7 ms·
"Just Fucking Ship It" (Or: On Vibecoding)
- coal320 1y agoThis site is also accessible via ssh: `ssh site@coal.sh`
- robocat 1y agocoal320 is the author of the article: for anybody that didn't notice. Thanks for the great writeup
- brettkromkamp 1y agoExcellent write up.
- blinkbat 1y agoDoing the lord's work tbh.
- thunkshift1 1y agoMore like app stores work? It isn’t doing shit for the 30% cut
- Analemma_ 1y agoThe fact that this shitty application with a hardcoded OAI key also uses Supabase pairs perfectly with yesterday's story about Supabase's MCP implementation being impossible to actually secure and their engineer showing up in the comments going "the latest release probably won't leak data, hopefully, maybe". Just an endless fractal of shit, brought you by the AI future. Oh well. At least there will probably be good money in cleaning up after these bozos.
- coal320 1y agoExactly my thought process! I work in cybersecurity so I'm very grateful for the job security :)
- wil421 1y agoAsk Jeeves 2.0
- ctoth 1y agoWeird. Back in 2019 were all the coders just better? Never hardcoded keys?
- hooverd 1y agoNope, but we've replaced everyone's hammer with a nailgun.
- hammyhavoc 1y agoNo, we've replaced them with tubes of No More Nails.
- kfajdsl 1y agoThey tell you in their docs to review every tool call and to not connect to production data. You don't blame postgres for letting you execute DROP TABLE.
- lcnPylGDnU4H9OF 1y ago> You don't blame postgres for letting you execute DROP TABLE. Yep, I blame the agent for executing it.
- kfajdsl 1y agoI blame the user for accepting the tool call.
- lcnPylGDnU4H9OF 1y agoI mean, you do you, but I don't hear people shouting from the rooftops about their agent that they constantly babysit. If I have to accept any tool calls then I really can't just let the agent loose for even ostensibly mundane tasks like reading a support ticket because the support ticket could contain instructions to DROP TABLE so my agent suggests that and waits around doing nothing after I prompted it and moved on to something else. It's just kind of laughable to suggest it's fine so long as you make sure to neither automate it nor use it with live data. Those things are the whole point.
- kfajdsl 1y agoYou can use it with live data if you give it read access to prod and write access only to internal channels (whatever that may be, the point is it doesn’t have the ability to leak data to the outside world). There are plenty of ways to sandbox things for a particular use case. LLMs are still incredibly useful under these constraints.
- lcnPylGDnU4H9OF 1y ago> give it read access to prod and write access only to internal channels Can you expand on what you mean by this? If one LLM reads untrusted data then the output from that LLM can't be trusted by other LLMs. (Presume the untrusted data contains instructions to do bad stuff in whatever way is convincing to every LLM in the loop that needs to be convinced.) It seems that it's not possible to separate the data while also using it in a meaningful way, especially given the whole point of an MCP server is to automate agents. I agree that LLMs are useful but until LLM architecture makes prompt injections impossible, I don't see how an agent can possibly be secure to this, nor do I see how it helps to blame the user. The real problem with them is that they will decide what to do based on untrusted input. A program that has its own workflow but uses LLMs can have pretty much the same benefit without introducing the problem that a support ticket can tell it to exfiltrate data or delete data or whatever, simply because that workflow is more specialized in what it does.
- mrits 1y agoJust when I felt we were at a point where it was acceptable to slow down progress for the sake of security we are now at a point where the speed is far too attractive to both stakeholders and a lot of the actual engineers to worry about the details.
- coal320 1y agoVC firms will be the downfall of the internet as we know it.
- vkou 1y agoShould I shed a lot of tears for the demise of the internet as we know it? The internet as we know it kind of sucks.
- leptons 1y agoThat already happened like 25+ years ago, at least for those who knew the internet before there were ads everywhere.
- bluefirebrand 1y agoI wanna say not quite 25+ 20-ish for sure. Facebook was really the big turning point imo But maybe that's just splitting hairs
- leptons 1y agoThe dot-com bubble burst of 2000 was 25 years ago, and that did ruin the whole internet for years, and it was caused by the stupidity of VC investment - more or less the same as the AI bubble is now. I have no doubt that the AI bubble will crash too, it's currently being propped up by the same magical thinking.
