Removing security measures by vibe coding when vibe coding is making cybersecurity more relevant than ever, has many layers of irony and this feels like the prologue to a bad comedy movie. People...
Removing security measures by vibe coding when vibe coding is making cybersecurity more relevant than ever, has many layers of irony and this feels like the prologue to a bad comedy movie.
People who used their password there for other places are going to get fucked if the backend is as messy as this. And apparently people have their credit card info there? If so this might as well be like leaving your curtains open in the night while having a few gold bars sitting on the table.
I just hope for many people this isn't as bad as how it looks.
Reading your comment, I had to check if mine was on there. Maybe I'm missing something, but for whatever reason, the only way I could find if it was on there was by adding something to my cart and...
And apparently people have their credit card info there?
Reading your comment, I had to check if mine was on there. Maybe I'm missing something, but for whatever reason, the only way I could find if it was on there was by adding something to my cart and going to checkout. What a mess.
I can see mine under Payment Method on my account page. Also, there's no actual way to delete it, so it's stuck there. (Everyone feel free to roast me for saving my credit card information to a...
I can see mine under Payment Method on my account page.
Also, there's no actual way to delete it, so it's stuck there.
(Everyone feel free to roast me for saving my credit card information to a site. I deserve it.)
I wasn't able to remove mine either but I used an old prepaid card I had sitting around and it accepted it while appearing to remove my old card info. Can't say for sure my card has actually been...
I wasn't able to remove mine either but I used an old prepaid card I had sitting around and it accepted it while appearing to remove my old card info. Can't say for sure my card has actually been removed but hopefully its better than nothing
Posting this here for awareness, since I see a lot of chatter around the monthly choice bundles. I had been wondering what was up since I got an activation code in my last bundle that had already...
Posting this here for awareness, since I see a lot of chatter around the monthly choice bundles. I had been wondering what was up since I got an activation code in my last bundle that had already been used by another account (?!) but this explains a lot of the jank.
Oof... So we should consider any activation codes possibly exposed? I'll have to test my bundles for any keys I want for sure. I usually do that during the Tildes giveaway period. Speaking of,...
Oof... So we should consider any activation codes possibly exposed? I'll have to test my bundles for any keys I want for sure. I usually do that during the Tildes giveaway period. Speaking of, sounds like this year's giveaway is going to be even more of a gamble with Humble keys...
I usually give the benefit of the doubt but… Yeah, one look at the front page and my “vibe code suspicion detector” fired off. Removal of the 2FA plus being able to change password without at...
I usually give the benefit of the doubt but… Yeah, one look at the front page and my “vibe code suspicion detector” fired off. Removal of the 2FA plus being able to change password without at least an email verification is also a strong indicator.
I use LLMs for work but like, I’m just a data analyst. I worry about my work being perceived as sloppy so I stay in the loop every step of the way. Claude might be writing the code but I make sure that it does what it’s supposed to do. So, even though some of my reports could be vibe coded in minutes, I still prefer to spend hours to make sure I know what I am delivering.
But then I see examples like this, where your work will be shown to millions of people, and every step of the way, where everyone involved must have said “sure, ship it”, and I’m scratching my head what these guys are even thinking
Edit: oh jeez. I went there to delete my payment info, and I can't find where to access my profile.... I also can't add anything to the cart.
https://www.humblebundle.com/store , here the "hot pre-orders" section is a buggy mess. If you click it may or may not open the page, but it will always rotate the games.
Yeah, they vibe coded this without care or concern. Will see if I can remove my payment info, if not I'm going to straight up block them and request to delete all my info
A lot of people push the narrative that LLMs are better than humans at coding now, and that human software engineers in the mix are a weak link. I think this is the kind of thing we're going to...
A lot of people push the narrative that LLMs are better than humans at coding now, and that human software engineers in the mix are a weak link. I think this is the kind of thing we're going to see more and more as people high up in the food chain who don't actually know anything about software development start to believe it, and as more and more experienced developers who know better burn out under their thumbs.
