Weird that they lay all this at the feet of vibecoding. I've asked for authentication systems several times and they've tended to come with pretty good feature-sets. Perhaps it's because I know what I'm asking for.
Edit: I've just tried to log in and it's failed through both Google and email. Whatever they've done, they haven't tested it well.
Yes, but you're not vibe coding when you ask for an authentication system. You know what you mean by an authentication system and can tell when what the AI delivers is insufficient. A vibe coder can't.
The problem with vibe coding isn't the AI, it's how people use it. It's that people with no idea of what they're doing, now think they can do what used to require an expert.
the part that is weird to me: nobody really knows how much they know about designing a system in plain english until they try it. i would not have thought i knew enough words to be dangerous (self-complimentary), but i clearly do. i still think of myself as a know-nothing vibe coder, and the only way to prove it one way or the other would basically be to go back to college. lol
We're talking vibing here, not coding. And who knows what the agent will decide from fuzzy prompts, take an external provider or create a new one from scratch?
That's fair, I do, but it's alien to me that they wouldn't at least start with the old system as a starting point or another system, or that the LLM wouldn't make that link.
To get what tfa is describing, you'd need to explicitly request a dumbed down system, use a really shitty LLM, or both.
Honestly I'd sooner believe this is the result of a highschooler than a LLM.
Oh, absolutely. Why even try to fix what wasn't broken, and 'fix' it in a way that's likely to break it? It betrays a deep misunderstanding of what the site does and is supposed to do.
I've got no problem with people vibe coding a personal project or a prototype or something, but when you've got code in production, that a business depends on, you've got to be a massive idiot to blindly start rewriting it in this way.
I think they wanted a site refresh, and instead of doing it visually and/or adding features at the same time (people do this still, I think its okay), they likely thought that due to AI assistance it would be easy to actually start from scratch.
Not sure why you couldn't take the "its easy with AI" path and actually refresh the current codebase.
This is hearsay mind you, I don't know how much of their old site is there...
It is the fault of vibe coding, the sell has consistently been AI solves all of this. Clearly someone somewhere has to know what the system should or shouldn't do.
I've seen a number of companies (and HN contributors) explain that AI produces code that is better than coders. Which, of course, if you actually think about it carefully, doesn't guarantee anything about security, but that's not how executives understand the sentence.
But you have asked for something specific. An authentication system.
If you ask it to rebuild a site that has x, y and z features, the AI will output an average outcome because it's doing broader implementations. Context and thinking only goes so far unless you have thousands upon thousands to burn in tokens.
This was likely the result of a CEO replacing their entire dev team by:
Build and maintain our website. Add features as needed. Rewrite everything as needed. Deploy automatically. Make it compatible. Make it fast, secure and bug free. Make it cyber. Make it cloud. Don't make mistakes.
"A computer can never be held accountable, therefore a computer must never make a management decision." - IBM slide deck, 1979
Scratch the "management" and replace it with "critical" and we probably have a near universal statement (maybe also add that no sole person should make such decisions).
1. Boss orders dev to use Claude for everything. Claims proudly "we're AI-native", "we're using an AI factory". Disincentivizes any kind of human review.
2. Dev eventually gives in.
3. Claude makes mistakes.
4. Dev gets blamed, because they're the "human [fuse] in the loop".
AI loves copying existing patterns in legacy code without asking, even if they're super-dumb. It's like it reads bad code and that anchors the pattern in its thinking.
It might have been some internal testing mechanism that's been corrupted. Or if they had an existing hole the AI probably convinced itself that was what was necessary.
That's one of the disadvantages of them hiding the "thinking" output they used to cycle through, sometimes you could spot that happening.
> It might have been some internal testing mechanism that's been corrupted.
Yeah, I've seen so often the agent just getting rid of tests (either by removing them or by corrupting them) that it stopped being funny a long time ago.
That's still dumber than I've come to expect from LLMs but as others have pointed out, I'm a developer who uses LLMs as a tool, not a manager using a LLM as a developer.
I'm not blaming the bulldozer. I blame the people who gave everyone bulldozers knowing that they have faulty steering and that nobody is used to bulldozing. And the people who shut down every attempt to prevent that with the argument "bulldozers are the future, you can't stop them!".
And yes, I also blame the people getting on that bulldozer, bulldozing like there's no tomorrow. But mainly I blame the first two groups.
Bulldozers aren't restricted vehicles, anyone can buy them. What you seem to be upset at is that they became very cheap and easy to obtain, and everyone is using them to landscape their small front yards and the damage caused is often outweighing the time saved by using something simpler that takes more time and effort. The bulldozers work fine, but if you use a large one to clear everything you might just find you've also taken out the walkway to your door inadvertently, when a small one that took a bit more time and effort would have allowed for you to target what needed attention.
That metaphor has been stretched about as far as I can take it, but it's the tools and people getting access to tools they've not been trained on to do tasks they have no prior experience with. As someone who just laid laminate flooring myself for the first time, I'm keenly aware of both having the right tool for the job and the knowledge of how to use it and knowledge of how to do the task in general affects the end product. The mistakes I made are my own, not the cause of the incorrect tools I used at times.
I'm not going to blame the tool. I'm sure as fuck going to blame the peddlers of the tools that are always ready to support this kind of nonsense; worse, they tell everyone around that this is perfectly fine.
Once you can't go for a walk without experiencing a bulldozer bulldozing the wrong thing somewhere on your path, it becomes a distinction without difference.
The bulldozer goes in the direction the person is sitting enough of the time we can call it "all the time" without having to argue "what if it breaks down, or a lever breaks and sticks on".
> I'm more inclined to blame the usage rather than the tool here.
Which is what your parent comment is doing. They didn’t say AI was to blame, they said this wouldn’t have happened without it. It may be your fault if you blow up your hands with a firecracker, but it’s also true that it wouldn’t have happened if firecrackers weren’t a thing.
> Do we blame the bulldozer if it bulldozes the wrong thing?
That’s such a tired analogy. By this point it’s honestly hard to believe it is made in good faith.
