YHK - yet another hacker news clone

Humble Bundle just killed most of their security through vibecoding

186 points rdmuser 1 hour ago 76 comments

xx__yy 59 minutes ago | parent

Sounds like shotgun project, cheap model with low effort, at the controls of someone who doesn't know how to build software, end to end.

AI doesn't produce bad software, people do.

jonplackett 54 minutes ago | parent

It does seem particularly weird. You’d have to really try to make something this bad

zendist 52 minutes ago | parent

AI definitely produces bad software, too.

It's up to the people involved in the process, to gatekeep AI to not *ship* bad software.

0xbadcafebee 25 minutes ago | parent

AI makes bad software like a saw makes bad furniture. The final result is never the tool's fault

geraneum 3 minutes ago | parent

But we’re being sold an “autonomous saw”. Who’s at fault here?

necovek 3 minutes ago | parent

It's not really an apples-to-apples: you can ask an "AI" to build software to do a particular thing, and it will happily oblige and spend some of your money on it and produce something that actually runs.

You cannot just turn the saw on (if electric), point it at some wood and expect anything resembling furniture.

blitzar 2 minutes ago | parent

Ai should randomly cut off people fingers occasionally as a polite reminder

toledocavani 2 minutes ago | parent

I agree that the tool shouldn't be at fault, but I refuse to take responsibility when managers force me to use it.

tonyhart7 51 minutes ago | parent

probably use gemini because its so bad

0815beck 44 minutes ago | parent

ah of course if only they used a proper model

johnnyanmac 37 minutes ago | parent

Blame anything except the thing that makes them money.

0815beck 42 minutes ago | parent

delusional bosses who decide that human work is worthless in comparison to 5 "ultraclaudes" running in a loop for a week is what produces bad software

somenameforme 29 minutes ago | parent

None of the issues raised in the post/article here even require any particular knowledge of how to build software. Anybody with a basic attention to detail would have noticed them. It's just somebody who simply DGAF shipping to live.

rajayonin 25 minutes ago | parent

> AI doesn't produce bad software, people do.

AI makes producing bad software easier.

Maxion 21 minutes ago | parent

And faster!

vrganj 10 minutes ago | parent

People produce bad software using AI.

aurareturn 58 minutes ago | parent

Why blame vibe coding?

It's always up to the skill of the human.

solid_fuel 49 minutes ago | parent

This perspective on vibe coding is both funny and contradictory. The core issue with vibe coding is that people ship things they don’t understand. To flip it around and blame it on the humans involved only after something goes wrong as if the issue is them vibe-coding “wrong” is foolish. The issue is the vibe coding.

cpa 41 minutes ago | parent

It’s never about the tool, but about the responsibility. In humans are those that take responsibility for the tool they use, be it vim or opencode.

somenameforme 39 minutes ago | parent

For the vast majority of these issues, certainly including those mentioned here, simply testing before going live would make them beyond clear. So it's simply a bad developer likely working under bad management and, shockingly enough, producing a bad outcome.

LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart" cousin and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.

bonoboTP 24 minutes ago | parent

Is it about MBA mantras or simply folks never sticking around in one spot to have long term consequences affect them and their reputations?

_flux 38 minutes ago | parent

So as I understand it, vibecoding means (meant?) that you don't look at the code it produces, you case only about the end results, e.g. website through a browser.

But in this case, they seem to have skipped that as well.

denkmoon 37 minutes ago | parent

Most software teams I’ve seen were pushing things they don’t understand well before AI

eddythompson80 23 minutes ago | parent

Exactly, there were always shitty software teams. We should all strive to be that one day.

kakacik 25 minutes ago | parent

Vibe coding is just a really big hammer, what you do with it and what you do with results is still up to humans. Even if this was result of it, fuckup is ultimately fully in hands of somebody responsible (for product, website, clients etc).

If not, company is not viable and will crash badly soon. Market forces and all that.

p00ki3 11 minutes ago | parent

If I had a dollar for every RoR coder who didn't understand the internals of the interpreter I would still not be richer than Musk because there are not that many coders.

No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.

git pull git@github.com:allofit/allthethings.git engineering patterns is what created this mess to begin with

eviks 48 minutes ago | parent

Because "skill" is too generic to be a useful categorization of reality, so people identify more specific causes

resonious 48 minutes ago | parent

Was going to say the same. In fact we're seeing a huge wave of hacks caused by old human coded systems getting owned by "vibe" attackers.

