Hacker News
points by program_whiz 3 days ago | 0 comments
What's hillarious is people vibe coding massive AI apps thinking its not creating tech debt and security holes. If anything, AI is discovering existing holes, and creating them faster than ever before in history.

All those "paying down" technical debt with AI, I would advise reading the code _very_ carefully. Sometimes the "solution" which passes some test or adheres to some described functionality is incredibly narrow / brittle, and/or has failure cases that are non-obvious.

Yes I'm using $latest_model on high, its still not there. Unless your threshold for "fixed" is "the 1M line lean proof runs, we don't know how it works", it still requires a lot of attention, hand-holding, and scrutiny, especially when fixing issues / working around failures (where it tends to shortcut or invent workarounds).

[–] fg137 3 days ago
A developer on my team introduced new features behind feature flags despite concerns about whether we should have those features and how they are going to be maintained. Changes touched 200+ files which is half of the files.

Turns out nobody wants to use them, they caused many subtle bugs in existing features and is a distraction for many things we do.

The developer left the team, and I am left with purging all of this.

[–] RiverStone 2 days ago
Why was it approved and merged then? That sounds like a code review problem not an AI problem.

200+ files should have triggered a conversation by the team, request to split it up, etc.

If nobody wants to use the features then that work never should have been prioritized or planned. The team should have discussed why it was being worked on if not a priority, etc.

Lots of layers of improvement here beside AI

[–] fg137 22 hours ago
I fully agree that there is a code review problem.

But the management chain doesn't particularly care about that, even less so with AI.

[–] program_whiz 3 days ago
Now imagine if he had 100x the speed! I'm sure AI will help him thoughtfully pay off tech debt at his next company!
[–] tjohnell 3 days ago
The same can be said with human-written code. LLM code is by far better than the average developer’s code at this point, and there’s not enough top percentile developers to go around, so it’s a wonderful tool.

Also, those very average developers are also the ones doing the code review.

[–] program_whiz 3 days ago
Below-average developers generating bugs now will be submitting AI created security holes at 10x the rate going forward. Hah, people are literally on this forum debating whether to use openSSL because they can vibe-code it with a smaller surface area (just have AI only create what you need).

Anthropic is literally creating their own git alternative because they are slopping so much code. You think its 100% secure? Even if it has bugs at 10% the rate, there is 10x more of it to go around.

Do you think Anthropic's git alternative tool is more secure and better written than git? Hah, I bet it was just some vibe-coded thing they did over a couple of days, when it starts bogging down, dropping commits, or getting unstable, they just have to prompt harder! I wonder why they won't open source or release to the public, its probably too dangerous to release!