There isn’t a massive industry with tendrils in every facet of society trying to sell you on autonomous bulldozers that do the bulldozing for you without interaction, is there? Caterpillar is working on autonomous bulldozers, but even those aren’t targeted and advertised at every household as something you have to use.
Disagree on which end of the telescope were looking down.
AI has caused a generational set back on how stakeholders view the value of expertise knowledge, but the gun is still people, AI is just one of the bullets along with things like obsessive cost cutting.
My large orgs entire marketing strategy is now run by an MBA using Claude to generate 'idea and best practice docs'.
The process that lead us to not having a CMO or any other marketing leadership with domain knowledge? Consulting partnerships using MBAs.
The reason we're not changing any strategies even though we're burning money pper CPA? MBAs concerned seeking alignment and having the right narrative to change course.
That is true, but this can be said about so many things. Hit and runs would also not exist if it weren't for cars.
The technology itself is not to blame, but maybe the marketing around it should be. AI coding tools are marketed as magic tools that can somehow spit out perfect solutions even if the input spec is garbage. Of course that is impossible, and no amount of technology can solve that problem unless every AI coding agent is equipped with guardrails that makes it stop if it gets the impression that its user is an idiot.
Thought experiment. A startup is at the end of their runway. Need to show income or go down. Businessmodel is to sell "one off" sales, and vast majority of their accounts buy once or twice (a year or ever).
What if they "accidentally" make it easier for hackers to take over those accounts. Accidentally, as part of a large overhaul or rewrite of their systems.
Then, at least for a while, their accounts suddenly "buy" much more products per month or year.
No. This isn't "bad software". This is Code Bootcamp 2nd semester lab levels of incompetent. Most of the security lessons this product ignores were known (and solved) 20 years ago. The last time I saw a website in the wild that fell down this badly on basic user account security it was written in Perl.
Can someone there please just click the rollback button now and we can all forget this ever happened. I don't think that new site can be saved. The old site was fine. Just leave it like it was. I bought a bundle as recently as last month. Three bundles I think.
If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.
This is something I don't get. The old development process was slow, but it was mostly safe and reliable.
People are rebuilding working things from scratch with AI just because they can.
AI eroded the greenfield advantage of rewriting a project from scratch because a rewrite generally meant that the code went through the fingers of the new developer. With AI that advantage is gone so you are better off incrementally improving the old code base to minimize overall maintenance costs and reduce the needed headcount as a result of this work.
To be fair, the greenfield advantage of a complete rewrite was also overestimated and frequently just lead to ungodly amounts of wasted resources on systems that never shipped or ended up being overly complicated. See https://en.wikipedia.org/wiki/Second-system_effect
AI lowered the cost of rewriting which means that more shitty systems ship because the rewriters don't run out of money before the rewrite is canceled. But it doesn't the solve the underlying problem of the people in charge of rewriting not understanding what features in the old system were actually important and which had to go.
I've been involved in many "rewrites". Almost exclusively, the result is worse for users at release.
Especially with "big bang releases". Where a team is working behind the scenes for months or longer, attempting to rewrite the old system "bug for bug". Releasing and then finding out that some users would "hold the space bar to make the CPU heat up, and configuring emacs to interpret that as 'control'" (XKCD 1172). First, users don't see any improvements for all the time that the new system was being built. Secondly, they get all the new stuff bundled. So while they may even get value from the rewrite, it is bundled with the stuff that makes it worse. Three new features, one new bug. And all everyone sees is that new bug.
But even rewrites where parts are swapped out and released immediately, (strangler vine pattern!) are worse for the users. They do get value fast. And in small increments. They can give feedback early. But the (much longer) period in which the replacements are implemented, is almost always one of confusion, complexity, and "having to learn new things every week". We all know the systems where "change email" is a link that leads to a form on some other site, in an old design rather than part of the "edit account" page. Because the "account service" has been extracted, but the "notification service" replacement on the backlog still.
"rewrites" are almost always for the benefit of the business, the technical team, or other internal reasons. If "benefit to the users" is a part of it, it's almost always secondary: so that we can build and release and scale new features and cool stuff for users faster than with the old legacy spaghetti debt.
> You can also change your password without confirmation - you don't need to either enter the previous password or double-enter the new password.
This seems to be mostly people who don't know what they are doing? I'd any model would default to requiring this since it's pretty much the default everywhere.
My experience with Opus 5.5 is that, it wouldn't, unless there is a framework that guides them to do it. Most of the times if I don't instruct him to do something more complex, it usually avoids it.
I recently wanted to download a game I bought a long time ago through them (Machinarium, new macOS builds). Unfortunately the file on their CDN is corrupted. Their reply, after a week's worth of back and forth: sucks for you, it was sold too long ago so we won't bother fixing the issue.
I don't know about illegalness, I pressed "Get your games" button accidentally and it immediately deducted 12,99€ from my Paypal account without confirmation. What the hell.
Definitely illegal in Germany at least as any payment button needs to be clearly labeled as buying/paying for something. Probably illegal in more places as that button description doesn't really indicate that you are agreeing to a purchase.
If they don't have any presence in and don't actively target your region, your local laws and regulations might not be the ones that govern the transaction, though. Not sure if Humble Bundle has crossed that threshold yet for most of their non-US markets.
After they repeatedly reinstated, without consent, recurring payment for their subscription plan Humble Choice, which I repeatedly chose to pause (yes, they offered it as a first-party option), I had to cancel the plan entirely, as an early subscriber back when it's called Monthly.
It showed me that they just don't care anymore.
But it still baffles me as to how an LLM could make it this worse, when they already had decent security measures. No top-of-the-line model should've done this. I guess it can only be concluded that they didn't even care to spend some money on SOTA models, even DeepSeek 4.1 Flash, instead turning to the cheaper but also much less capable models to save a few pennies.
Maybe it was different when you used it, but when I had Humble Choice years ago, I remember that it was very clearly communicated that the "pause" is for one month only. Maybe a dark pattern that you have to remember, but it was shown
To me it was always pretty clear. Though I have heard there was some probable weirdness in the functionality. Still bit questionable of grandfathered "classic" subscribers were forced to go through this to keep their status. But that is pretty normal, only have seen one site that allows coming back later to subs at old sub.
