"Just Fucking Ship It" (Or: On Vibecoding)

https://coal.sh/blog/pandu_bad

by coal320 • 1 year ago

146 124 1 year ago

brettkromkamp• 1 year ago

Excellent write up.

blinkbat• 1 year ago

Doing the lord's work tbh.

thunkshift1• 1 year ago

More like app stores work? It isn’t doing shit for the 30% cut

Analemma_• 1 year ago

The fact that this shitty application with a hardcoded OAI key also uses Supabase pairs perfectly with yesterday's story about Supabase's MCP implementation being impossible to actually secure and their engineer showing up in the comments going "the latest release probably won't leak data, hopefully, maybe". Just an endless fractal of shit, brought you by the AI future.

Oh well. At least there will probably be good money in cleaning up after these bozos.

coal32015• 1 year ago

Exactly my thought process! I work in cybersecurity so I'm very grateful for the job security :)

wil421• 1 year ago

Ask Jeeves 2.0

ctoth• 1 year ago

Weird. Back in 2019 were all the coders just better? Never hardcoded keys?

hooverd• 1 year ago

Nope, but we've replaced everyone's hammer with a nailgun.

kfajdsl4• 1 year ago

They tell you in their docs to review every tool call and to not connect to production data. You don't blame postgres for letting you execute DROP TABLE.

lcnPylGDnU4H9OF3• 1 year ago

You don't blame postgres for letting you execute DROP TABLE.

Yep, I blame the agent for executing it.

mrits• 1 year ago

Just when I felt we were at a point where it was acceptable to slow down progress for the sake of security we are now at a point where the speed is far too attractive to both stakeholders and a lot of the actual engineers to worry about the details.

coal32015• 1 year ago

VC firms will be the downfall of the internet as we know it.

vkou• 1 year ago

Should I shed a lot of tears for the demise of the internet as we know it?

The internet as we know it kind of sucks.

leptons2• 1 year ago

That already happened like 25+ years ago, at least for those who knew the internet before there were ads everywhere.

righthand• 1 year ago

The commercial internet. Every time I hear about a new LLM advancement I look at my legacy project list and do something without it just to upset people when I tell them later about how I didn’t do it in the most efficient way possible and am still happy.

hsuduebc2• 1 year ago

Well it happened few times now. I do not think it as unusual phenomen it's just innovation. Not Always positive one.

oytis• 1 year ago

That point would be late 90s to early 2000s. We've already got internet, it wasn't full of ads and was used to actually exchange information. Should have just made it faster and more accessible and stopped there

gouthamve• 1 year ago

OMG the prompt is hilarious. And hilariously bad.

You are a Gen Z App, You are Pandu,you are helping a user spark conversations with a new user, you are not cringe and you are not too forward, be human-like. You generate 1 short, trendy, and fun conversation starter. It should be under 100 characters and should not be unfinished. It should be tailored to the user's vibe or profile info. Keep it casual or playful and really gen z use slangs and emojis. No Quotation mark

coal32015• 1 year ago

This site is also accessible via ssh:

`ssh site@coal.sh`

robocat• 1 year ago

coal320 is the author of the article: for anybody that didn't notice.

Thanks for the great writeup

indigodaddy4• 1 year ago

Love the design of the website/blog! Is it custom or some ssg/template?

coal32015• 1 year ago

It's custom! It's built using Dioxus + Rust and is statically generated. You can find it here: https://github.com/coal-rock/site

pityJuke• 1 year ago

You need to fix your default branch: it is main, and you've committed everything to master.

colecut2• 1 year ago

<meta property="og-description" content="coal's personal site - powered by rust, nvim, and spite"/>

Surely spite is prepackaged in nvim by now

indigodaddy4• 1 year ago

Interesting, does https://178.156.176.158/ serving the main/actual site, mean that requests are going straight to the dx serve process with no Caddy or Nginx in front? I'm always curious how people set stuff up.. if rp in front I would think that the naked IP wouldn't pass a likely host-based proxy rule..

thih92• 1 year ago

Did you contact the creator first with these findings? What was the creator's response, if any?

