It is the fault of vibe coding, the sell has consistently been AI solves all of this. Clearly someone somewhere has to know what the system should or shouldn't do.

No? I have heard literally nobody say that AI guarantees insecure code will never be written again.

They do it by implication:

AI Companies: "AI is now amazing at spotting insecure code"

Implication: If it can spot it, all the code it writes must therefore be secure

> Implication: If it can spot it, all the code it writes must therefore be secure

Which is funny to anyone that's prompted one to review some code for security problems where that code is something it generated previously.

[delayed]

Erm.

I've seen a number of companies (and HN contributors) explain that AI produces code that is better than coders. Which, of course, if you actually think about it carefully, doesn't guarantee anything about security, but that's not how executives understand the sentence.

[delayed]

AI loves copying existing patterns in legacy code without asking, even if they're super-dumb. It's like it reads bad code and that anchors the pattern in its thinking.

It might have been some internal testing mechanism that's been corrupted. Or if they had an existing hole the AI probably convinced itself that was what was necessary.

That's one of the disadvantages of them hiding the "thinking" output they used to cycle through, sometimes you could spot that happening.

Yeah, not a bad shout.

That's still dumber than I've come to expect from LLMs but as others have pointed out, I'm a developer who uses LLMs as a tool, not a manager using a LLM as a developer.

> It might have been some internal testing mechanism that's been corrupted.

Yeah, I've seen so often the agent just getting rid of tests (either by removing them or by corrupting them) that it stopped being funny a long time ago.

But you have asked for something specific. An authentication system.

If you ask it to rebuild a site that has x, y and z features, the AI will output an average outcome because it's doing broader implementations. Context and thinking only goes so far unless you have thousands upon thousands to burn in tokens.

The scope of the Humble site feels like 2 free months of Copilot. I've done more with less.

I suspect LLMs are going to be used as convenient scapegoats for the foreseeable future. "Boss, I didn't fuck up, Claude did."

"And who used Claude on it? You did? Well..."

Might be worse.

1. Boss orders dev to use Claude for everything. Claims proudly "we're AI-native", "we're using an AI factory". Disincentivizes any kind of human review.

2. Dev eventually gives in.

3. Claude makes mistakes.

4. Dev gets blamed, because they're the "human [fuse] in the loop".

"A computer can never be held accountable, therefore a computer must never make a management decision." - IBM slide deck, 1979

Scratch the "management" and replace it with "critical" and we probably have a near universal statement (maybe also add that no sole person should make such decisions).

My read was that they didn't test it. How do can someone compare the old version vs the new one and miss something like 2FA?

This isn’t a matter of testing — this is the output of an executive decision to hire someone/some shop that doesn’t know what they’re doing, which delegated not only coding, but also technical design, architecture, implemention, auditing, etc. to a chatbot. Anybody that knows that tests are necessary doesn’t need a test to check the most basic, broad-stroke sanity of an authentication system.

Yes, but you're not vibe coding when you ask for an authentication system. You know what you mean by an authentication system and can tell when what the AI delivers is insufficient. A vibe coder can't.

The problem with vibe coding isn't the AI, it's how people use it. It's that people with no idea of what they're doing, now think they can do what used to require an expert.

You do not code your authentication system, in 99% of cases. Take an external provider or a selfhosted OSS project.

We're talking vibing here, not coding. And who knows what the agent will decide from fuzzy prompts, take an external provider or create a new one from scratch?

That's fair, I do, but it's alien to me that they wouldn't at least start with the old system as a starting point or another system, or that the LLM wouldn't make that link.

To get what tfa is describing, you'd need to explicitly request a dumbed down system, use a really shitty LLM, or both.

Honestly I'd sooner believe this is the result of a highschooler than a LLM.

Oh, absolutely. Why even try to fix what wasn't broken, and 'fix' it in a way that's likely to break it? It betrays a deep misunderstanding of what the site does and is supposed to do.

I've got no problem with people vibe coding a personal project or a prototype or something, but when you've got code in production, that a business depends on, you've got to be a massive idiot to blindly start rewriting it in this way.

I think they wanted a site refresh, and instead of doing it visually and/or adding features at the same time (people do this still, I think its okay), they likely thought that due to AI assistance it would be easy to actually start from scratch.

Not sure why you couldn't take the "its easy with AI" path and actually refresh the current codebase.

This is hearsay mind you, I don't know how much of their old site is there...

the part that is weird to me: nobody really knows how much they know about designing a system in plain english until they try it. i would not have thought i knew enough words to be dangerous (self-complimentary), but i clearly do. i still think of myself as a know-nothing vibe coder, and the only way to prove it one way or the other would basically be to go back to college. lol

This was likely the result of a CEO replacing their entire dev team by:

Build and maintain our website. Add features as needed. Rewrite everything as needed. Deploy automatically. Make it compatible. Make it secure. Make it cyber. Make it cloud. Don't make mistakes.

"Make it cyber. Make it cloud. Don't make mistakes" This is going to be my new motto from now on

But yeah, you description sounds pretty accurate from the outcome