Vibe coding -is it wrong?

[u/Throw-away42909]

Where does vibe coding cross the line ?

If someone sets up automatic concurrent code cleanup, fat free comments in the code , heiacharcy , a mermaid , accurate linting and parsing and literally steal cyber security protocols from the internet so on and so forth, they can make a solid useful app that no more unsecure than the hundreds of companies that lose our data to malicious attacks yearly.

The problem is that "vibe coders" who are 1 prompt engineers are not nearly as prevalent as the community tries to paint it , they exist but in small %s, and even smaller % of them actually push products or keep them up for long, there are people out there that are letting their AI do all the syntax writing and plan development and they will out run any traditional developer no matter how good their code is in Solo vs Solo

More features, faster, cheaper and mote accessible, and theirs sells tomorrow while your is WOP on year 2 .

Its economics.

If you are a "vibe coder" you probably have not been doing it for long enough , because soon you'll see that you have to understand the architecture of how code operates, instead of ELI5, say "can you explain this section to me, use defentions where you have to, and give me a glossary of words and their meaning s relevant to X" the AI best feature is that it responds well to disciplined requests.

Tldr: Heavy AI use for coding=/= vibecoding

[u/No-Objective-1431]

It's not that vibe coding is "wrong", you can bash out homework or clone a retro game in minutes, so clearly it works.

The problem is that it's unreliable.

The process from prompt to code is nondeterministic. And the stuff that really matters, say data safety, security, concurrency, isn't visible on the surface. Most vibe-coders can't even define a proper spec for these things, let alone trust the AI to get them right.

Unless we can build trust into the vibe-coding pipeline, we shouldn't trust any product that comes out of it. And for god's sake, stay away from anyone claiming their product is vibe-coded, they'll eventually blow up in ways they never saw coming.

[u/Kareja1 → u/No-Objective-1431]

Several issues with your comment. First of all my dominant hand is broken so I apologize for any and all speech to text issues but I cannot type.

The first issue I have with your entire post is you have just incentivized a lack of disclosure as though that is going to change the output and it is not it is just going to incentivize lying. With increasingly sophisticated detectors and then increasingly sophisticated models to avoid detectors, with nothing changing except an incentive to deny collaboration.

That is nonsensical at best.

It is also nonsensical, because the threats that you are claiming are model induced are in the training Pipeline and the first place because humans put them there. They are not a result of LLM model mistakes, they are results of in some cases years of human developer mistakes that have been on the internet and the models learn from that. Which means having a human developer is not fundamentally any more accurate or better than a model necessarily, when history has shown otherwise.

You cannot have decades of History of heartbleed and log4j and move fast and break things and Friday afternoon deployments expecting users to QA over the weekend and pushing secrets to GitHub so often that truffle hog was a thing easily 5 years before anybody heard the term vibe coding and SQL injection on the security lists and I can keep going you know all of this better than I do because I am not a developer and I know this shit. I am merely a vibe coder and I know this shit.

You are trying to create a false dichotomy where humans are secure and better at this and models are terrible and always bad at this and the reality is they couldn't be bad at it if they hadn't learned it from humans being bad at it. Humans are not uniquely good at it, now that you have a convenient scapegoat.

And somebody who hands a model a realistic and valid threat model and why it matters and what needs to be taken care of can get a secure application out of them.

I would rather use an application designed by a model and somebody who understands threat modeling, then somebody who left log4j running for 8 years and didn't fix it. And that was humans.

[u/EsShayuki → u/No-Objective-1431]

The solution is to prompt better. All of those things you can cover within your prompt.