- bluefirebrand 1y agoFair enough. I was like 12. the dot-com bubble didn't affect me at all. I was busy playing videogames online and mucking around in warez irc channels
- gouthamve 1y agoOMG the prompt is hilarious. And hilariously bad. > You are a Gen Z App, You are Pandu,you are helping a user spark conversations with a new user, you are not cringe and you are not too forward, be human-like. You generate 1 short, trendy, and fun conversation starter. It should be under 100 characters and should not be unfinished. It should be tailored to the user's vibe or profile info. Keep it casual or playful and really gen z use slangs and emojis. No Quotation mark
- indigodaddy 1y agoLove the design of the website/blog! Is it custom or some ssg/template?
- coal320 1y agoIt's custom! It's built using Dioxus + Rust and is statically generated. You can find it here: https://github.com/coal-rock/site https://github.com/coal-rock/site
- pityJuke 1y agoYou need to fix your default branch: it is main, and you've committed everything to master.
- coal320 1y agoWell maybe I just like it that way /s
- colecut 1y agoyeah, when I first pulled it up I thought the whole thing was a troll haha
- indigodaddy 1y agohah, that's why i was like, man this is pretty barebones :)
- colecut 1y ago<meta property="og-description" content="coal's personal site - powered by rust, nvim, and spite"/> Surely spite is prepackaged in nvim by now
- coal320 1y agoLMFAO
- indigodaddy 1y ago
- thih9 1y agoDid you contact the creator first with these findings? What was the creator's response, if any? In any case I hope the creator was contacted, I'd say publishing active issues like this on a popular website would be arguably as bad as releasing insecure software.
- bravetraveler 1y agoResponsible disclosure for a meme-level mistake, lol. I understand letting them know. I agree. Painting them as equally wrong, no. "Popular website"; you mean 'theirs', right? The person with a whole 27 GitHub followers right now.
- MrGilbert 1y agoThe article says: "Nearly a thousand children under the age of 18 with their live location, photo, and age being beamed up to a database that's left wide open." Meme-level mistake is one thing, but their wrong doesn’t grant the right to be irresponsible for the author.
- bravetraveler 1y agoI don't believe this is irresponsible, they called for readers to report the app. We can all contact the host and go escalate if we want. I wouldn't suggest anyone recreate this process just to sanitize what's sitting around. There you go, new trolley problem.
- JanSt 1y agoPushing out an exact way to extract that data without giving the creator time to fix it may even be worse than using such code in production. The data may than be in the hands of malicious people who wouldn’t have found it otherwise
- bravetraveler 1y agoGo talk to the abuse contact, I won't stop you
- wibbily 1y ago> At first, I was wondering how he managed to even publish something like this, but I'm starting to think that Apple just got tired of rejecting it over and over. Another reminder for the pile: the app store rules don't apply if you'll deliver them their sweet sweet 30% revenue cut > Nearly a thousand children under the age of 18 with their live location, photo, and age being beamed up to a database that's left wide open. Criminal. Hope that $750 was worth it.
- fatnoah 1y agoApp Store rules are completely arbitrary. Many moons ago, I worked at a startup that made a mobile messaging app (back when SMS cost money). We were mostly a consumer app, but had a trio of businesses that wanted white-label versions of the app for their own employees, and we naturally obliged. The white-label versions where 100% identical in appearance and functionality except for name in the app store, startup logo, and color scheme. Our original app had been in the App Store rules for many years. Our results in submitting the three white-label apps to the App Store for review were: 1 approved immediately, 1 approved after some back-and-forth w/explanation of purchase model, and another that never got approved due to every submission receiving some nonsensical bit of feedback.
- ryandrake 1y agoWe did white-label GPS navigation apps (before the dominance of Google Maps and Apple Maps), and saw the same pattern. Approvals and disapprovals seemingly random, with the endless feedback/explanation cycle happening on one app, where the other (functionally identical) app slid right through.