With them killing the "classic" it doesn't really matter anymore. Better just to cancel.
I think we need to hold our horses a bit here. Do we have evidence they used AI and what exactly did they use? Was it the same dev team? The post doesn’t mention anything except this line:
> turns out to be an AI shop.
If you check Reddit, people had been already complaining about HB functionally and design 6 years ago.
My bet is they outsourced to get cheaper devs, who did a sloppy job, even if they were using AI.
- The UI components are the ones that cheap AIs default to
- multiple regressions in functionality (can’t delete a card easily, no 2FA check, a lot of purchases are missing because somehow they botched a migration?)
- they had a consistent design system for the FE before this, and now it looks like “Generic Gaming Website From 2025-2026. [Phrase 1. Phrase 2. Phrase 3]”
Even if they outsourced to devs that used AI, they are asking for a lawsuit to remove core security safeguards, while rolling old subscription plans onto the new plan in the same rewrite/migration.
To be "fair" (if a victim "failing" to recognize a dark pattern should be counted on the victim), I wasn't exactly familiar with dark patterns, back when I cancelled the plan.
Interestingly, they didn't seem to set up much dark pattern for the cancellation of it - I recorded the automatically reinstated payment in a private rant post, but not a dark pattern in cancellation. To this point I don't really care to conspiracy this into the theory that they knew users who were angry enough to cancel couldn't be stopped, and/or the law might be against a dark cancellation pattern, but no so much as to a pause.
Thx. Was trying to delete my account. I couldn’t find the option in the settings of the page. A quick search told me to go via the sepetate Support Page, but alas the Login Button there only leads to a 404. What a mess! Using your link and confirming Ziff Davis is the parent company of Humble Bundle before entering my data, worked. They should now hopefully close my account.
They do this annoying thing where their form has "Delete account" option but their response is another step in the chain, basically hope you forget or miss it.
This reminds me a bit of trying to close a patreon account years ago. They said they could only do it if I accept data terms for a 3rd party which would clear my data. Of course I didn't want to give my data to ANOTHER party just to clear my data. I refused many times over and got nowhere. No idea where I could have gone really.
Perfect. I closed my account and then unlinked my connected accounts but this seems like a much better option. I don't want my data to be involved in yet another hack.
The flow/interaction of changing passwords and email addresses is somehow a bit of a pickle for people to get their head around.
In general I think it is obvious that logged-in users must need their password to change their email address, and forgot-password users must need access to their email address to change their password.
I would be a little surprised if any coding-focussed AI, frontier or otherwise, didn't offer that by default if not prompted, but I will have to test this now with the local models I use — has anyone else?
But for some reason not everyone agrees re: the first of these.
It might be due to the sort of bug that PayPal regularly inflicts upon themselves. Once so many different teams and different project revisions have each set their own cookies, the aggregate cookie header is now so long that their server won't even entertain your request long enough to serve you a custom error page.
One-click payments are not illegal in themselves, but the EU requires that online purchases go through an explicit Checkout Confirmation screen. From what others have said on this thread, it appears this is the step that Humble Bundle skips.
Nonetheless, at the same time they made Humble Games redundant, they put the Humble Bundle on life support, and my understanding is that its now operated by contractors rather than an in-house development team.
My order history is gone. The "new" look is bad, it seems another hallucinated neon brain fuck. Wasn't perfect before but why the need to change just for the sake of it? Why? What was improved? This is what pisses me off the most, using LLMs for doing things just for the sake of it
As if anyone holds management accountable either. Big companies are full of VPs and Directors who make a mess and transfer orgs just before it comes back to bite them.
> The only party truly above accountability is the shareholder (a questionable decision itself)
This is decidedly not a "questionable" decision. I really, really shouldn't be held accountable for the conduct of any company in my ETF portfolio, as I have zero influence on their operations and zero insight into them (beyond what any member of the public has).
You do have influence, you just chose to give it away. Your ETF provider definitely votes in shareholder meetings in your name, using the voting rights which come with the shares they bought for you. If the fund you use doesn't offer pass-through voting or at least the choice of several voting policies, then you've got only yourself to blame for rubberstamping the asset manager's choices.
As to insight: a shareholder having information beyond what the public has is called "insider trading", so that's not going to happen. But nothing is stopping you from pushing the board to release more information to the public. At the moment there's little reason to do so as companies being secretive provides a competitive advantage, which is in the shareholder's interest - but that equation would obviously change when that same secrecy exposes the shareholder to risks of unknown size, and when all companies are forced to be transparent it is no longer a competitive disadvantage.
I disagree. I think you should be held responsible for all the stock that you own. If that means that ETFs are too dangerous for you that's good. Otherwise, it's rather foolish to expect shareholders make rational decisions beyond profit maximization.
What do you suppose those shares you bought are for? "I decided to launder my accountability through a third party" doesn't have quite the same ring to it.
the site looks terrible too.
on-hover menus that take an eternity to show up because of some stupid css transition.
a huge blurry pixelated hero image blown up far too large
a "new and trending" section that's straight up empty (broken?)
I was listing my purchases to download the games I've bought there before deleting my account and it would only show four at a time. Listing the games, it showed all the different versions with identical labels, so it was impossible to know whether I downloaded the Linux, Windows or Macintosh versions.
The plain text editor never produced any kind of logic, or any kind of text for that matter, beyond what was explicitly typed into it. We never said the IDE "does" X when it got auto-complete.
Comparing AI to simple tools like a hammer or saw just isn’t right.
AI tools are complex systems that definitely can have agency, even though that is mostly human controlled. Bad controls = bad outcomes.
Yes, I totally agree that humans have the most control over them, but that doesn’t mean it’s completely off the hook.
If we really have to draw simplified real life comparisons, maybe a car or a gun would be more suitable “systems” that we can metaphorically compare AI to.
It's not really an apples-to-apples: you can ask an "AI" to build software to do a particular thing, and it will happily oblige and spend some of your money on it and produce something that actually runs.
