The nicest thing I saw today

all 34 comments

sorted by: hot top controversial new old
[–] 145 points 9 months ago (7 children)

I feel like people are going to look back at the vibe coding era and wonder if we were all drunk...

  • source
  • hideshow 7 child comments
  • [–] 35 points 9 months ago (5 children)

    I worked with a guy in the '90s who swore he did some of his best coding after our usual Friday after-work beers (the bar was next door).

  • source
  • parent
  • hideshow 5 child comments
  • [–] [S] 57 points 9 months ago

    I checked their website and its fixed now

  • source
  • [–] 42 points 9 months ago (1 child)

    When pointed out, the vibe coder will prompt: "How can I stop developer tools from working on my website?"

  • source
  • hideshow 1 child comment
  • [–] 6 points 9 months ago

    "What a great question! You've clearly considered the security implications of putting development tools in the hands of an end user, you are a pioneer in the field of cyber security!...."

    Proceeds to provide unrelated advice about disabling Https certification

  • source
  • parent
  • [–] 78 points 9 months ago (8 children)

    No vibe coding needed. Many years ago, my friend, a new yet overly-confident web developer, pulled the entire list of usernames and passwords from the back-end when the login page opened. It was to "check if password is correct faster".

    (And yes, he stored passwords in plaintext)

  • source
  • hideshow 8 child comments
  • [–] 16 points 9 months ago (3 children)

    And why is the database storing the passwords in plain text? Sure the web dev is wrong, but the back end guy is not the brightest either.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 9 months ago

    That was pretty common some years back. Earlier versions of popular discussion boards like phpBB and stuff would store everything in the mysql db in plain text. The practice only changed when sql injections became popular with script kiddies. Malicious admins would also just check user's email and password and try them elsewhere, reusing passwords was even more commonplace then than it still is today.

  • source
  • parent
  • [–] 26 points 9 months ago*

    I remember one of my friends found a Vibe coded tool that did a similar thing, it had the supabase key on the client where anyone can see.

  • source
  • [–] 52 points 9 months ago (1 child)

    obvious solution is to vibe legislate a law to prohibit opening developer tools on other people's websites

  • source
  • hideshow 1 child comment
  • [–] 28 points 9 months ago

    The UK already did that iirc. Up to 10 years for having "hacking tools" installed, where "hacking tools" is ill defined and could reasonably interpreted as a tool that could be used for hacking, like for example, a browser with dev tools...

  • source
  • parent
  • [–] 17 points 9 months ago (1 child)

    what is the waitlist? to use the expense tracker?

  • source
  • hideshow 1 child comment
  • [–] 11 points 9 months ago

    Looks good, push it ✅💯

  • source
  • [–] 10 points 9 months ago (1 child)

    I always assumed those numbers are the result of some function like Math.random()*100...

  • source
  • hideshow 1 child comment
  • [–] 8 points 9 months ago (1 child)

    Wait so everyone’s emails are just stored in JavaScript that anyone can see in their web browsers inspect tool? That’s a new level of if fail.

  • source
  • hideshow 1 child comment
  • [–] 6 points 9 months ago (1 child)

    That static JSON I'm seeing; isn't it possible that some server-side script, invisible to the user, could pre-generate that based on real numbers? (Not saying that it's the case here, just curious)

  • source
  • hideshow 1 child comment
  • [–] 4 points 9 months ago
    [–] 1 point 9 months ago

    I've seen this vulnerability before but it was in websockets, all the connected user details were listed.

  • source