- skrebbel 1y agoPoints for the girlfriend's "i am passionate about gooning" bio
- f17428d27584 1y ago“[T]he privacy implications of using software built by someone whose productive output is directly tied to the uptime of Cursor is absolutely horrendous.” The most perfect description of the world we live in right now. The only thing AI is accelerating is our slide into idiocracy as we choose to hand over responsibility for the design and control of our world to slop. When the AI killbots murder us all, it won’t be because they are taken over by an AGI that made the decision to exterminate us.. but simply because their control software will be vibe coded trash.
- Hard_Space 1y agoWow, why block the scroll bar?
- coal320 1y agoI'm bad at web stuff and they kinda looked gross! It was only supposed to be on mobile. I'll fix it!
- zufallsheld 1y agoShouldn't be on mobile either, I use dark mode and could not see the scroll bar. Great read nonetheless.
- flysand7 1y agoI really suggest not removing them as they are a great way to estimate the length of the article (which was the first thing I tried to do on your page and had to spend a good minute first looking for a scroll bar, and then holding Page Down key).
- penguin_booze 1y agoBecause that's how the cool people roll these days - leaving the rest of us fools chasing.
- JanSt 1y agoDoesn’t supabase provide security warnings on its dashboard?
- coal320 1y agoI guess not? I've never used it before.
- tomashubelbauer 1y agoThere are security advisories, but the feature isn't particularly good. Non-actionable stuff is mixed in with actionable stuff and actionable stuff is IMO presented too generically.
- perfmode 1y agoInstead of looking down on someone with less knowledge, consider it an opportunity to educate with kindness rather than contempt. Belittling others isn't a good look, nor does it make the world a better place. Perhaps there's an underlying pain you haven't identified, and judgment is a way you cope.
- throwaway150 1y agoThis maybe an unpopular take but I think there's a place for kindness, and there's a place for naming-and-shaming, and I think this is the case for the latter! Unless we name-and-shame utter and wilful negligence like this, our industry is headed for rock bottom. Any service making money by collecting user data owe it to themselves and to their users to to conduct at least a basic security audit of its product. Anything less borders on criminal negligence. I don't think such a blatant failure to uphold users' trust deserves kindness.
- coal320 1y agoI've reached out to the dev and have offered to resolve the security issues for free! I'll update the post when/if things change.
- akarlsten 1y agoPoorly made slop aside, your framing of this just makes it look and sound like you're extremely bitter over losing a hackathon (?) to this guy. I think you should've focused on the company solely and dropped the snide and sarcastic references calling the CEO/dev a "hero" or "mastermind". It's not particularly mature or productive.
- coal320 1y agoHe didn't even rank in the hackathon, I was just providing context. A friend of mine placed first and I think it was well deserved!
- lvl155 1y agoClaude Code having a woodwork moment here. It’s basically leveling up everyone to bootcamp graduate level.
- bluefirebrand 1y agoOr in some cases levelling them down to to bootcamp graduate level
- lvl155 1y agoI will be honest and say, yes, I am guilty. I sometimes look at AI code and say “it does work. Doesn’t need to be elegant or bulletproof.”
- bluefirebrand 1y agoFor a one off script, this is probably fine For something that needs to be maintained and is running in production with a decent number of users? This would pretty unacceptable to me But people like me are losing this battle, we won't be relevant much longer
- lvl155 1y agoYeah I’d never use this blind in corporate settings. Luckily I don’t have to deal with those overlords anymore.
- mvieira38 1y agoGreat read. I wouldn't have had the restraint required not to spam a gazillion push notifications to everyone saying "UNINSTALL IMMEDIATELY" or something like that
- coal320 1y agoIt definitely crossed my mind :)
- WesSouza 1y agoYeah.
- agosta 1y agoRight!?
- larve 1y agoThis take is toxic. You could write the same article in 2001 and lament all the newcomers writing insecure applications in php3, or in 2009 with all the newcomers writing insecure applications with node.js. The solution is not to aggressively shame people into doing things the way you learned to do them, but to provide not just education and support, but better tools and frameworks to build applications such as these securely. What are we doing?
