Hacker News Reader

Comment by faizshah | Hacker News Reader

In new software I write these days I limit the number of external dependencies and mostly vibe code anything I need besides the most critical foundational libraries (increasingly I am replacing these as well).

I think this, the supply chain attacks and binary reverse engineering will cause us to go back to thin clients, html over the wire and vibe coded libs instead of external open source deps.

View on HN

Vibe coding deps is security through obscurity, with all of its weaknesses (and strengths). It's not that such deps have fewer security bugs than the open source reference implementations from which they are derived, it's just that those bugs are currently less discoverable.

In the near to medium term, the current open source regime has issues because bugs have become extremely discoverable and easy to exploit. But I am skeptical that obscurity will provide vibe coded deps sufficient protection over the long term. As soon as the source code for those vibe-coded deps leaks, you are screwed.

It's not just obscurity, it's increasingly difficult to trust the governance and quality of code of any outside library. A lot of deps in code are unnecessary you use maybe 1-10% of the api surface. But since building and maintaining software can be cheaper now it can be better to maintain a 1-5k LOC vibe coded version that meets your security bar than to trust an external party's governance & quality. This has the additional benefit of reconsidering if you even need the dep or if you can reuse something you already have (since you may not want to maintain the lib).

> it's increasingly difficult to trust the governance and quality of code of any outside library

The value of 'code written before 2024' is going to be substantially higher than of code written afterwards.

Sort of like a 'low background steel', a comparison someone made on HN before which I think was pretty good.

This only applies to its value in regards to training data for LLMs.

No, it will also be reflected in the value of IP.

I really doubt that. If these models continue to improve, they will be producing higher quality code than, maybe not the best human developers, but certainly the average human developer who would have typically been writing code on these systems.

Pre-2024 code is full of human-written vulnerabilities.

Limiting the number of dependencies is always good, within reason. Especially with eco-systems that want to pull in everything and the kitchen sink. That's just asking for a supply chain attack. I try to limit myself to what well reputed distros provide and what I can review. That's still no guarantee but it cuts down the risk substantially.

Reply on news.ycombinator.com