Vibe coding is such an overused term now. Stats say what, 80% of programmers use AI to generate code? 90%? So everything is vibe coded. If you do well, no, it's still engineering. Someone makes a mistake? Cuts a corner somewhere? Vibe coded.

johnnyanmac 38 minutes ago | parent

>So everything is vibe coded.

Given the sentiment that software is getting worse, buggier, and overall less stable, that isn't a comforting statement.

bigstrat2003 28 minutes ago | parent

> Stats say what, 80% of programmers use AI to generate code? 90%?

I am extremely skeptical that those numbers are even close to accurate.

agilek 44 minutes ago | parent

There probably was no human in the loop.

Or more possibly the person incompetent one.

roncesvalles 44 minutes ago | parent

Vibecoding amplifies human mediocrity and enables grift.

johnnyanmac 43 minutes ago | parent

how many forced "tokenmaxxing" initatives do I need to bring up before we stop blaming developers for this reckless adoption of AI? These decisions come from the top, often from people who do not understand the software.

throwaw12 40 minutes ago | parent

"Why blame vibe coding?"

Because it allows you to produce so much code that it's not viable to carefully review each line/module, and get the benefits of the fast output.

Writing code yourself forces your brain to start creating pathways in your brain and you can verify the correctness of those pathways in your mind (e.g. am I actually doing this right, if I have seen such API would I be happy to use it,...)

Not saying we should write code manually, just showing the differences.

mcv 19 minutes ago | parent

And even if you don't carefully review each line of code (or if you do), it helps a lot if you understand the basic principles of what you're trying to build. In this case, the vibe coder clearly had no idea about account security standards.

Programmers don't just write code. They also understand why they're writing the code and what it's supposed to do.

b00ty4breakfast 39 minutes ago | parent

I'm too old to keep up with the hip jargon these days; isn't "vibe coding" different from just using a coding agent?

voidUpdate 35 minutes ago | parent

Because if a human was to program it, they might have stopped for a second and thought "Is this really a good idea?" whereas the LLM just goes "You're absolutely right! Here's some updates to the security code:"

user43928 11 minutes ago | parent

I don't think it does, I doubt SOTA models are going to sign off on this.

On the other hand, people incompetent enough to ship this couldn't have produced a working website if they had to handwrite the code, so in that sense LLMs are at fault.

xavdid 54 minutes ago | parent

Wow, that's an impressive downgrade. Not only is the site uglier (gradients, gradients everywhere!), but I could log in without needing my 2FA at all. Shame too, since I found the old Humble site pretty charming.

mococa 54 minutes ago | parent

They fired their devs and put marketing people to code

somenameforme 34 minutes ago | parent

I expect marketing types are freaking out even more about the jobpocalypse than devs. While it takes some skill to determine whether resultant code is working, marketing goes by vibes all the way up the chain.

Ekaros 53 minutes ago | parent

Perfect example of when rewrite is functionally worse for users and done for sake of doing it...

I wondered why I did not get email code from them for login. Then it arrive one hour later... Seems like pretty big oversight...

rozenmd 52 minutes ago | parent

"A computer can never be held accountable, therefore a computer must never make a management decision"

ruined 40 minutes ago | parent

"A computer can never be held accountable, therefore a computer must make every management decision"

ghurtado 34 minutes ago | parent

"A manager can never be held accountable, therefore a manager must make every computer decision"

dist-epoch 4 minutes ago | parent

HuggingFace incident strong precedent.

You want to do a crime, subtly hint your AI about it.

roncesvalles 34 minutes ago | parent

As if anyone holds management accountable either. Big companies are full of VPs and Directors who make a mess and transfer orgs just before it comes back to bite them.

throwaway27448 33 minutes ago | parent

The only party truly above accountability is the shareholder (a questionable decision itself)

adwn 17 minutes ago | parent

> The only party truly above accountability is the shareholder (a questionable decision itself)

This is decidedly not a "questionable" decision. I really, really shouldn't be held accountable for the conduct of any company in my ETF portfolio, as I have zero influence on their operations and zero insight into them (beyond what any member of the public has).

throwaway27448 1 minute ago | parent

[delayed]

gabucino 49 minutes ago | parent

>To start with, 2-factor authentication no longer exists, it does not ask for any tokens to log in, so your password is the only security on there.

i thought i'd be hearing about downsides?.. elaborate plz

agilob 38 minutes ago | parent

> so bad that they have one-click payments enabled (which is illegal) for purchases.