You cannot just turn the saw on (if electric), point it at some wood and expect anything resembling furniture.
Comparing AI to a saw it's like admitting it's the same as an IDE. To some extent it is, it is more autonomous too though. It's more like a brain child robot with a saw and a grin on the face
At the end of the day, no matter how you put it, someone has to still actively ask for those solutions. When we get to the point that the saw decides to activate itself and go cutting stuff without being asked, then we can say the tool is actually doing stuff.
Nuclear weapons are a totally neutral technology with no particular affordances. That they can be used to kill people is totally beside the point and irrelevant to any discussion about their merits and downsides.
In particular they offer their owner a high maintenance decaying shelf life, or an explosion.
Of the 2,476 explosions to date, two were used specifically to kill people, some of the others did kill people, although such things were supposedly unintentional.
They have not afforded a better way to make canals, mine in a controlled manner, or fart a starship to space .. although people have desired such affordances.
I just used Claude opus 5 high to refactor our permissions model to an hierarchical one. In the validation function, if a part of a permission grant was missing in the hierarchy, claude happily granted them approval instead of rejecting, fail open for permissions.
Always review the code an LLM creates.
(When I told Claude that this is very bad, its reply was “Good catch!”)
None of the issues raised in the post/article here even require any particular knowledge of how to build software. Anybody with a basic attention to detail would have noticed them. It's just somebody who simply DGAF shipping to live.
Wow, that's an impressive downgrade. Not only is the site uglier (gradients, gradients everywhere!), but I could log in without needing my 2FA at all. Shame too, since I found the old Humble site pretty charming.
The article doesn’t seem to provide any direct proof the new site was vibecoded? I mean, probably it was, but people were writing insecure software long before AI came along.
Without evidence, accusations like this are, ironically, just vibes-based.
What other reason would there be for a complete rewrite without any sort of security? They had a fully functional and secure backend, why would it require replacing just to redesign the site?
You get regressions in design and security when you:
- never documented how the old site work
- never asked a good model/person to comb through the old codebase, and write a spec + PRD for how it works
- ask a cheap LLM to redesign the whole website (without migrating auth, or some material % of old content)
It was ok before, not perfect but more than ok and secure. The new version it is indeed vibecoded doesn't matter if with ai or not, vibecoding to me means careless and sloppiness, either it be human or not
```
Some of your older order history is still on its way.
We'll add anything left to show once it arrives.
```
It is funny, I downloaded the latest purchase and thought, maybe i should download my previous purchases on another computer, but why bother, all of my purchases were there two weeks ago...
```
Welcome to your new library! We're still moving a few things in.
Your unrevealed content has already been moved over from our previous site, so it's ready for you here. The rest of your order history is being migrated automatically in the background. There's nothing you need to do, and all of your purchases are safe.
If something isn't showing yet, it will appear on its own soon. Thank you for your patience!
```
I expect marketing types are freaking out even more about the jobpocalypse than devs. While it takes some skill to determine whether resultant code is working, marketing goes by vibes all the way up the chain.
Yeah this is really bad. Feels like they fired the dev team and let a PM with a claude sub just push to production. Even asking Claude to go through the site and note down things that don't make sense would've prevented at least some of this. There's really no excuse. I'm working on an android app (hobby, no ones is depending on it), and admittedly going by vibes, but I let Claude spin up emulators and even have a physical phone hooked up. It genuinely can do all the checks itself. It still breaks and misses some stuff, but I'm just a doing a hobby project. Major letdown this.
> And yes blizzard my wow account is not worth anything either.
Plenty of other players would strongly disagree. Blizzard pushes so strongly for 2FA because the support costs associated with people complaining about their WoW accounts getting compromised and drained are massive. If every player were to just shrug and start over from scratch, Blizzard wouldn't have bothered with it.
For a lot of services I'd rather just get a 'magic' link in my email and not have to deal with a password at all. I've got good email security so it's worth hanging a few lesser services off of that.
> And yes blizzard my wow account is not worth anything either.
You’d be surprised; a friend of mine had a battle.net account under one of his emails, because apparently his email was used to make a WoW account in college and was banned. He had never played wow before, contacted support, and they didn’t say what happened but revoked the ban
I wholly agree with this. People already took shortcuts with passwords, excessive MFA causes the same _need_ from people to flow through it, and we see it everywhere already (addons to autofill MFA etc).
it honestly feels like they slopped this up with opus 4.5 a year ago, and then it was sitting for a year in corporate purgatory until the 10 layers of management managed to sign off on it.
This perspective on vibe coding is both funny and contradictory. The core issue with vibe coding is that people ship things they don’t understand. To flip it around and blame it on the humans involved only after something goes wrong as if the issue is them vibe-coding “wrong” is foolish. The issue is the vibe coding.
Vibe coding is just a really big hammer, what you do with it and what you do with results is still up to humans. Even if this was result of it, fuckup is ultimately fully in hands of somebody responsible (for product, website, clients etc).
If not, company is not viable and will crash badly soon. Market forces and all that.
For the vast majority of these issues, certainly including those mentioned here, simply testing before going live would make them beyond clear. So it's simply a bad developer likely working under bad management and, shockingly enough, producing a bad outcome.
LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart cousin" and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.
So as I understand it, vibecoding means (meant?) that you don't look at the code it produces, you case only about the end results, e.g. website through a browser.
But in this case, they seem to have skipped that as well.
If I had a dollar for every RoR coder who didn't understand the internals of the interpreter I would still not be richer than Musk because there are not that many coders.
No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.
git pull git@github.com:allofit/allthethings.git engineering patterns is what created this mess to begin with
Software is hard. But especially, evolving software over many years is hard.
I've seen people build great software but fail to evolve it.
All the lessons from agile, clean code, TDD and testable architectures, CI/CD, DevOps are really about building software that can evolve, yet most of those get ignored from time to time due to cost (frequently called time) pressures.
GenAI stresses this loop even more, and no human can effectively deal with the level of output you need to fit in to continue effectively shipping. This can only mean more bugs rather than fewer bugs.
