Hacker News Reader

Comment by rectang | Hacker News Reader

Vibe coding deps is security through obscurity, with all of its weaknesses (and strengths). It's not that such deps have fewer security bugs than the open source reference implementations from which they are derived, it's just that those bugs are currently less discoverable.

In the near to medium term, the current open source regime has issues because bugs have become extremely discoverable and easy to exploit. But I am skeptical that obscurity will provide vibe coded deps sufficient protection over the long term. As soon as the source code for those vibe-coded deps leaks, you are screwed.

View on HN

It's not just obscurity, it's increasingly difficult to trust the governance and quality of code of any outside library. A lot of deps in code are unnecessary you use maybe 1-10% of the api surface. But since building and maintaining software can be cheaper now it can be better to maintain a 1-5k LOC vibe coded version that meets your security bar than to trust an external party's governance & quality. This has the additional benefit of reconsidering if you even need the dep or if you can reuse something you already have (since you may not want to maintain the lib).

> it's increasingly difficult to trust the governance and quality of code of any outside library

The value of 'code written before 2024' is going to be substantially higher than of code written afterwards.

Sort of like a 'low background steel', a comparison someone made on HN before which I think was pretty good.

This only applies to its value in regards to training data for LLMs.

No, it will also be reflected in the value of IP.

I really doubt that. If these models continue to improve, they will be producing higher quality code than, maybe not the best human developers, but certainly the average human developer who would have typically been writing code on these systems.

Pre-2024 code is full of human-written vulnerabilities.

Reply on news.ycombinator.com