Most comments complaining about vibe-coding are just butt-hurt programmers who are annoyed that Joe Schmoe can produce a decent looking website in about 20 minutes without having had to waste their formative years nerding out on forums and chasing stray semicolons.
Every time someone on here says “hey, I made a cool (but harmless) interactive tool/map/website” the top comment is always “this looks vibecoded as hell” or “whats with claude.md, asshole?”. I’m all for the democratization of the economy so that social welfare, de-growth, environmental regulation and technological caution are rewarded instead of punished- including halting the datacenters and LLM proliferation for a few decades at least. But ya’ll sound like professional chefs complaining that the neighbour bought a microwave and a thermomix… or whining that they pimped out a cake mix instead of baking one from scratch. Just chill and maybe try to be helpful instead.
Can AI write code? Yes. In fact I’ll sometimes give it obtuse code I wrote and ask if there’s a way to simplify it, then use that as a jumping board on where I might want to head.
You know what else it does? Not understand context, or situations it hasn’t been made explicitly aware of.
I’ve given it plenty of things that it spit back just plainly incorrect or fundamentally altered code. Sometimes it’s just ignoring best security practices, sometimes it’s trying to use a string as an int, sometimes it just makes up “standard” functions that don’t actually exist because someone one said “wouldn’t it be nice is int.ThisFunctionName existed and did specific thing?”
Anyone shitting on AI for spitting out code is missing the point. Vibe coding is fine for personal projects that never get released to the world, but the moment you’re trying to build a business on top, or want to release it? Vibe coding is downright dangerous. There have been a number of vibe coded websites that were just sitting open for anyone to look at the personal information, because no one who knew what they were doing was involved.
There have been a number of vibe coded php websites that were just sitting open for anyone to look at the personal information, because no one who knew what they were doing was involved.
Re-wrote this for you for 2016.
Just saying, the web has been like this forever. The only thing AI is changing about people building insecure websites with shit code that that they look like someone talked to a designer for 10 seconds before it went up.
I am using PHP as a metaphor. Like, even a script kiddie could get up a working PHP site and it doesn’t matter how spaghetti the code is - it will still run.
Even a vibe coded site can be secured, the language doesn’t matter. Shitty sites with terrible security have always and will always exist on the web. AI didn’t start this trend and we should not pretend like web development has been like this for years.
AI didn’t start the trend but it has pushed that change to an extreme. A user who has no concept of security can sling up a nice, polished-looking application and publish it to the web. That was always “possible” but the bar needed to get to the point of publishing was higher, so the chances of pushing insecure code was lower.
The number of “developers” who literally don’t know how their application works is staggering. I have seen people literally say “I don’t know how it works” of their own project, and that should be terrifying for published code.
Again, for small diy things it’s whatever. But as a project released into the wild it is, at least currently, irresponsible.
How exactly are you using AI? Are you from 2023? If the AI cannot compile, lint, or type check it’s outputs with deterministic tools, you’re straight up using it wrong. I have a compiler for a reason, I want the AI to use that, not it’s vague memory.
When it comes to missing context, that’s (in most cases) on the developer calling it. It cannot have context that you do not give it. If the hyperspecific reason that module A is built weird (some insane legacy customer request maybe) only lives in the minds and hearts of developers having worked on it 3 years ago, that’s a failure of documentation, not the AI. A human could not have done better. Obviously, there’s limits to everything, but in my personal experience 95% of issues with AI agents would’ve have likely happened with a freshly onboarded human too.
The definition of vibe coding has shifted a bunch of times. I will agree that any non-developer using it for anything even remotely important/dangerous is asking for trouble. But a developer who knows the possible pitfalls can get pretty freaking far.
For me, the biggest fear is that noones educating/hiring juniors anymore. As a senior, that’s job security, but it will still fuck us over once we run out of old people that know what vim is.
As a person who spent many years in the culinary arts field, I can assure you that most professional bakeries use the same mix you can buy at the store, just shipped in 50 pound bags. The difference is that they use butter instead of oil, heavy cream instead of water, more eggs, and brown sugar instead of white.