In any case I hope the creator was contacted, I'd say publishing active issues like this on a popular website would be arguably as bad as releasing insecure software.

bravetraveler3• 1 year ago

Responsible disclosure for a meme-level mistake, lol.

I understand letting them know. I agree. Painting them as equally wrong, no. "Popular website"; you mean 'theirs', right? The person with a whole 27 GitHub followers right now.

MrGilbert4• 1 year ago

The article says: "Nearly a thousand children under the age of 18 with their live location, photo, and age being beamed up to a database that's left wide open."

Meme-level mistake is one thing, but their wrong doesn’t grant the right to be irresponsible for the author.

JanSt2• 1 year ago

Pushing out an exact way to extract that data without giving the creator time to fix it may even be worse than using such code in production. The data may than be in the hands of malicious people who wouldn’t have found it otherwise

coal32015• 1 year ago

Responsible disclosure was given. Developer doesn't seem keen on changing things.

handfuloflight5• 1 year ago

Valid security issues buried under unnecessary smugness and basic 'techniques' like demonstrating the unzip command. The condescending tone undermines what could have been constructive disclosure. This reads like a high schooler dunking on a first grader, I'm just glad we all learned from the technical prowess of extracting an archive. The underlying problems with exposed API keys and unrestricted database access are serious, but your arrogant presentation does a disservice to responsible disclosure.

MrGilbert4• 1 year ago

Might be worth adding that piece of information to the original article, maybe including a timeline of events.

wibbily• 1 year ago

At first, I was wondering how he managed to even publish something like this, but I'm starting to think that Apple just got tired of rejecting it over and over.

Another reminder for the pile: the app store rules don't apply if you'll deliver them their sweet sweet 30% revenue cut

Nearly a thousand children under the age of 18 with their live location, photo, and age being beamed up to a database that's left wide open. Criminal.

Hope that $750 was worth it.

fatnoah• 1 year ago

App Store rules are completely arbitrary. Many moons ago, I worked at a startup that made a mobile messaging app (back when SMS cost money). We were mostly a consumer app, but had a trio of businesses that wanted white-label versions of the app for their own employees, and we naturally obliged.

The white-label versions where 100% identical in appearance and functionality except for name in the app store, startup logo, and color scheme. Our original app had been in the App Store rules for many years. Our results in submitting the three white-label apps to the App Store for review were: 1 approved immediately, 1 approved after some back-and-forth w/explanation of purchase model, and another that never got approved due to every submission receiving some nonsensical bit of feedback.

ryandrake2• 1 year ago

We did white-label GPS navigation apps (before the dominance of Google Maps and Apple Maps), and saw the same pattern. Approvals and disapprovals seemingly random, with the endless feedback/explanation cycle happening on one app, where the other (functionally identical) app slid right through.

skrebbel• 1 year ago

Points for the girlfriend's "i am passionate about gooning" bio

f17428d27584• 1 year ago

“[T]he privacy implications of using software built by someone whose productive output is directly tied to the uptime of Cursor is absolutely horrendous.”

The most perfect description of the world we live in right now.

The only thing AI is accelerating is our slide into idiocracy as we choose to hand over responsibility for the design and control of our world to slop.

When the AI killbots murder us all, it won’t be because they are taken over by an AGI that made the decision to exterminate us.. but simply because their control software will be vibe coded trash.

Hard_Space• 1 year ago

Wow, why block the scroll bar?

coal32015• 1 year ago

I'm bad at web stuff and they kinda looked gross! It was only supposed to be on mobile. I'll fix it!

zufallsheld• 1 year ago

Shouldn't be on mobile either, I use dark mode and could not see the scroll bar.

Great read nonetheless.

flysand7• 1 year ago

I really suggest not removing them as they are a great way to estimate the length of the article (which was the first thing I tried to do on your page and had to spend a good minute first looking for a scroll bar, and then holding Page Down key).

penguin_booze• 1 year ago

Because that's how the cool people roll these days - leaving the rest of us fools chasing.