We're well beyond "start". For some reason the people I meet that are the most evangelical are directors or board members or founders, it's weird. Hell my own company's founder wants me to move...
start to believe it
We're well beyond "start".
For some reason the people I meet that are the most evangelical are directors or board members or founders, it's weird.
Hell my own company's founder wants me to move the dev team to daily releases. Totally a bad idea in our case but it's a never ending tug of war regardless.
The argument of "I'll hire two freelancers to do this in two weeks" has been dropped more than once too.
All because they can whip up a redesign in something like lovable in a day it means all of software dev must be the same.. right!?
I work for a small publishing collective owned by a very nice guy who bought the company so his kids could be employed (he doesn't draw a salary and he's extremely hands off) but every so often...
I work for a small publishing collective owned by a very nice guy who bought the company so his kids could be employed (he doesn't draw a salary and he's extremely hands off) but every so often he'll pop in and encourage us to use AI tools as much as possible and I can't imagine where he's even getting the notion that that could be a good idea for us in any way. Thankfully we can just smile and nod and he'll let it go for a while after that.
It's a Dunning-Kruger and Chesterton's Fence maximizer. The hardcore vibe coding evangelists are typically inexperienced but think they know better than people with years or decades of industry...
It's a Dunning-Kruger and Chesterton's Fence maximizer. The hardcore vibe coding evangelists are typically inexperienced but think they know better than people with years or decades of industry experience, and their carelessness is essentially being carried on the backs of those experienced people. Who, like you say, are increasingly stressed and at risk of burning out. Lazy and frequent PRs require more mental energy from the more senior developers, essential shifting work onto them.
And the LLMs only work well because they're often operating on code bases that are organized and well cared for, but the vibe coding is basically dumping toxic runoff into them. Which is a price to be paid later, so neither the vibe coders nor their management care until something cataclysmic like this happens.
There are a disturbing number of people on Hacker News arguing for not reading code or doing PR review at all. Which is just bald faced engineering malpractice and I'm livid that we lack proper licensing for software engineering as a result of this insanity.
Coding agents are fancy but they’re still just software. They don’t have mind-reading magic. I think people let their guards down because LLMs seem so good at inferring intent. But if you never...
Coding agents are fancy but they’re still just software. They don’t have mind-reading magic. I think people let their guards down because LLMs seem so good at inferring intent. But if you never even had intent in the first place what are they supposed to do? You’ve got to give them something to work with.
If they’d just spent a few cycles with their agent, prompting it to “analyze the codebase for security holes, vulnerabilities, privacy risks, and e-commerce antipatterns” it would’ve fixed most of this stuff immediately. They don’t even need to know what any of those things are, just point the LLM in the right direction and let it loose. If they really cared to, they could’ve set up a (Ralph Wiggum) loop with that prompt that just keeps scanning for problems and fixing them until it can’t find any more. But the problem is, they didn’t care to at all.
Which is a major red flag, not just for the site redesign, but for the company as a whole. It should be for any company.
Thanks mate! But, I got this: what a mess.... I decided to just open a ticket and requested them to delete any payment info I have
Thanks mate!
But, I got this:
Oops, something went wrong!
Minified React error #441; visit https://react.dev/errors/441 for the full message or use the non-minified dev environment for full errors and additional helpful warnings.
Error Digest: 1030952670
what a mess....
I decided to just open a ticket and requested them to delete any payment info I have
Ai-ya. Maybe because I'm in the US I'm getting priority or something? What a cluster this is turning into... I may block them with my payment provider just to be sure.
Ai-ya. Maybe because I'm in the US I'm getting priority or something? What a cluster this is turning into... I may block them with my payment provider just to be sure.
Off-topic, but is there a reason everybody seems to use purple gradients and accent colors now? Is that a Claude/vibecoding thing? Purple is actually my favorite color, so I thought it was cool...
