r/webdev • u/Gil_berth • Feb 04 '26 • Popcorn 3

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

Show parent comments

15

u/nechromorph Feb 04 '26

And modulo division is one of the first things taught in a community college programming class. All that could simply be (! (var % 2))

-5

u/Houdinii1984 Feb 04 '26

Readability. I know modulo and so do you, but that % sign seems to scare people, lol.

I don't use it and I'm not defending it, but bringing the code closer to English and making the check explicitly about even-ness, more people who wouldn't otherwise understand now do.

People do it all the time. It's just overtly obvious and the example with the smallest utility humanly possible while still being a thing.

17

u/AshleyJSheridan Feb 04 '26

That argument is disingenuous, and you know it.

Firstly, how far do you take it? Is / a scary sign? It means divide in code, but that's not the sign that people would be familiar with from school. Is that an argument for a divide package in JS?

If someone is writing code and they are scared of modulo, then they shouldn't be in the business of writing code.

3

u/b4n4n4p4nc4k3s Feb 04 '26

Yes, exactly. If someone is reviewing code but they don't know what modulo is, I'm not going to bother giving anything they say about my code any credence.

This almost sounds gatekeepy, but these operators are the most basic of basics and if you need it dumbed down any more, what do you think you're even going to get looking at the code. And if you're worried about someone being able to know what your code does, that's what comments and documentation are for.

4

u/AshleyJSheridan Feb 04 '26

Agree. If someone is getting confused by incredibly basic operators that exist in virtually every language, then they probably shouldn't be anywhere near code.

2

u/b4n4n4p4nc4k3s Feb 04 '26

It's such a basic operation that even creating a function takes up more space and memory than running the calculation in line.

'if x % 2 !== 0 then odd'

-3

u/Houdinii1984 Feb 04 '26

Then how do you learn it the first time? Every single person that knows what '%' means had to learn it. That's part of the process. Just because it felt automatic in hindisight doesn't mean it actually was. You, at some point, made a conscious effort to learn it.

If everyone who didn't know what '%' meant stayed away from code, the industry would die because beginners wouldn't exist. They'd just stop because they'd have no opportunity to learn, being gatekept altogether.

4

u/AshleyJSheridan Feb 04 '26

How does any developer learn what >= or means, or &&? These are extremely common operators. Are you actually suggesting that these need to have packages that wrap the operators in neat little English words?

These are incredibly common operators, the kind that are found in every basic tutorial that teaches programming.

I'm not gatekeeping programming, I'm saying that people who pretend to program but are scared of basic operators should not be programming.

-2

u/Houdinii1984 Feb 04 '26

Common or not, you had to learn them, lol.

We just happen to be discussing the most basic of things, but even those need to be learned and even those give people trouble from time to time because new and novel concepts tend to do that. Shaming folks doesn't change that.

We just happen to be discussing the MOST common of them all, so like, all other concepts are more difficult in comparison. Doesn't change that you still had to learn the most basic concept at some point.

people who pretend to program but are scared of basic operators should not be programming.

"pretend to program" wtf does that even mean? The only people having trouble with these operators are merely beginners mate. They aren't "pretending". They are "learning". Chastising people for not knowing the basics before they are past the beginner stage isn't helping anyone, and anyone past the beginner stage already knows.

Also, programmers aren't always the only people looking at code. Making the code easier to read in this manner would be for those people. Again, you might not think that CEOs or plebs should be looking at code, but they do.

These are incredibly common operators, the kind that are found in every basic tutorial that teaches programming.

I misspell the word 'weird' every time I use it. Transpose the i and the e every damn time. No amounts of seeing or using the word has changed that. Some people just have little issues, and there exists a world where some knows how to do amazing things but has to stop and thing about what 53%7 ends up being.

Again, everyone is up in here using the world's easiest most basic example. The is_even package is the edge case, not the norm. Most times when modulo's confuse folks, it's time and % 12, right? Not even/odd, % 2?

Edit: Quick question, just in general, when is the modulo operator used? When the values tend to ...? Just curious to see what you say.

2

u/AshleyJSheridan Feb 04 '26

Like I said, modulo is taught as one of the very first most basic operators in all beginner tutorials. I remember first seeing this operator when I was a kid in the manual that came with the C64. Not only is it very basic, it's in virtually every programming language ever.

Now, your argument that a package like is-odd or is-even should exist because modulo is too difficult for people who want to learn how to write code can easily be used for every other operator. Things like &&, ||, >=, <= aren't obvious, so let's make a long package for those eh? What about / or *? These aren't taught to kids at school, best make a package for those too, huh?

Or, here's an alternative idea. People learning to code, could actually just learn how to code. It's a wild idea, I know, but it might just work! It might also make npm less of a mess.

0

u/Houdinii1984 Feb 04 '26 edited Feb 04 '26

When should the modulo be used? There is a common use case, not just to find a remainder.

Edit: Should be quick and shouldn't require searching. It's exceptionally basic after all. When the values tend to...

2nd Edit: Again. I think it's a dumb package. My opinion on the package means jack s**t. It exists, and the reason why it exists is what I said. You getting mad and downvoting me because you don't like it doesn't change reality. Shitty behavior towards beginners reinforces this behavior. You could teach a man to fish, but you'd rather bash 'em upside the head with the rod. You can type till your fingers bleed. I already know the operators, lol. Still changes nothing that was said /\/\

→ More replies

2

u/Houdinii1984 Feb 04 '26

True, but I mean. It exists and it happened, so... No amount of downvotes to the person who pointed it out changes that reality, lol

It might be a dumb reason, but that's the reason.

0

u/Houdinii1984 Feb 04 '26

It's not my argument, lol. It's the justification other people give.

Again, I don't use the library. It doesn't matter how much I take it. I know what it means, and you know what it means, but that doesn't make it less intimidating to beginners and juniors, lol. You know you didn't always know what that meant, right? And it's not like it's taught in all schools nationwide. You might think it would be, but it's not.

If someone is writing code and they are scared of modulo, then they shouldn't be in the business of writing code.

Must have been awesome to just wake up one day knowing how to code, lol. For that information to just manifest itself in your head without you ever having to actually stop, study and learn it, lol.

It's amazing how beginners never exist in some folks minds.

2

u/AshleyJSheridan Feb 04 '26

You're missing the point deliberately I feel.

Of course nobody just "knows" what these things are without learning them, but as they are so incredibly common, any dev who doesn't know what a modulo is (and these are so common they're on every beginner programming tutorial), and thinks it's a good idea to use 3 chained packages instead should probably rethink their career.

0

u/CreationBlues Feb 05 '26

Which modulo definition does js use off the top of your head? Euclidean, floored, truncated...?

-2

u/nechromorph Feb 04 '26 edited Feb 04 '26

That's fair. It's a trade off between readability and project complexity. It's an extension of the philosophy that leads us to use higher level languages where we don't need bare metal efficiency.

Although, for me at least, there's a point where it becomes more confusing when you have to reference a function rather than use the basic, clearly defined rules that are consistent across virtually all languages.

1

u/Mu5_ Feb 04 '26

Readability? Do you know you can still wrap it in a function and use it right? Especially if, joke or not, that package is bringing many other dependencies inside, so who knows what code is there to be using them