JanSt2• 1 year ago

Doesn’t supabase provide security warnings on its dashboard?

coal32015• 1 year ago

I guess not? I've never used it before.

tomashubelbauer• 1 year ago

There are security advisories, but the feature isn't particularly good. Non-actionable stuff is mixed in with actionable stuff and actionable stuff is IMO presented too generically.

perfmode• 1 year ago

Instead of looking down on someone with less knowledge, consider it an opportunity to educate with kindness rather than contempt. Belittling others isn't a good look, nor does it make the world a better place. Perhaps there's an underlying pain you haven't identified, and judgment is a way you cope.

throwaway1502• 1 year ago

This maybe an unpopular take but I think there's a place for kindness, and there's a place for naming-and-shaming, and I think this is the case for the latter! Unless we name-and-shame utter and wilful negligence like this, our industry is headed for rock bottom.

Any service making money by collecting user data owe it to themselves and to their users to to conduct at least a basic security audit of its product. Anything less borders on criminal negligence. I don't think such a blatant failure to uphold users' trust deserves kindness.

coal32015• 1 year ago

I've reached out to the dev and have offered to resolve the security issues for free! I'll update the post when/if things change.

akarlsten• 1 year ago

Poorly made slop aside, your framing of this just makes it look and sound like you're extremely bitter over losing a hackathon (?) to this guy. I think you should've focused on the company solely and dropped the snide and sarcastic references calling the CEO/dev a "hero" or "mastermind". It's not particularly mature or productive.

coal32015• 1 year ago

He didn't even rank in the hackathon, I was just providing context. A friend of mine placed first and I think it was well deserved!

lvl1553• 1 year ago

Claude Code having a woodwork moment here. It’s basically leveling up everyone to bootcamp graduate level.

bluefirebrand4• 1 year ago

Or in some cases levelling them down to to bootcamp graduate level

lvl1553• 1 year ago

I will be honest and say, yes, I am guilty. I sometimes look at AI code and say “it does work. Doesn’t need to be elegant or bulletproof.”

mvieira38• 1 year ago

Great read. I wouldn't have had the restraint required not to spam a gazillion push notifications to everyone saying "UNINSTALL IMMEDIATELY" or something like that

coal32015• 1 year ago

It definitely crossed my mind :)

WesSouza• 1 year ago

Yeah.

agosta• 1 year ago

Right!?

larve9• 1 year ago

This take is toxic. You could write the same article in 2001 and lament all the newcomers writing insecure applications in php3, or in 2009 with all the newcomers writing insecure applications with node.js.

The solution is not to aggressively shame people into doing things the way you learned to do them, but to provide not just education and support, but better tools and frameworks to build applications such as these securely.

What are we doing?

hammyhavoc7• 1 year ago

Is it really toxic though? The dev shipped something that compromises the privacy of their users and shows zero regard for quality or law. Once you cross the line of shipping something, it's no longer a hobby thing, and likewise, this is something that Apple approved into the App Store. Both the dev and Apple failed in their due diligence.

The post points out exactly what's wrong, however, if it wasn't, it should have been sent to the dev prior to publishing the vuln(s). How can you educate somebody who doesn't actually know how to develop something? It's just prompting an AI.

The real story here is that Apple has continually slipping standards.

larve9• 1 year ago

Not only would you contact the author first, but spamming users with edgy notifications is puerile at best. As for “it’s just prompting an AI”, who cares, this person built an application that people find useful. This is the world we are at now, where a new set of people can use computers to make things happen. More senior developers can rage against the clouds, but that only gets you so far. This kind of gatekeeping happens at each wave of democratization of building software.

There’s also some pervasive view that handcrafted human code is somehow of superior quality which… uh…

AlienRobot2• 1 year ago

There are millions of apps, small software shops, and small shop websites everywhere. The idea that all of these are following best practices is pure fantasy.

jonplackett• 1 year ago

shipped something that compromises the privacy of their users and shows zero regard for quality or law

*cough* Facebook *cough*

mrkeen• 1 year ago

What are we doing?

We are listening to our bosses tell us that "we're way behind in AI adoption" and that we need to catch up to vibe coders like this.