Off-topic, but is there a reason everybody seems to use purple gradients and accent colors now? Is that a Claude/vibecoding thing?
Purple is actually my favorite color, so I thought it was cool when I started seeing it more, but it seems like it's everywhere now -- especially on sites/apps that people accuse of being vibecoded.
Purple was never part of Humble's color scheme in the past, so it's weird to see it so prominent in this redesign.
Yes, Claude (and others I believe) default to gradient colors, and uses purple a lot. It's why Anthropic made "Claude Design", which is basically a place where you can define your own design style...
Yes, Claude (and others I believe) default to gradient colors, and uses purple a lot. It's why Anthropic made "Claude Design", which is basically a place where you can define your own design style and rules, and Claude will use it for reference.
But that's the thing... There are also a myriad of repositories meant to "unslop" webpages (and some of them, imo, are genuinely good), which basically have instructions to contradict these tendencies that LLM's have. It feels such an obvious thing that they could've used. But from my glancing, it feels like they really just went "claude, remake my webpage, make no mistakes, I'll sue you" and that was the output.
I'm wondering if there were any designers involved... Or even tech people... Idk, it's like I said in my other comment, I don't know what they were thinking.
I’ve seen LLMs blamed for gradients quite a lot, so I think it’s exactly that. Purple is my favorite color too. Many of the LLM revisions I did to audiobookcovers.com included purple or purple...
I’ve seen LLMs blamed for gradients quite a lot, so I think it’s exactly that. Purple is my favorite color too. Many of the LLM revisions I did to audiobookcovers.com included purple or purple gradients. (Not going to apologize for LLM design; I am not a designer. But most of the code was first drafted by LLM and then rewritten by me, sometimes quite extensively.)
Godshitfuck. Yeah it allows me to change mail and pw without any confirmation or verification. The main ui looks worse than the old one. And unlike some people (maybe they already started fixing...
Godshitfuck.
Yeah it allows me to change mail and pw without any confirmation or verification.
The main ui looks worse than the old one.
And unlike some people (maybe they already started fixing things?) I did get a 2FA request correctly when logging in. But even the UI for that was glitching out.
I removed as much as I could; cancelled Choice, which seems to have also deleted my payment method, fingers crossed, and removed my links to my gaming accounts as well. As much as I can be, I'm...
I removed as much as I could; cancelled Choice, which seems to have also deleted my payment method, fingers crossed, and removed my links to my gaming accounts as well. As much as I can be, I'm done with Humble. It's been a lot of small things up to now, nothing much to go running to everyone to complain about, but I haven't liked their direction for awhile and this was the final straw.
Edit: just logged in and access to my profile from the main page was removed. I had to do a weird work-around where I went to their main "About' page, which mentioned Humble Choice which I clicked for "more" and that had the profile icon at the upper-right again. Here's the direct URL for anyone that needs it: https://www.humblebundle.com/user/settings
I work in security and trying to access my profile after the redesign just gave me a huge creepout feeling. I canceled choice but not until accidentally clicking the "Give me my games now" link on...
I work in security and trying to access my profile after the redesign just gave me a huge creepout feeling. I canceled choice but not until accidentally clicking the "Give me my games now" link on the choice page which immediately charged my card with no confirmation or way to cancel after that link click. I've since canceled my choice membership and left them a support request explaining exactly why. Removing TOTP for any reason is unacceptable in this day and age, especially when users specifically opted into using it.
Removing security measures by vibe coding when vibe coding is making cybersecurity more relevant than ever, has many layers of irony and this feels like the prologue to a bad comedy movie.
People who used their password there for other places are going to get fucked if the backend is as messy as this. And apparently people have their credit card info there? If so this might as well be like leaving your curtains open in the night while having a few gold bars sitting on the table.
I just hope for many people this isn't as bad as how it looks.
