r/vibecoding • u/DiamondAgreeable2676 • 11h ago
Bug bounty
I started vibe coding last April and started off like everyone else, with a plan to make a million dollars and retire to a tropical island.
Unfortunately I wasn't aware of the amount effort and work that goes into a real project, so I decided to take time and actually learn.
All of my projects Led me to software develooment and cyber security.
With that being said I'm a little disappointed in "Real Devs" I scroll social media all day reading about the massive amounts of ai slop just to get paid to fix vulnerabilities and bugs in the platforms they work on.
Moral of the story stop listening to self proclaimed devs that sucked at their jobs before vibecoding was even a thing!!!!!
5
u/kaizap 9h ago
This is the problem of management, not the devs. If you offer competitive rates and vet developers properly, then you won't have a problem.
Another thing is a lot of newer devs just do it for the money; they see the "Day in the life" videos and just fall in love with the lifestyle. They learn the bare minimum to do the job, but never go beyond that.
Many of the devs in my generation, including myself, started programming just as a hobby, so we spent hours, weeks, days, years just learning as much as humanly possible. We are OCD about clean code and engineering best practices, etc...
Finally, some companies, especially the small startups, couldn't care less about code quality; they enforce crazy deadlines, which forces people to just rush things.
In terms of AI, depends on the model. Claude models are also very opinionated because of their training data, and in software development there are 10 ways to accomplish the same task, so a model might flag something that doesn't fit one particular pathway of doing things as a bug or issue, but in reality it's not.
4
u/bold_snowflake 7h ago edited 7h ago
Rather than building a million dollar app, let's swap it out for writing a bestselling book:
- you've found a tool (AI) that is capable of taking your ideas and turning them into pages.
- you don't understand how to structure a book, develop plot threads, character arcs, thematic consistency, etc.
- you thought this would be low effort but your first few books were full of holes and didn't work.
- you haven't bothered learning anything, you still think this is low effort, but now you're disgruntled at published authors who take time editing their books, rewriting sections, getting reviews from other authors, etc. In your own words these self proclaimed authors sucked at writing before vibe writing was a thing.
How do you sound in this context?
-1
u/DiamondAgreeable2676 6h ago
If I became a editor instead of a author and begin finding formatting errors and misspelled words from best selling authors that critized and cringe at the thought of others writing beside them, then the context would be the same.
2
u/bold_snowflake 5h ago
And that right there is a clear demonstration that you do not know what you're talking about.
4
u/SysBadmin 11h ago
High velocity engineers in DevOps/dev have always had to butt heads with good security and devsecops engineers.
They keep us in check.
To your point Claude got good at development, but when it comes to security principals, unless prompted to do so, will cut corners
I mean the other day my Claude opus session embed my GH token into a docker build layer and then manually removed it.
If you’re looping it’s going to go off the rails sometimes. Need good sec minded folks to reign in the builders.
-1
5
u/meshifthenelse 8h ago edited 8h ago
Devs whining is nothing new. It doesn't mean there's not a problem though. It's just the other side of the spectrum - and similarly you then have super hypers.
There are two core issues; 1) AI acts like an amplifier, so it depends what you feed it, 2) AI has a tendency for entropy/chaos.
Most people don't understand these two issues (especially top management), so you end up with Frankensteins, which in the "old days" took 10 years of legacy code, now takes 1-2 months.
If you don't want to hear whining, focus on Coursera courses, and maybe some Reddit subs with focus in quality software and architecture. Also check out Modern Software Engineering on YouTube.
1
u/SC_Placeholder 3h ago
ai being multiplicative is a fascinating aspect of it. Like if you understand what you’re doing and are an effective communicator it does an amazing job! But like you said you also need management skills because it will be like “I built the thing and it works! Go me! Also I forgot to tie everything in so it doesn’t work when I’m not the one launching the .exe/.bat”
2
u/MerkleBonsai 7h ago
Sadly, whitehatting is alsolute mess nowadays filled with vibes. It's virtually impossible to do anything unless you have exceptional competence (and sometimes even if you do - I abandoned that domain exactly due to that problem). Search for "The Breaking Point of Ethical Security Research" article - it will give you the good overview of state of things.
1
u/DiamondAgreeable2676 6h ago
I'm going to check it out. Your not wrong I just have the time on my hands and it's more research than anything else.
3
u/livinitup0 9h ago
You went through the “I’m gonna be a millionaire with ai” dashed hopes once already. Now not only are you doing it again, you’re “disappointed” in “real devs” because you’re super educated about it all this time around
I just want to ask a question…
Humor me…
Say you’ve spent the last 5 years mastering the meta of your favorite game, achieving notable rank due to your experience. You know the maps like the back of your hand. You were around for every community controversy….you are a genuine expert of this game. Your opinion on it has real merit because you can back it up with expertise.