Yes, in a well executed project, LLM agents can bring immediate value and find and fix bugs: because the system has the good feedback loop built in. As soon as you lose that (over shorter time with LLMs than with humans), it starts getting exponentially worse.
And this is all even before you stop and think if you are even building the right thing.
Because it allows you to produce so much code that it's not viable to carefully review each line/module, and get the benefits of the fast output.
Writing code yourself forces your brain to start creating pathways in your brain and you can verify the correctness of those pathways in your mind (e.g. am I actually doing this right, if I have seen such API would I be happy to use it,...)
Not saying we should write code manually, just showing the differences.
And even if you don't carefully review each line of code (or if you do), it helps a lot if you understand the basic principles of what you're trying to build. In this case, the vibe coder clearly had no idea about account security standards.
Programmers don't just write code. They also understand why they're writing the code and what it's supposed to do.
Because if a human was to program it, they might have stopped for a second and thought "Is this really a good idea?" whereas the LLM just goes "You're absolutely right! Here's some updates to the security code:"
My SOTA LLM spends disturbingly much time stopping me and telling me to shape up and do things right, especially on the security/legal/privacy side. Speaking from recent experience, it would NOT have anything CLOSE to this—I’d expect it to literally refuse to ship.
Whether that says more about me or about LLMs These Days, I’m not sure…
I don't think it does, I doubt SOTA models are going to sign off on this.
On the other hand, people incompetent enough to ship this couldn't have produced a working website if they had to handwrite the code, so in that sense LLMs are at fault.
Was going to say the same. In fact we're seeing a huge wave of hacks caused by old human coded systems getting owned by "vibe" attackers.
Vibe coding is such an overused term now. Stats say what, 80% of programmers use AI to generate code? 90%? So everything is vibe coded. If you do well, no, it's still engineering. Someone makes a mistake? Cuts a corner somewhere? Vibe coded.
how many forced "tokenmaxxing" initatives do I need to bring up before we stop blaming developers for this reckless adoption of AI? These decisions come from the top, often from people who do not understand the software.
Weird that they lay all this at the feet of vibecoding. I've asked for authentication systems several times and they've tended to come with pretty good feature-sets. Perhaps it's because I know what I'm asking for.
Edit: I've just tried to log in and it's failed through both Google and email. Whatever they've done, they haven't tested it well.
Yes, but you're not vibe coding when you ask for an authentication system. You know what you mean by an authentication system and can tell when what the AI delivers is insufficient. A vibe coder can't.
The problem with vibe coding isn't the AI, it's how people use it. It's that people with no idea of what they're doing, now think they can do what used to require an expert.
the part that is weird to me: nobody really knows how much they know about designing a system in plain english until they try it. i would not have thought i knew enough words to be dangerous (self-complimentary), but i clearly do. i still think of myself as a know-nothing vibe coder, and the only way to prove it one way or the other would basically be to go back to college. lol
You do not code your authentication system, in 99% of cases. Take an external provider or a selfhosted OSS project.
We're talking vibing here, not coding. And who knows what the agent will decide from fuzzy prompts, take an external provider or create a new one from scratch?
That's fair, I do, but it's alien to me that they wouldn't at least start with the old system as a starting point or another system, or that the LLM wouldn't make that link.
To get what tfa is describing, you'd need to explicitly request a dumbed down system, use a really shitty LLM, or both.
Honestly I'd sooner believe this is the result of a highschooler than a LLM.
Oh, absolutely. Why even try to fix what wasn't broken, and 'fix' it in a way that's likely to break it? It betrays a deep misunderstanding of what the site does and is supposed to do.
I've got no problem with people vibe coding a personal project or a prototype or something, but when you've got code in production, that a business depends on, you've got to be a massive idiot to blindly start rewriting it in this way.
I think they wanted a site refresh, and instead of doing it visually and/or adding features at the same time (people do this still, I think its okay), they likely thought that due to AI assistance it would be easy to actually start from scratch.
Not sure why you couldn't take the "its easy with AI" path and actually refresh the current codebase.
This is hearsay mind you, I don't know how much of their old site is there...
It is the fault of vibe coding, the sell has consistently been AI solves all of this. Clearly someone somewhere has to know what the system should or shouldn't do.
No? I have heard literally nobody say that AI guarantees insecure code will never be written again.
Erm.
I've seen a number of companies (and HN contributors) explain that AI produces code that is better than coders. Which, of course, if you actually think about it carefully, doesn't guarantee anything about security, but that's not how executives understand the sentence.
They do it by implication:
AI Companies: "AI is now amazing at spotting insecure code"
Implication: If it can spot it, all the code it writes must therefore be secure
> Implication: If it can spot it, all the code it writes must therefore be secure
Which is funny to anyone that's prompted one to review some code for security problems where that code is something it generated previously.
My read was that they didn't test it. How do can someone compare the old version vs the new one and miss something like 2FA?
But you have asked for something specific. An authentication system.
If you ask it to rebuild a site that has x, y and z features, the AI will output an average outcome because it's doing broader implementations. Context and thinking only goes so far unless you have thousands upon thousands to burn in tokens.
The scope of the Humble site feels like 2 free months of Copilot. I've done more with less.
This was likely the result of a CEO replacing their entire dev team by:
Build and maintain our website. Add features as needed. Rewrite everything as needed. Deploy automatically. Make it compatible. Make it fast, secure and bug free. Make it cyber. Make it cloud. Don't make mistakes.
I suspect LLMs are going to be used as convenient scapegoats for the foreseeable future. "Boss, I didn't fuck up, Claude did."
"A computer can never be held accountable, therefore a computer must never make a management decision." - IBM slide deck, 1979
Scratch the "management" and replace it with "critical" and we probably have a near universal statement (maybe also add that no sole person should make such decisions).
Might be worse.
1. Boss orders dev to use Claude for everything. Claims proudly "we're AI-native", "we're using an AI factory". Disincentivizes any kind of human review.
2. Dev eventually gives in.
3. Claude makes mistakes.
4. Dev gets blamed, because they're the "human [fuse] in the loop".
"And who used Claude on it? You did? Well..."