Reading your comment, I had to check if mine was on there. Maybe I'm missing something, but for whatever reason, the only way I could find if it was on there was by adding something to my cart and going to checkout. What a mess.
I can see mine under Payment Method on my account page.
Also, there's no actual way to delete it, so it's stuck there.
(Everyone feel free to roast me for saving my credit card information to a site. I deserve it.)
I wasn't able to remove mine either but I used an old prepaid card I had sitting around and it accepted it while appearing to remove my old card info. Can't say for sure my card has actually been removed but hopefully its better than nothing
Posting this here for awareness, since I see a lot of chatter around the monthly choice bundles. I had been wondering what was up since I got an activation code in my last bundle that had already been used by another account (?!) but this explains a lot of the jank.
Oof... So we should consider any activation codes possibly exposed? I'll have to test my bundles for any keys I want for sure. I usually do that during the Tildes giveaway period. Speaking of, sounds like this year's giveaway is going to be even more of a gamble with Humble keys...
I usually give the benefit of the doubt but… Yeah, one look at the front page and my “vibe code suspicion detector” fired off. Removal of the 2FA plus being able to change password without at least an email verification is also a strong indicator.
I use LLMs for work but like, I’m just a data analyst. I worry about my work being perceived as sloppy so I stay in the loop every step of the way. Claude might be writing the code but I make sure that it does what it’s supposed to do. So, even though some of my reports could be vibe coded in minutes, I still prefer to spend hours to make sure I know what I am delivering.
But then I see examples like this, where your work will be shown to millions of people, and every step of the way, where everyone involved must have said “sure, ship it”, and I’m scratching my head what these guys are even thinking
Edit: oh jeez. I went there to delete my payment info, and I can't find where to access my profile.... I also can't add anything to the cart.
https://www.humblebundle.com/store , here the "hot pre-orders" section is a buggy mess. If you click it may or may not open the page, but it will always rotate the games.
Yeah, they vibe coded this without care or concern. Will see if I can remove my payment info, if not I'm going to straight up block them and request to delete all my info
A lot of people push the narrative that LLMs are better than humans at coding now, and that human software engineers in the mix are a weak link. I think this is the kind of thing we're going to see more and more as people high up in the food chain who don't actually know anything about software development start to believe it, and as more and more experienced developers who know better burn out under their thumbs.
We're well beyond "start".
For some reason the people I meet that are the most evangelical are directors or board members or founders, it's weird.
Hell my own company's founder wants me to move the dev team to daily releases. Totally a bad idea in our case but it's a never ending tug of war regardless.
The argument of "I'll hire two freelancers to do this in two weeks" has been dropped more than once too.
All because they can whip up a redesign in something like lovable in a day it means all of software dev must be the same.. right!?
I work for a small publishing collective owned by a very nice guy who bought the company so his kids could be employed (he doesn't draw a salary and he's extremely hands off) but every so often he'll pop in and encourage us to use AI tools as much as possible and I can't imagine where he's even getting the notion that that could be a good idea for us in any way. Thankfully we can just smile and nod and he'll let it go for a while after that.
It's a Dunning-Kruger and Chesterton's Fence maximizer. The hardcore vibe coding evangelists are typically inexperienced but think they know better than people with years or decades of industry experience, and their carelessness is essentially being carried on the backs of those experienced people. Who, like you say, are increasingly stressed and at risk of burning out. Lazy and frequent PRs require more mental energy from the more senior developers, essential shifting work onto them.
And the LLMs only work well because they're often operating on code bases that are organized and well cared for, but the vibe coding is basically dumping toxic runoff into them. Which is a price to be paid later, so neither the vibe coders nor their management care until something cataclysmic like this happens.
There are a disturbing number of people on Hacker News arguing for not reading code or doing PR review at all. Which is just bald faced engineering malpractice and I'm livid that we lack proper licensing for software engineering as a result of this insanity.
