Comment by mathfailure
5 hours ago
I do. I care. And there are dozens of us.
Lots of infected programs provide value. It has nothing to do with being or not being infected.
If a project was vibecoded in a weekend - there are less chances that it will still be maintained in a, say, year or two.
But if it is open source you could maintain it? It could be "done" for a given state of affairs (protocol/API versions etc)?
Of course you could, but if it was indeed vibe-coded in a weekend, why wouldn't you want to start from scratch to make sure everything is up to your standards (especially security)?
I'm definitely not going to jump in on a vibe-coded project. I'd much rather start from scratch if I found the use-case to be relevant.
Not to say vibe-coded projects can't be alright. If the engineer behind it knows their stuff, it's fine to me. But we don't know that. So to get a general idea, I think it's fair to ask how this was done.
Such action has non-zero cost/effort. Do I really want to pay it? I am not sure.
Don't give programs unnecessary access - problem solved
That's a good advice in general to treat any software as untrusted black box as much as possible. But it raises (slightly, but still does) the cost/effort for the user: the user now has to make extra steps and take extra caution.
These concerns were great valid even before vibecoding becoming a thing, but now the estimated probabilities of malicious code's presence have changed, simply because nowadays the cost/effort of writing software plummeted.