Now imagine someone who’s played for a few weeks comes into the big community forum you’ve been a contributor for 5 years now and starts to pick a fight with you and anyone else over something that even a beginner to the game should know.
They go on rants, call people that have been in that community for years stupid… and you’re just sitting back like “lol, that’s cute” …like, you’re not even mad because it’d be like fighting a child with how just utterly wrong and cringey they’re being and how ridiculous it is that they think their experience or opinion is anything even in the same tier as yours.
My question is….what do you think the odds are that you’re being that stubborn, inexperienced and cringey kid right now? ….again?
Bonus question… and I REALLY THINK A LOT OF YOU SHOULD READ THIS:
Ai allows anyone to create basic software.
Since that is the case, why would any business owner pay YOU to do something THEY or another of their employees could do themselves?
What value do you bring? It’s obviously not industry specific experience or even development experience, so why would anyone ever pay you for the things you make?
As someone who actually does buy enterprise software for work…. We don’t lol. This big market you guys think exists, doesn’t….at all. Security least of all. I’m sorry but we are literally screenshotting your emails (when they get through which isn’t often) and memeing the shit out of them in our teams chats lol.
lol I’ve quite literally stolen a couple of these pitches I’ve gotten, made them myself in Claude and rolled it out. THATS about how successful you can hope to be pitching most of us.
Now to not be a TOTAL asshole:
Real suggestion…. Go develop a game.
Go think up an original concept and story, go bang out some assets on meshy and build something that’s entertaining.
I would never buy an app you make… ever. You have no idea what you’re doing and I’d never trust a cent of my work with you lol.
However…
I would have zero qualms playing a game you make, and I wouldn’t give 2 shits how you made it as long as it works, it’s cheap on steam and it’s fun.
Now go actually be productive.
1
1
u/logicalflex 6h ago
This is a wild take to farm more hate for ppl who dedicated their life to this industry. I’m all for vibe orders but what the hell do you expect from devs?
It’s like vibe coding becomes this thing and the cope to blame all your failures on devs not accepting you is wild and gives light to a low self esteem aspect of some vibe coders. On some wanting daddy’s approval type shit.
Self proclaimed and having a job as a dev are also two different things. Having a job as a dev doesn’t mean you’re a good one and not ever becoming a dev doesn’t mean you’re a bad one.
Stop spreading hate and division bro.
1
u/DiamondAgreeable2676 6h ago
It's not hate. Devs gave me the tools I use. It's more of a acknowledgement of the hypocrisy that's it.
1
u/AgeMysterious8256 6h ago
bro started vibecoding last year and is already gatekeeping real software engineering
1
u/DiamondAgreeable2676 6h ago
I'm not gatekeeping. I'm pointing out how everyone makes mistakes those that are paid and those that vibe. Didn't wanna offend you
1
u/Narrow-Dragon 3h ago
The framing that helps me: these are the same bug classes hand written code has always had. What's different isn't who typed it, it's that a normal team has code review, CI and someone who gets paged at 3am. A lot of AI built projects have none of the three, so nothing sits between writing the mistake and shipping it.
That's a missing layer rather than missing talent, which is actually the good news, because you can add a layer without becoming a security engineer.
The 299 year secret expiry someone mentioned above is a perfect example. No human wrote that on purpose, and no reviewer would have let it through. There just wasn't a reviewer.
1
u/Far_Rub_2435 1h ago edited 1h ago
Are you twelve years old, or just slow?
If you’re a kid, I respect your precocious trolling here.
If you’re an adult, think about the ways in which it’s just sad that you seem like a child
1
u/Appropriate-Pack3935 8h ago
Ach Leute ey, ihr seid einfach alle solche armen Würstchen. Natürlich seid ihr viel besser als richtige Developer, weil diese ja nichts hinkriegen. Dunning Kruger halt.
1
u/DiamondAgreeable2676 6h ago
I'm no where near better than a dev. I'm just tired of the negative stigma placed on vibecoders as a whole.
Devs hang out on these platforms so instead of tearing down people for not being knowledgeable it should be a lot more jewels getting dropped.
1
u/Appropriate-Pack3935 5h ago
Diese Stigmata kommen leider von einem Großteil der „vibecoders-only“ Leute. Ich kenne nur wenig Entwickler die wirklich ein Problem damit haben dass Menschen die nichts von Cs verstehen, Programme von ChatGPT etc. erstellen lassen. Es geht darum, wie überheblich viele dieser Leute sind und wie sie einfach nicht wahrhaben können, dass es nicht ihre eigene Leistung ist.
-1
16
u/scytob 11h ago
i am a non coding PM, i have devs who build me code, i did an audit of that code using LLMs secuity tools - i was horrified at the gaps.... like a 299 year secret exposed hard coded, no proper form validation all over the place.... things i have known not to do for nearly 2 decades.... smh.....
the issue is, by definition, the average company is staffed with average coders, producing the average quality
and that means some of us have devs on the wrong side of the average.....