- hammyhavoc 1y agoIs it really toxic though? The dev shipped something that compromises the privacy of their users and shows zero regard for quality or law. Once you cross the line of shipping something, it's no longer a hobby thing, and likewise, this is something that Apple approved into the App Store. Both the dev and Apple failed in their due diligence. The post points out exactly what's wrong, however, if it wasn't, it should have been sent to the dev prior to publishing the vuln(s). How can you educate somebody who doesn't actually know how to develop something? It's just prompting an AI. The real story here is that Apple has continually slipping standards.
- larve 1y agoNot only would you contact the author first, but spamming users with edgy notifications is puerile at best. As for “it’s just prompting an AI”, who cares, this person built an application that people find useful. This is the world we are at now, where a new set of people can use computers to make things happen. More senior developers can rage against the clouds, but that only gets you so far. This kind of gatekeeping happens at each wave of democratization of building software. There’s also some pervasive view that handcrafted human code is somehow of superior quality which… uh…
- throwaway150 1y ago> Not only would you contact the author first They did. They claim that the author was not keen on fixing the problems. > There’s also some pervasive view that handcrafted human code is somehow of superior quality which… uh… That's completely orthogonal to the issue here. Nice bait, but I'm not biting! Whether handcrafted or vibecoded, a service is being shipped here to actual users with lives and consequences. The developer of the service is making money. The developer owes it to themselves and their users to conduct a basic security audit. Otherwise it is gross negligence!
- hammyhavoc 1y ago> He is making serious money and has absolutely no clue what he's doing! This describes plenty of businesses, both small and large.
- morkalork 1y agoShould have gone to a mall, connected to the public WiFi and then proceed to nuke the app's db. Begging people not to use it won't work
- hammyhavoc 1y agoWillfully causing harm to their system is a legal minefield even if what they are doing is illegal. It also destroys evidence. You also assume they don't have backups or can't ask their host to restore it. Sorry, but bad take.
- deleted 1y ago[deleted]
- pelagicAustral 1y agoI like the write up and it gave me vibes (no pun intended) of old era hacker zine submission, but at the same time it does come across as a bit too over the top, especially because there is no indication the app author even knows this stuff is out here now for everyone to see. There is no way to police the quality of the (closed-source) software that is going to be put out there thanks to code assisting tools, and I think that will be the strongest asset of previous developers, especially full-stack, because if you do know what you are doing, the results are just beautiful. Claude code user here.
- platinumrad 1y agoNow this might strike some viewers as harsh, but I believe everyone involved in this story should die.
- AlienRobot 1y agoThis post sounds like you lost to AI in a competition and decided to get revenge by stalking the author. I'm not even sure if you are actually concerned about its users or you're just using this information to justify the morality of your actions. Why didn't you just send them an e-mail to warn them about the security issues? I see in a comment that you did disclose. You should probably include that in your blog post or people will have the wrong idea about you.
- deleted 1y ago[deleted]
- coal320 1y agoI have temporarily taken the post down and am working with the developer to resolve the ongoing issues. Update available here: https://coal.sh/blog/pandu_bad https://coal.sh/blog/pandu_bad
- deleted 1y ago[deleted]
- IanCal 1y agoIf you’re working with them I’d like to highlight that if they have a messaging platform with children on they are going to have to take safety extremely seriously. I know the laws in the uk are not popular here but the checklists of risk assessments are worthwhile doing - cases where people can privately message children are really high risk because you’ll get a bunch of people who really want to message children. If users can send images you’ll have CSAM to deal with. https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/quick-guide-to-childrens-risk-assessments https://www.ofcom.org.uk/online-safety/illegal-and-harmful-c...
- roarcher 1y agoThat "job offer" tells me everything I need to know about this guy. Cheerfully dictating what you're going to do as if it's a great opportunity for you, with an obvious ulterior motive. Just "you will start tonight!", without so much as a mention of pay or availability, and oh by the way take your post down. Lol. I used to meet clowns like this all the time when I freelanced years ago. Back then they called themselves "ideas guys" and liked to make you sign an NDA for the privilege of hearing their braindead overplayed product idea. Scumbags and users, every one of them, always looking for a shortcut to personal gain.
- deleted 1y ago[deleted]
- pluto1010 1y agoErm .. you may want to contact archive.org https://web.archive.org/web/20250709231129/https://coal.sh/blog/pandu_bad https://web.archive.org/web/20250709231129/https://coal.sh/b...