I feel like people are going to look back at the vibe coding era and wonder if we were all drunk...

I feel like people are going to look back at the vibe coding era and wonder if we were all drunk...

When pointed out, the vibe coder will prompt: "How can I stop developer tools from working on my website?"
"What a great question! You've clearly considered the security implications of putting development tools in the hands of an end user, you are a pioneer in the field of cyber security!...."
Proceeds to provide unrelated advice about disabling Https certification
No vibe coding needed. Many years ago, my friend, a new yet overly-confident web developer, pulled the entire list of usernames and passwords from the back-end when the login page opened. It was to "check if password is correct faster".
(And yes, he stored passwords in plaintext)
Maybe the entire database should be downloaded into the browser. Then it'll go really, really fast!
It was faster?
And why is the database storing the passwords in plain text? Sure the web dev is wrong, but the back end guy is not the brightest either.
Having been there, it's probably the same guy, lol
Sometimes you really do just gotta learn the hard way.
That was pretty common some years back. Earlier versions of popular discussion boards like phpBB and stuff would store everything in the mysql db in plain text. The practice only changed when sql injections became popular with script kiddies. Malicious admins would also just check user's email and password and try them elsewhere, reusing passwords was even more commonplace then than it still is today.
I remember one of my friends found a Vibe coded tool that did a similar thing, it had the supabase key on the client where anyone can see.
obvious solution is to vibe legislate a law to prohibit opening developer tools on other people's websites
what is the waitlist? to use the expense tracker?
I always assumed those numbers are the result of some function like Math.random()*100...
Wait so everyone’s emails are just stored in JavaScript that anyone can see in their web browsers inspect tool? That’s a new level of if fail.
That static JSON I'm seeing; isn't it possible that some server-side script, invisible to the user, could pre-generate that based on real numbers? (Not saying that it's the case here, just curious)
I've seen this vulnerability before but it was in websockets, all the connected user details were listed.
all 34 comments