AI loves copying existing patterns in legacy code without asking, even if they're super-dumb. It's like it reads bad code and that anchors the pattern in its thinking.
It might have been some internal testing mechanism that's been corrupted. Or if they had an existing hole the AI probably convinced itself that was what was necessary.
That's one of the disadvantages of them hiding the "thinking" output they used to cycle through, sometimes you could spot that happening.
> It might have been some internal testing mechanism that's been corrupted.
Yeah, I've seen so often the agent just getting rid of tests (either by removing them or by corrupting them) that it stopped being funny a long time ago.
Yeah, not a bad shout.
That's still dumber than I've come to expect from LLMs but as others have pointed out, I'm a developer who uses LLMs as a tool, not a manager using a LLM as a developer.
This is not AI's fault. In fact, they had to probably fight the LLM to get it this simple.
I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.
This disaster never would have seen the light of day if it weren't for AI.
I don't know, I'm more inclined to blame the usage rather than the tool here.
Do we blame the bulldozer if it bulldozes the wrong thing? We're just not used to bulldozing yet.
I'm not blaming the bulldozer. I blame the people who gave everyone bulldozers knowing that they have faulty steering and that nobody is used to bulldozing. And the people who shut down every attempt to prevent that with the argument "bulldozers are the future, you can't stop them!".
And yes, I also blame the people getting on that bulldozer, bulldozing like there's no tomorrow. But mainly I blame the first two groups.
Bulldozers aren't restricted vehicles, anyone can buy them. What you seem to be upset at is that they became very cheap and easy to obtain, and everyone is using them to landscape their small front yards and the damage caused is often outweighing the time saved by using something simpler that takes more time and effort. The bulldozers work fine, but if you use a large one to clear everything you might just find you've also taken out the walkway to your door inadvertently, when a small one that took a bit more time and effort would have allowed for you to target what needed attention.
That metaphor has been stretched about as far as I can take it, but it's the tools and people getting access to tools they've not been trained on to do tasks they have no prior experience with. As someone who just laid laminate flooring myself for the first time, I'm keenly aware of both having the right tool for the job and the knowledge of how to use it and knowledge of how to do the task in general affects the end product. The mistakes I made are my own, not the cause of the incorrect tools I used at times.
I'm not going to blame the tool. I'm sure as fuck going to blame the peddlers of the tools that are always ready to support this kind of nonsense; worse, they tell everyone around that this is perfectly fine.
Once you can't go for a walk without experiencing a bulldozer bulldozing the wrong thing somewhere on your path, it becomes a distinction without difference.
The bulldozer goes in the direction the person is sitting enough of the time we can call it "all the time" without having to argue "what if it breaks down, or a lever breaks and sticks on".
> I'm more inclined to blame the usage rather than the tool here.
Which is what your parent comment is doing. They didn’t say AI was to blame, they said this wouldn’t have happened without it. It may be your fault if you blow up your hands with a firecracker, but it’s also true that it wouldn’t have happened if firecrackers weren’t a thing.
> Do we blame the bulldozer if it bulldozes the wrong thing?
That’s such a tired analogy. By this point it’s honestly hard to believe it is made in good faith.
There isn’t a massive industry with tendrils in every facet of society trying to sell you on autonomous bulldozers that do the bulldozing for you without interaction, is there? Caterpillar is working on autonomous bulldozers, but even those aren’t targeted and advertised at every household as something you have to use.
Do we blame the bulldozer if it bulldozes the wrong thing?
The people who make the bulldozer don't market it as "intelligent."
Disagree on which end of the telescope were looking down.
AI has caused a generational set back on how stakeholders view the value of expertise knowledge, but the gun is still people, AI is just one of the bullets along with things like obsessive cost cutting.
My large orgs entire marketing strategy is now run by an MBA using Claude to generate 'idea and best practice docs'.
The process that lead us to not having a CMO or any other marketing leadership with domain knowledge? Consulting partnerships using MBAs.
The reason we're not changing any strategies even though we're burning money pper CPA? MBAs concerned seeking alignment and having the right narrative to change course.
Thr planned new course? More Claude.
That is true, but this can be said about so many things. Hit and runs would also not exist if it weren't for cars.
The technology itself is not to blame, but maybe the marketing around it should be. AI coding tools are marketed as magic tools that can somehow spit out perfect solutions even if the input spec is garbage. Of course that is impossible, and no amount of technology can solve that problem unless every AI coding agent is equipped with guardrails that makes it stop if it gets the impression that its user is an idiot.
A fool with a tool is still a fool.
AI is a massive multiplier. It’ll 100x anyone. It’s just many people start with negative coefficients…
What if it was intentional?
Thought experiment. A startup is at the end of their runway. Need to show income or go down. Businessmodel is to sell "one off" sales, and vast majority of their accounts buy once or twice (a year or ever).
What if they "accidentally" make it easier for hackers to take over those accounts. Accidentally, as part of a large overhaul or rewrite of their systems. Then, at least for a while, their accounts suddenly "buy" much more products per month or year.
Cynical, I know. But not unthinkable.
It’s the person’s fault who says you don’t need to review/read/understand the code. “2fa? that’s just gobbledygook”.
I doubt you have to fight anything to get there.
Nah. Pre-AI you'd never make it deep enough into a project to actually ship with this level of incompetence.
This just simply isn’t true. How short is your memory? Bad software, AND bad software of this nature, existed in plentiful quantities before “AI”.
No. This isn't "bad software". This is Code Bootcamp 2nd semester lab levels of incompetent. Most of the security lessons this product ignores were known (and solved) 20 years ago. The last time I saw a website in the wild that fell down this badly on basic user account security it was written in Perl.
Can someone there please just click the rollback button now and we can all forget this ever happened. I don't think that new site can be saved. The old site was fine. Just leave it like it was. I bought a bundle as recently as last month. Three bundles I think.
If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.
That's assuming the LLM manned for rollacks
This is something I don't get. The old development process was slow, but it was mostly safe and reliable.
People are rebuilding working things from scratch with AI just because they can.