Is this actually illegal in a jurisdiction or against ToS of payment providers and they can get permanently banned from using card payments?

ghurtado 36 minutes ago | parent

Probably the latter, not that it's any better.

nitroedge 32 minutes ago | parent

sad when the honorable ones get infiltrated.

This last month has set my expectation that next month + next month is too many CVE's and I'm plugging the dam hole with my finger.

ZiiS 17 minutes ago | parent

It used to infringe Amazon's patent; which is why it has only become common recently. Not illegal.

consp 16 minutes ago | parent

It is where I live. Not going to create an account to check if it is enabled there as well.

lxgr 10 minutes ago | parent

If they don't have any presence in and don't actively target your region, your local laws and regulations might not be the ones that govern the transaction, though. Not sure if Humble Bundle has crossed that threshold yet for most of their non-US markets.

petetnt 5 minutes ago | parent

I don't know about illegalness, I pressed "Get your games" button accidentally and it immediately deducted 12,99€ from my Paypal account without confirmation. What the hell.

dava96 37 minutes ago | parent

I wonder if the issues I was having trying to download my ebooks from them is related to "vibe coding".

It was pretty frustrating not being able to download the things I'd paid for.

bronlund 37 minutes ago | parent

I hate on hover menus with a passion.

genxy 13 minutes ago | parent

I thrashed 3x in a row trying to open the menu!

aeQu5igh 33 minutes ago | parent

They deleted the download link for the original humble bundle. I can no longer download Gish.

nvgeele 3 minutes ago | parent

I recently wanted to download a game I bought a long time ago through them (Machinarium, new macOS builds). Unfortunately the file on their CDN is corrupted. Their reply, after a week's worth of back and forth: sucks for you, it was sold too long ago so we won't bother fixing the issue.

jjbinx007 30 minutes ago | parent

Thanks for this. Been a Humble subscriber for years but this has just persuaded me to cancel

brindleth 24 minutes ago | parent

The article doesn’t seem to provide any direct proof the new site was vibecoded? I mean, probably it was, but people were writing insecure software long before AI came along.

Without evidence, accusations like this are, ironically, just vibes-based.

gbingles 20 minutes ago | parent

Yeah we just say that about anything now.

Kwpolska 1 minute ago | parent

What other reason would there be for a complete rewrite without any sort of security? They had a fully functional and secure backend, why would it require replacing just to redesign the site?

DuncanCoffee 17 minutes ago | parent

If you try to log in, it gives you three captchas, once when you input your username and twice when you input your password lmao.

I removed the automatic payment process from paypal so at least that's safe, I'd recommend others to do the same at this point.

Cannot wait for some insider to tell us the story of how this came to be

anilakar 16 minutes ago | parent

Humble hasn't been humble since the IGN acquisition.

Maybe they should finally change name to Edgy Bundle.

origini 15 minutes ago | parent

At least 2fa got removed. Man i hate this, every single shit wants 2fa.

Let me do 2fa when i have to pay not to just login to services i care very little.

And yes blizzard my wow account is not worth anything either.

trvz 15 minutes ago | parent

This is not AI's fault. In fact, they had to probably fight the LLM to get it this simple.

I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.

geraneum 8 minutes ago | parent

It’s the person’s fault who says you don’t need to review/read/understand the code. “2fa? that’s just gobbledygook”.

I doubt you have to fight anything to get there.

WD-42 7 minutes ago | parent

This disaster never would have seen the light of day if it weren't for AI.

p2detar 3 minutes ago | parent

[delayed]

1313ed01 9 minutes ago | parent

Can someone there please just click the rollback button now and we can all forget this ever happened. I don't think that new site can be saved. The old site was fine. Just leave it like it was. I bought a bundle as recently as last month. Three bundles I think.

If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.

scaglio 7 minutes ago | parent

For anyone interested in deleting their account, I think this is the right link (at the bottom of the homepage): https://dsar.humblebundle.com/