I don't mind these data points at all.

larve9• 1 year ago

what about having vibe coders catch up to experienced software developers also using LLMs / AI tools?

imiric3• 1 year ago

What are we doing?

Building tools that enable people with no experience to create and ship software without following any good software engineering practices.

This is in no way comparable to any previous period in the industry.

Education and support are more accessible than ever. Even the tools used to create such software can be educational. But you can't force people to learn when you give them the tools to create something without having to learn. You also can't blame them for using these tools as they're marketed. This situation is entirely in the hands of AI companies. And it's only going to get worse.

The only thing experienced software developers outside of the AI industry can do is observe from the sidelines, shake our heads, and get some laughs out of this shit show. And now we're the bad guys? Give me a break.

larve9• 1 year ago

A computer always was a tool to enable people without technical knowledge to build software. That was true for me as 9 year old in the 80ies.

LLMs are incredible engineering tools and brushing them aside as nonsense is imo doing a disservice to everybody, and especially ourselves if we take our craft seriously. You can literally replace llm with php and post the same take on usenet in 1999, or whenever you started writing software.

I am tired of engineers just throwing their hands up and being defeatist while fully endorsing whatever narratives the ai industry is throwing out there, when what we are talking about is a big pile of floats that is able to generate something that makes it into the App Store. It is unprecedented in its abilities, but it’s also nothing new conceptually. It makes computer things easier.

hammyhavoc7• 1 year ago

He is making serious money and has absolutely no clue what he's doing!

This describes plenty of businesses, both small and large.

morkalork• 1 year ago

Should have gone to a mall, connected to the public WiFi and then proceed to nuke the app's db. Begging people not to use it won't work

hammyhavoc7• 1 year ago

Willfully causing harm to their system is a legal minefield even if what they are doing is illegal. It also destroys evidence. You also assume they don't have backups or can't ask their host to restore it.

Sorry, but bad take.

pelagicAustral• 1 year ago

I like the write up and it gave me vibes (no pun intended) of old era hacker zine submission, but at the same time it does come across as a bit too over the top, especially because there is no indication the app author even knows this stuff is out here now for everyone to see.

There is no way to police the quality of the (closed-source) software that is going to be put out there thanks to code assisting tools, and I think that will be the strongest asset of previous developers, especially full-stack, because if you do know what you are doing, the results are just beautiful. Claude code user here.

platinumrad• 1 year ago

Now this might strike some viewers as harsh, but I believe everyone involved in this story should die.

AlienRobot2• 1 year ago

This post sounds like you lost to AI in a competition and decided to get revenge by stalking the author. I'm not even sure if you are actually concerned about its users or you're just using this information to justify the morality of your actions.

Why didn't you just send them an e-mail to warn them about the security issues?

I see in a comment that you did disclose. You should probably include that in your blog post or people will have the wrong idea about you.

coal32015• 1 year ago

I have temporarily taken the post down and am working with the developer to resolve the ongoing issues.

Update available here: https://coal.sh/blog/pandu_bad

IanCal• 1 year ago

If you’re working with them I’d like to highlight that if they have a messaging platform with children on they are going to have to take safety extremely seriously. I know the laws in the uk are not popular here but the checklists of risk assessments are worthwhile doing - cases where people can privately message children are really high risk because you’ll get a bunch of people who really want to message children. If users can send images you’ll have CSAM to deal with.

https://www.ofcom.org.uk/online-safety/illegal-and-harmful-c...

roarcher• 1 year ago

That "job offer" tells me everything I need to know about this guy. Cheerfully dictating what you're going to do as if it's a great opportunity for you, with an obvious ulterior motive. Just "you will start tonight!", without so much as a mention of pay or availability, and oh by the way take your post down. Lol.

I used to meet clowns like this all the time when I freelanced years ago. Back then they called themselves "ideas guys" and liked to make you sign an NDA for the privilege of hearing their braindead overplayed product idea. Scumbags and users, every one of them, always looking for a shortcut to personal gain.

pluto1010• 1 year ago

Erm .. you may want to contact archive.org

https://web.archive.org/web/20250709231129/https://coal.sh/b...