with LLMs than with humans), it starts getting exponentially worse.

And this is all even before you stop and think if you are even building the right thing.

Re:Humble Bundle just killed most of their security through ... by alwa on Thursday November 12, 2026 @04:06AM (#50464777)
I have noticed that the code harness is extremely willing to run me into extreme levels of decisionmaking detail if I ask it to defer substantive decisions to me. And then, for each answer, it’s happy to dispatch (token-gobbling, but often insightful) subagents to study the repercussions and argue back with me. To nitpick intersections between my decisions, my stated core principles, and the standing rules for the project. And to point me at standards to fill in the gaps in my understanding.

It’s exhausting, but so often, my mush-brain has to concede that it has a point.

On any given day, several hundred decisions in to what I’d imagined would be a sensitive but straightforward spec, I’m keenly tempted to just accept its default judgements…

By now, I’ve encountered the whole of all 3 official bodies’ standards in anger. For sure that’s not the same as real understanding or hard-earned experience. But I sure understand the formalities of the problem space a hell of a lot better than I did when I started this particular vibe coding adventure.

Contrast with my young friend whose approach was “make me a first person shooter, in Los Angeles, I want {some kind of weapon} and cars, make it super polished and fun”. And his follow-ups along the lines of “I don’t care, make it awesome, whatever’s most awesome.” I hate to say he’s holding it wrong (as he did get some sort of Unity/Godot thing out of it), but… does my neuroticism elevate my LLM-hectored coding out of “vibe” territory?

Re:Humble Bundle just killed most of their security through ... by skeledrew on Thursday November 12, 2026 @04:09AM (#50464808)
Vibe-coding is a skill (like tying shoelaces), not a tool. And there's always room for improvement.
Re:Humble Bundle just killed most of their security through ... by boomlinde on Thursday November 12, 2026 @02:53PM (#50473226)
I'm sure it's both different groups of morons, but the constant shifting back and forth between "if you're reading code in 2026 you're wasting time" and "you wouldn't blame a hammer if you hit your thumb" is absolutely hilarious. LLMs are either a simple tool or a hyper-intelligent system depending on which characterization is anticipated to sell the most snake oil in any given instance.

At the very least, if these are indeed different groups of morons, one group is shutting up whenever the other is spewing their flavor of bullshit.