AI eroded the greenfield advantage of rewriting a project from scratch because a rewrite generally meant that the code went through the fingers of the new developer. With AI that advantage is gone so you are better off incrementally improving the old code base to minimize overall maintenance costs and reduce the needed headcount as a result of this work.
To be fair, the greenfield advantage of a complete rewrite was also overestimated and frequently just lead to ungodly amounts of wasted resources on systems that never shipped or ended up being overly complicated. See https://en.wikipedia.org/wiki/Second-system_effect
AI lowered the cost of rewriting which means that more shitty systems ship because the rewriters don't run out of money before the rewrite is canceled. But it doesn't the solve the underlying problem of the people in charge of rewriting not understanding what features in the old system were actually important and which had to go.
I don't think the kind of people that did zero manual testing before deploy had a robust rollback plan
Perfect example of when rewrite is functionally worse for users and done for sake of doing it...
I wondered why I did not get email code from them for login. Then it arrive one hour later... Seems like pretty big oversight...
> rewrite is functionally worse for users
I've been involved in many "rewrites". Almost exclusively, the result is worse for users at release.
Especially with "big bang releases". Where a team is working behind the scenes for months or longer, attempting to rewrite the old system "bug for bug". Releasing and then finding out that some users would "hold the space bar to make the CPU heat up, and configuring emacs to interpret that as 'control'" (XKCD 1172). First, users don't see any improvements for all the time that the new system was being built. Secondly, they get all the new stuff bundled. So while they may even get value from the rewrite, it is bundled with the stuff that makes it worse. Three new features, one new bug. And all everyone sees is that new bug.
But even rewrites where parts are swapped out and released immediately, (strangler vine pattern!) are worse for the users. They do get value fast. And in small increments. They can give feedback early. But the (much longer) period in which the replacements are implemented, is almost always one of confusion, complexity, and "having to learn new things every week". We all know the systems where "change email" is a link that leads to a form on some other site, in an old design rather than part of the "edit account" page. Because the "account service" has been extracted, but the "notification service" replacement on the backlog still.
"rewrites" are almost always for the benefit of the business, the technical team, or other internal reasons. If "benefit to the users" is a part of it, it's almost always secondary: so that we can build and release and scale new features and cool stuff for users faster than with the old legacy spaghetti debt.
> You can also change your password without confirmation - you don't need to either enter the previous password or double-enter the new password.
This seems to be mostly people who don't know what they are doing? I'd any model would default to requiring this since it's pretty much the default everywhere.
If they asked Fable (or Opus?) to build this, for sure it would not mess up like that. Maybe they used something cheaper?
My experience with Opus 5.5 is that, it wouldn't, unless there is a framework that guides them to do it. Most of the times if I don't instruct him to do something more complex, it usually avoids it.
They deleted the download link for the original humble bundle. I can no longer download Gish.
I recently wanted to download a game I bought a long time ago through them (Machinarium, new macOS builds). Unfortunately the file on their CDN is corrupted. Their reply, after a week's worth of back and forth: sucks for you, it was sold too long ago so we won't bother fixing the issue.
> so bad that they have one-click payments enabled (which is illegal) for purchases.
Is this actually illegal in a jurisdiction or against ToS of payment providers and they can get permanently banned from using card payments?
I don't know about illegalness, I pressed "Get your games" button accidentally and it immediately deducted 12,99€ from my Paypal account without confirmation. What the hell.
Definitely illegal in Germany at least as any payment button needs to be clearly labeled as buying/paying for something. Probably illegal in more places as that button description doesn't really indicate that you are agreeing to a purchase.
It used to infringe Amazon's patent; which is why it has only become common recently. Not illegal.
It is where I live. Not going to create an account to check if it is enabled there as well.
If they don't have any presence in and don't actively target your region, your local laws and regulations might not be the ones that govern the transaction, though. Not sure if Humble Bundle has crossed that threshold yet for most of their non-US markets.
Probably the latter, not that it's any better.
sad when the honorable ones get infiltrated.
This last month has set my expectation that next month + next month is too many CVE's and I'm plugging the dam hole with my finger.
After they repeatedly reinstated, without consent, recurring payment for their subscription plan Humble Choice, which I repeatedly chose to pause (yes, they offered it as a first-party option), I had to cancel the plan entirely, as an early subscriber back when it's called Monthly.
It showed me that they just don't care anymore.
But it still baffles me as to how an LLM could make it this worse, when they already had decent security measures. No top-of-the-line model should've done this. I guess it can only be concluded that they didn't even care to spend some money on SOTA models, even DeepSeek 4.1 Flash, instead turning to the cheaper but also much less capable models to save a few pennies.
Maybe it was different when you used it, but when I had Humble Choice years ago, I remember that it was very clearly communicated that the "pause" is for one month only. Maybe a dark pattern that you have to remember, but it was shown
To me it was always pretty clear. Though I have heard there was some probable weirdness in the functionality. Still bit questionable of grandfathered "classic" subscribers were forced to go through this to keep their status. But that is pretty normal, only have seen one site that allows coming back later to subs at old sub.
With them killing the "classic" it doesn't really matter anymore. Better just to cancel.
Could be muddy memories, but yeah, leaving a Classic subscriber to that is a shame.
I think we need to hold our horses a bit here. Do we have evidence they used AI and what exactly did they use? Was it the same dev team? The post doesn’t mention anything except this line:
> turns out to be an AI shop.
If you check Reddit, people had been already complaining about HB functionally and design 6 years ago.
My bet is they outsourced to get cheaper devs, who did a sloppy job, even if they were using AI.
You are right, so to be precise: that was a hypothesis. It could well be a cheaper human dev doing something they don't understand.
- The UI components are the ones that cheap AIs default to - multiple regressions in functionality (can’t delete a card easily, no 2FA check, a lot of purchases are missing because somehow they botched a migration?) - they had a consistent design system for the FE before this, and now it looks like “Generic Gaming Website From 2025-2026. [Phrase 1. Phrase 2. Phrase 3]”
Even if they outsourced to devs that used AI, they are asking for a lawsuit to remove core security safeguards, while rolling old subscription plans onto the new plan in the same rewrite/migration.