Coding agents are fancy but they’re still just software. They don’t have mind-reading magic. I think people let their guards down because LLMs seem so good at inferring intent. But if you never even had intent in the first place what are they supposed to do? You’ve got to give them something to work with.
If they’d just spent a few cycles with their agent, prompting it to “analyze the codebase for security holes, vulnerabilities, privacy risks, and e-commerce antipatterns” it would’ve fixed most of this stuff immediately. They don’t even need to know what any of those things are, just point the LLM in the right direction and let it loose. If they really cared to, they could’ve set up a (Ralph Wiggum) loop with that prompt that just keeps scanning for problems and fixing them until it can’t find any more. But the problem is, they didn’t care to at all.
Which is a major red flag, not just for the site redesign, but for the company as a whole. It should be for any company.
https://www.humblebundle.com/user/settings -- I had to find this through About and clicking on their Humble Choice "more info" link... jeez.
Thanks mate!
But, I got this:
what a mess....
I decided to just open a ticket and requested them to delete any payment info I have
Ai-ya. Maybe because I'm in the US I'm getting priority or something? What a cluster this is turning into... I may block them with my payment provider just to be sure.
Off-topic, but is there a reason everybody seems to use purple gradients and accent colors now? Is that a Claude/vibecoding thing?
Purple is actually my favorite color, so I thought it was cool when I started seeing it more, but it seems like it's everywhere now -- especially on sites/apps that people accuse of being vibecoded.
Purple was never part of Humble's color scheme in the past, so it's weird to see it so prominent in this redesign.
Yes, Claude (and others I believe) default to gradient colors, and uses purple a lot. It's why Anthropic made "Claude Design", which is basically a place where you can define your own design style and rules, and Claude will use it for reference.
But that's the thing... There are also a myriad of repositories meant to "unslop" webpages (and some of them, imo, are genuinely good), which basically have instructions to contradict these tendencies that LLM's have. It feels such an obvious thing that they could've used. But from my glancing, it feels like they really just went "claude, remake my webpage, make no mistakes, I'll sue you" and that was the output.
I'm wondering if there were any designers involved... Or even tech people... Idk, it's like I said in my other comment, I don't know what they were thinking.
I’ve seen LLMs blamed for gradients quite a lot, so I think it’s exactly that. Purple is my favorite color too. Many of the LLM revisions I did to audiobookcovers.com included purple or purple gradients. (Not going to apologize for LLM design; I am not a designer. But most of the code was first drafted by LLM and then rewritten by me, sometimes quite extensively.)
Godshitfuck.
Yeah it allows me to change mail and pw without any confirmation or verification.
The main ui looks worse than the old one.
And unlike some people (maybe they already started fixing things?) I did get a 2FA request correctly when logging in. But even the UI for that was glitching out.
I had a MFA app setup and it apparently changed/defaulted to email MFA. I was able to get in but that's not encouraging.
I removed as much as I could; cancelled Choice, which seems to have also deleted my payment method, fingers crossed, and removed my links to my gaming accounts as well. As much as I can be, I'm done with Humble. It's been a lot of small things up to now, nothing much to go running to everyone to complain about, but I haven't liked their direction for awhile and this was the final straw.
Edit: just logged in and access to my profile from the main page was removed. I had to do a weird work-around where I went to their main "About' page, which mentioned Humble Choice which I clicked for "more" and that had the profile icon at the upper-right again. Here's the direct URL for anyone that needs it: https://www.humblebundle.com/user/settings
My payment information for Humble was through PayPal, so I think I'm good. Still, test on global and the world will test with you.
I work in security and trying to access my profile after the redesign just gave me a huge creepout feeling. I canceled choice but not until accidentally clicking the "Give me my games now" link on the choice page which immediately charged my card with no confirmation or way to cancel after that link click. I've since canceled my choice membership and left them a support request explaining exactly why. Removing TOTP for any reason is unacceptable in this day and age, especially when users specifically opted into using it.