Yeah, it shocks most people when they hear it. But if you think further on it, mayo is essentially oil, egg, and an acid, but mainly oil and egg. Cake mix calls for oil and egg, and so you just substitute a dollop of mayonnaise, and it does a better job of oil and egg.
As far as how much, I have no idea. I’m not a baker. I can cook, but I do not bake.
And for anyone wondering, you do not taste mayo in the cake, that would be terrible.
OK, here’s my unpopular opinion: cooking and baking aren’t that different, and the differences between them are massively overstated. If you can follow a savory meat dish recipe that spends time in the oven, you can make a cake.
I’ve worked in restaurants and as a pastry chef. It’s all the same fundamentals. People say baking has to be “more precise” and I don’t even think that’s true. Plenty of savory sauces and meat dishes require just as much, if not more, precision as baking.
I mean this to be encouraging. I hear from a lot of talented cooks that they don’t bake and I’m always like but… you could? You’re just inexperienced at it. But a passionate cook is also a passionate baker.
I don’t doubt you, I just don’t bake. Don’t wanna. And I’m fortunate enough that my wife, mother, and mother-in-law all have some baking specials, so don’t need to.
I’ve definitely heard the whole baking is a science thing, but I tend to treat cooking like that (aka I follow the recipe). So maybe I could bake. But I won’t!
Fair. But my impression is that passing snippets around has been standard practice since the beginning. What makes the code yours, in my opinion, is the application of the snippets and the creativity involved. I don’t see the LLMs as threatening this in a big way, yet.
Eh Im not so sure, all functions for anything open source or with an API are well documented, if it simply knows literally All the functions and knows how to put them together in a coherent way, then I highly doubt its ‘stealing’ anyones code.
Its like AI art, we told AI what a cat looks like by showing it thousands of picture of cats, so now it knows how to draw a cat based on that data. When you ask it to draw a cat its not just pulling one of its thousands of cat pics out and showing it it to you, thats not how it works.
That’s a subjective fucking standard. And the LLMs learned from corporate standards, which are using 6 frameworks and then just adding basic gradients to make it look “fancy”.
chasing stray semicolons
It’s usually not having enough that’s a problem? And then you just look at the error, it says " line 12", and you add the damn semicolon. And if it’s not on line 12, add on line 11. And then you get used to fucking adding semicolons.
“this looks vibe coded” doesn’t mean “we don’t like your project because it used ai”
it means “your project for fucking sure does not do what you think it does because you are not a skilled developer enough to understand the code that the AI generated for you”
to which the counterargument the slopper would throw is “I wrote tests for requirements and the tests are passing”
how would a slopper know the code generated fits the requirements vs strictly only passes test cases ?
I am Java developer, and I don’t understand how exactly JVM works, for example. I’m not sure, how much my app will consume memory and CPU resources. I don’t know when garbage collector will do their work. I even don’t know what JIT and AOT compilation. And this doesn’t prevent me from doing good, effective and useful things. May be they are not the best. Maybe writing them on C or assembler will be more optimized and effective. But anyway, I am OK with that and trying to accept vibe coding same way, as I accept myself and my job.
Difference is that vibe coding doesn’t create 20% more CPU usage or 30% more RAM usage because it doesn’t understand the underlying mechanics (or, it could but that is not the important part). LLMs will happily provide you with solutions that consists of plain text password storage, leaking personal information through open APIs, and business crushing vulnerabilities. A sharp developer should be able to catch that, but if you’re reviewing 5000+ line PRs daily that’s been spat out by LLMs it’ll be impossible to catch all failures. And for someone who doesn’t know all those nonfunctional requirements that a business absolutely must have it’ll become a nightmare for the receiver of the code.
So to be clear: For functional requirements LLMs are a bit better but still needs hand holding. For nonfunctional requirements they’re dog shit as that’s the part that more often than not has to explicitly be mentioned. And being able to identify nonfunctional requirements and when they’re not met is the difference between a junior dev and a 10+ year lead.
