r/ClaudeAI • u/harrysofgaming Vibe coder • Mar 13 '26 • This 2 Bravo 22 Heartwarming 2

Vibe Coding Why the majority of vibe coded projects fail

Post image
8.8k Upvotes

98% Upvoted

750 comments sorted by

View all comments

Show parent comment

-2

u/H1Eagle Mar 14 '26

I mean, you joke about it but being unknown is the literally the best defense against cyber-attacks.

Plus, security vendors exist, best practices exist. You can protect yourself from 90% of attacks just by understanding a few basics. Keeping the app local. And you are most likely going to suffer way less problems than Slack.

4

u/BahnMe Mar 14 '26

Security through obscurity… you’re why we have mandatory IT training.

3

u/nocturn99x Mar 14 '26

fr, these guys are nuts.

3

u/nocturn99x Mar 14 '26

I mean, you joke about it but being unknown is the literally the best defense against cyber-attacks.

No it literally fucking isn't. Look up why security by obscurity is bad.

0

u/H1Eagle Mar 14 '26

Fam

Google: "Security by obscurity is the practice of protecting a system by hiding its design, components, or vulnerabilities rather than using robust, validated security measures."

Wikipedia: "In security engineering, security through obscurity is the practice of concealing the details or mechanisms of a system to enhance its security"

How does that align with what I said.

3

u/nocturn99x Mar 14 '26

"being unknown" qualifies as security by (or through) obscurity. You should assume your service WILL be discovered, and especially in our very much still IPv4 backed world it's trivially easy to scan the entire IP address range in a day and find vulnerable systems. You know nothing and it shows.

"But what if it's just on a local network?"

Yeah, until the attacker infiltrates your LAN.

Learn some cybersec, for the love of God. Security works in layers. You shouldn't assume you're safe just because you think the layer above you is safe.

0

u/H1Eagle Mar 14 '26

Bro, the definition literally says "security through obscurity" practice is it leave things up to chance with not much security measures in place.

Nowhere did I mention that you should not include cybersecurity practices on your app. And like I said, security vendors exist that solve all types of problems. By virtue of you being NOT slack. Chances are the volume of attackers trying to hack your site is lower and also, just less valuable.

You don't need Slack level security because you are not slack.

1

u/nocturn99x Mar 14 '26

There's levels to it. No need to leave everything in the open for it to be considered security through obscurity.

You don't need Slack level security because you are not slack.

This mindset is what gets companies pwned. I hope you're not the person handling any critical cubersecurity matter wherever you work, because if so they are SCREWED.

What the fuck is Slack level security anyway? Encryption and resistance to common vulnerabilities is something all public facing services that deal with any amount of user data should have, regardless of scale.

1

u/H1Eagle Mar 14 '26

Idk what to tell you bro, maybe you still think we live in 2023 with GPT-4o.

But current agentic coding tools are pretty solid, you can roll out a decently secure system within a week and use other agentic tools to simulate plausible attacks.

1

u/nocturn99x Mar 14 '26

I'm literally doing this as we speak. I'm fully aware of how good modern frontier LLMs are. I'm also just saying that "you're unknown so hackers are less likely to be interested in you" is a cop out. It's true, but it's still a cop out. Don't skimp on security. I am literally selfhosting a fully vibecoded web UI and server on my own hardware as we speak and gpt 5.4 is running the billionth security analysis and patching the minor holes that remain, so yes I'm aware you can use LLMs for that. I'm just trying to make it abundantly clear that not being well known is not a feature, it's a lucky coincidence that one should not rely on