Slow app? Just add resources. Vulnerable app? Actual compliance and business risk.
This makes no sense. What in the world makes you think that the average junior dev before AI produced perfectly safe code? For both the junior and the AI, the solution is a senior looking over stuff, decent code review cycles, pair programming, maybe a spec and good documentation for especially heinous customer requirements.
I’d actually go so far as to say SOTA models are far more likely to notice these issues and do them right. Seriously, juniors are often lazy, undisciplined, and very scared of asking for help. I say that as someone that’s both been that guy, as well as taught a bunch of those guys.
If there’s an olive branch I can extend, it’s definitely that adding LLM to a disfunctional, badly managed team and/or process won’t improve it. It will just increase the rate of bugs and vulns produced ten fold.
This is a helpful clarification, thanks. Then my question to you is, should the viber cease and desist? Is this not a valid way for them to foment an interest in software/tool/website development? Surely if their code has deep issues, they’ll discover that eventually and maybe learn from it, right?
Like, someone could try to learn a language by only using an ai translator. It’s lazy and not as effective, but I wouldn’t discourage someone from pursuing the language on account of that.
Then the copers defending AI will find it hard to ignore that it can cause irreparable damage (deaths)
These kinda of stories will prop up more and more as more and more of the old guard is replaced by Charles “chatgpt: how do I feel today?” LLM cave brains
Surely if their code has deep issues, they’ll discover that eventually and maybe learn from it, right?
Maybe… but that’s definitely not a given, and if they’re not already an experienced developer it’s almost certainly something they’ll try to solve by prompting, “don’t make any mistakes” or similar.
Most comments complaining about vibe-coding are just butt-hurt programmers who are annoyed that Joe Schmoe can produce a decent looking website in about 20 minutes without having had to waste their formative years nerding out on forums and chasing stray semicolons.
Every time someone on here says “hey, I made a cool (but harmless) interactive tool/map/website” the top comment is always “this looks vibecoded as hell” or “whats with claude.md, asshole?”. I’m all for the democratization of the economy so that social welfare, de-growth, environmental regulation and technological caution are rewarded instead of punished- including halting the datacenters and LLM proliferation for a few decades at least. But ya’ll sound like professional chefs complaining that the neighbour bought a microwave and a thermomix… or whining that they pimped out a cake mix instead of baking one from scratch. Just chill and maybe try to be helpful instead.
Eeeeh. I disagree. Disclosure: I’m a developer.
Can AI write code? Yes. In fact I’ll sometimes give it obtuse code I wrote and ask if there’s a way to simplify it, then use that as a jumping board on where I might want to head.
You know what else it does? Not understand context, or situations it hasn’t been made explicitly aware of.
I’ve given it plenty of things that it spit back just plainly incorrect or fundamentally altered code. Sometimes it’s just ignoring best security practices, sometimes it’s trying to use a string as an int, sometimes it just makes up “standard” functions that don’t actually exist because someone one said “wouldn’t it be nice is int.ThisFunctionName existed and did specific thing?”
Anyone shitting on AI for spitting out code is missing the point. Vibe coding is fine for personal projects that never get released to the world, but the moment you’re trying to build a business on top, or want to release it? Vibe coding is downright dangerous. There have been a number of vibe coded websites that were just sitting open for anyone to look at the personal information, because no one who knew what they were doing was involved.
Re-wrote this for you for 2016.
Just saying, the web has been like this forever. The only thing AI is changing about people building insecure websites with shit code that that they look like someone talked to a designer for 10 seconds before it went up.
No, that’s quite different. PHP is a language, any language can be made secure so long as it isn’t running client side.
This is like saying PHP and a script kiddy are equivalent.
I am using PHP as a metaphor. Like, even a script kiddie could get up a working PHP site and it doesn’t matter how spaghetti the code is - it will still run.
Even a vibe coded site can be secured, the language doesn’t matter. Shitty sites with terrible security have always and will always exist on the web. AI didn’t start this trend and we should not pretend like web development has been like this for years.
AI didn’t start the trend but it has pushed that change to an extreme. A user who has no concept of security can sling up a nice, polished-looking application and publish it to the web. That was always “possible” but the bar needed to get to the point of publishing was higher, so the chances of pushing insecure code was lower.
The number of “developers” who literally don’t know how their application works is staggering. I have seen people literally say “I don’t know how it works” of their own project, and that should be terrifying for published code.
Again, for small diy things it’s whatever. But as a project released into the wild it is, at least currently, irresponsible.
How exactly are you using AI? Are you from 2023? If the AI cannot compile, lint, or type check it’s outputs with deterministic tools, you’re straight up using it wrong. I have a compiler for a reason, I want the AI to use that, not it’s vague memory.
When it comes to missing context, that’s (in most cases) on the developer calling it. It cannot have context that you do not give it. If the hyperspecific reason that module A is built weird (some insane legacy customer request maybe) only lives in the minds and hearts of developers having worked on it 3 years ago, that’s a failure of documentation, not the AI. A human could not have done better. Obviously, there’s limits to everything, but in my personal experience 95% of issues with AI agents would’ve have likely happened with a freshly onboarded human too.
The definition of vibe coding has shifted a bunch of times. I will agree that any non-developer using it for anything even remotely important/dangerous is asking for trouble. But a developer who knows the possible pitfalls can get pretty freaking far.
For me, the biggest fear is that noones educating/hiring juniors anymore. As a senior, that’s job security, but it will still fuck us over once we run out of old people that know what vim is.
As a person who spent many years in the culinary arts field, I can assure you that most professional bakeries use the same mix you can buy at the store, just shipped in 50 pound bags. The difference is that they use butter instead of oil, heavy cream instead of water, more eggs, and brown sugar instead of white.
As always, the main difference between home cooking and restaurant quality is an irresponsible amount of salt, fat, acid, sugar, and/or heat.
The secret is mayonnaise. Use mayonnaise. Been my mom’s secret weapon in chocolate cake for years and it comes out super moist.
that’s just eggs, bud.
I love mayo, but this is a horrifying thought. If the secret is mayonnaise then it should stay a secret.
Yeah, it shocks most people when they hear it. But if you think further on it, mayo is essentially oil, egg, and an acid, but mainly oil and egg. Cake mix calls for oil and egg, and so you just substitute a dollop of mayonnaise, and it does a better job of oil and egg.
As far as how much, I have no idea. I’m not a baker. I can cook, but I do not bake.
And for anyone wondering, you do not taste mayo in the cake, that would be terrible.
OK, here’s my unpopular opinion: cooking and baking aren’t that different, and the differences between them are massively overstated. If you can follow a savory meat dish recipe that spends time in the oven, you can make a cake.
I’ve worked in restaurants and as a pastry chef. It’s all the same fundamentals. People say baking has to be “more precise” and I don’t even think that’s true. Plenty of savory sauces and meat dishes require just as much, if not more, precision as baking.
I mean this to be encouraging. I hear from a lot of talented cooks that they don’t bake and I’m always like but… you could? You’re just inexperienced at it. But a passionate cook is also a passionate baker.
I don’t doubt you, I just don’t bake. Don’t wanna. And I’m fortunate enough that my wife, mother, and mother-in-law all have some baking specials, so don’t need to.
I’ve definitely heard the whole baking is a science thing, but I tend to treat cooking like that (aka I follow the recipe). So maybe I could bake. But I won’t!
So no water just cream? Or less water
The reason programmers are complaining is because the LLM stole our code to do so.
Fair. But my impression is that passing snippets around has been standard practice since the beginning. What makes the code yours, in my opinion, is the application of the snippets and the creativity involved. I don’t see the LLMs as threatening this in a big way, yet.
Eh Im not so sure, all functions for anything open source or with an API are well documented, if it simply knows literally All the functions and knows how to put them together in a coherent way, then I highly doubt its ‘stealing’ anyones code.
Its like AI art, we told AI what a cat looks like by showing it thousands of picture of cats, so now it knows how to draw a cat based on that data. When you ask it to draw a cat its not just pulling one of its thousands of cat pics out and showing it it to you, thats not how it works.
That’s a subjective fucking standard. And the LLMs learned from corporate standards, which are using 6 frameworks and then just adding basic gradients to make it look “fancy”.
It’s usually not having enough that’s a problem? And then you just look at the error, it says " line 12", and you add the damn semicolon. And if it’s not on line 12, add on line 11. And then you get used to fucking adding semicolons.
Good luck maintaining that code
“this looks vibe coded” doesn’t mean “we don’t like your project because it used ai”
it means “your project for fucking sure does not do what you think it does because you are not a skilled developer enough to understand the code that the AI generated for you”
to which the counterargument the slopper would throw is “I wrote tests for requirements and the tests are passing”
how would a slopper know the code generated fits the requirements vs strictly only passes test cases ?
I am Java developer, and I don’t understand how exactly JVM works, for example. I’m not sure, how much my app will consume memory and CPU resources. I don’t know when garbage collector will do their work. I even don’t know what JIT and AOT compilation. And this doesn’t prevent me from doing good, effective and useful things. May be they are not the best. Maybe writing them on C or assembler will be more optimized and effective. But anyway, I am OK with that and trying to accept vibe coding same way, as I accept myself and my job.
Difference is that vibe coding doesn’t create 20% more CPU usage or 30% more RAM usage because it doesn’t understand the underlying mechanics (or, it could but that is not the important part). LLMs will happily provide you with solutions that consists of plain text password storage, leaking personal information through open APIs, and business crushing vulnerabilities. A sharp developer should be able to catch that, but if you’re reviewing 5000+ line PRs daily that’s been spat out by LLMs it’ll be impossible to catch all failures. And for someone who doesn’t know all those nonfunctional requirements that a business absolutely must have it’ll become a nightmare for the receiver of the code.
So to be clear: For functional requirements LLMs are a bit better but still needs hand holding. For nonfunctional requirements they’re dog shit as that’s the part that more often than not has to explicitly be mentioned. And being able to identify nonfunctional requirements and when they’re not met is the difference between a junior dev and a 10+ year lead.
Slow app? Just add resources. Vulnerable app? Actual compliance and business risk.
This makes no sense. What in the world makes you think that the average junior dev before AI produced perfectly safe code? For both the junior and the AI, the solution is a senior looking over stuff, decent code review cycles, pair programming, maybe a spec and good documentation for especially heinous customer requirements.
I’d actually go so far as to say SOTA models are far more likely to notice these issues and do them right. Seriously, juniors are often lazy, undisciplined, and very scared of asking for help. I say that as someone that’s both been that guy, as well as taught a bunch of those guys.
If there’s an olive branch I can extend, it’s definitely that adding LLM to a disfunctional, badly managed team and/or process won’t improve it. It will just increase the rate of bugs and vulns produced ten fold.
This is a helpful clarification, thanks. Then my question to you is, should the viber cease and desist? Is this not a valid way for them to foment an interest in software/tool/website development? Surely if their code has deep issues, they’ll discover that eventually and maybe learn from it, right?
Like, someone could try to learn a language by only using an ai translator. It’s lazy and not as effective, but I wouldn’t discourage someone from pursuing the language on account of that.
Guess we’ll find out once you start hearing about critical systems having bugs that are hard to ignore
Like health systems incorrectly monitoring data or programmed systems in planes causing catastrophic bugs
A lot more of these https://en.wikipedia.org/wiki/Ariane_flight_V88
Then the copers defending AI will find it hard to ignore that it can cause irreparable damage (deaths)
These kinda of stories will prop up more and more as more and more of the old guard is replaced by Charles “chatgpt: how do I feel today?” LLM cave brains
Maybe… but that’s definitely not a given, and if they’re not already an experienced developer it’s almost certainly something they’ll try to solve by prompting, “don’t make any mistakes” or similar.
I don’t think we’re “butt hurt”. We just have a different tolerance for what is acceptable.