You're very familiar with the dark pattern in the cancel flow.
You have to click through multiple primary cancel buttons, but the final one cancels the cancellation.
To be "fair" (if a victim "failing" to recognize a dark pattern should be counted on the victim), I wasn't exactly familiar with dark patterns, back when I cancelled the plan.
Interestingly, they didn't seem to set up much dark pattern for the cancellation of it - I recorded the automatically reinstated payment in a private rant post, but not a dark pattern in cancellation. To this point I don't really care to conspiracy this into the theory that they knew users who were angry enough to cancel couldn't be stopped, and/or the law might be against a dark cancellation pattern, but no so much as to a pause.
For anyone interested in deleting their account, I think this is the right link (at the bottom of the homepage): https://dsar.humblebundle.com/
Thx. Was trying to delete my account. I couldn’t find the option in the settings of the page. A quick search told me to go via the sepetate Support Page, but alas the Login Button there only leads to a 404. What a mess! Using your link and confirming Ziff Davis is the parent company of Humble Bundle before entering my data, worked. They should now hopefully close my account.
They do this annoying thing where their form has "Delete account" option but their response is another step in the chain, basically hope you forget or miss it.
To save people time, you need to go here: https://dsar.humblebundle.com/
This reminds me a bit of trying to close a patreon account years ago. They said they could only do it if I accept data terms for a 3rd party which would clear my data. Of course I didn't want to give my data to ANOTHER party just to clear my data. I refused many times over and got nowhere. No idea where I could have gone really.
Perfect. I closed my account and then unlinked my connected accounts but this seems like a much better option. I don't want my data to be involved in yet another hack.
Didn't the new management layoff basically the whole staff a couple of years back?
I'm surprised this is so far down the list of comments. Yes, they let all of their staff go 2 years ago.
https://www.pcgamer.com/gaming-industry/humble-games-layoffs...
Oh wow, when I read that the information came from Reddit, I thought it was one more of those fake ragebaits...
But it's true. I couldn't login no matter how I tried to do it. The thing is broken.
I wonder if the issues I was having trying to download my ebooks from them is related to "vibe coding".
It was pretty frustrating not being able to download the things I'd paid for.
The flow/interaction of changing passwords and email addresses is somehow a bit of a pickle for people to get their head around.
In general I think it is obvious that logged-in users must need their password to change their email address, and forgot-password users must need access to their email address to change their password.
I would be a little surprised if any coding-focussed AI, frontier or otherwise, didn't offer that by default if not prompted, but I will have to test this now with the local models I use — has anyone else?
But for some reason not everyone agrees re: the first of these.
I'd love to verify this for myself, but I can't even open the website anymore, I get:
The server at www.humblebundle.com sent back an error: 431 Request Header Fields Too Large
It might be due to the sort of bug that PayPal regularly inflicts upon themselves. Once so many different teams and different project revisions have each set their own cookies, the aggregate cookie header is now so long that their server won't even entertain your request long enough to serve you a custom error page.
Deleting cookies for the domain might solve it.
Are my humble bundle games gone? Sucks, cest la vie
Thanks for this. Been a Humble subscriber for years but this has just persuaded me to cancel
> managed to fuck up so bad that they have one-click payments enabled (which is illegal
Since when are one click payments illegal? Amazon's one-click payment patent expired in 2017
One-click payments are not illegal in themselves, but the EU requires that online purchases go through an explicit Checkout Confirmation screen. From what others have said on this thread, it appears this is the step that Humble Bundle skips.
https://www.eurogamer.net/humble-games-confirms-restructurin...
All staff laid off?!
Update: this is not relevant or related to Humble Bundle.
Article is from 2024 it's Humble Game not Humble Bundle
Nonetheless, at the same time they made Humble Games redundant, they put the Humble Bundle on life support, and my understanding is that its now operated by contractors rather than an in-house development team.
Humble Games seems to be part of Humble Bundle: https://en.wikipedia.org/wiki/Humble_Bundle
Update: see also https://en.wikipedia.org/wiki/Balor_Games
My order history is gone. The "new" look is bad, it seems another hallucinated neon brain fuck. Wasn't perfect before but why the need to change just for the sake of it? Why? What was improved? This is what pisses me off the most, using LLMs for doing things just for the sake of it
"A computer can never be held accountable, therefore a computer must never make a management decision"
> A COMPUTER CAN NEVER BE HORNY OR SAD
> THEREFORE A COMPUTER MUST NEVER MAKE AN ARTISTIC DECISION
As if anyone holds management accountable either. Big companies are full of VPs and Directors who make a mess and transfer orgs just before it comes back to bite them.
The only party truly above accountability is the shareholder (a questionable decision itself)
> The only party truly above accountability is the shareholder (a questionable decision itself)
This is decidedly not a "questionable" decision. I really, really shouldn't be held accountable for the conduct of any company in my ETF portfolio, as I have zero influence on their operations and zero insight into them (beyond what any member of the public has).
You do have influence, you just chose to give it away. Your ETF provider definitely votes in shareholder meetings in your name, using the voting rights which come with the shares they bought for you. If the fund you use doesn't offer pass-through voting or at least the choice of several voting policies, then you've got only yourself to blame for rubberstamping the asset manager's choices.
As to insight: a shareholder having information beyond what the public has is called "insider trading", so that's not going to happen. But nothing is stopping you from pushing the board to release more information to the public. At the moment there's little reason to do so as companies being secretive provides a competitive advantage, which is in the shareholder's interest - but that equation would obviously change when that same secrecy exposes the shareholder to risks of unknown size, and when all companies are forced to be transparent it is no longer a competitive disadvantage.
I disagree. I think you should be held responsible for all the stock that you own. If that means that ETFs are too dangerous for you that's good. Otherwise, it's rather foolish to expect shareholders make rational decisions beyond profit maximization.
If that is the case shareholders shouldn't have any influence outside of collect dividend and sell.
If you were accountable, you would be a lot more careful about what stocks you were investing in.
> I have zero influence on their operations
What do you suppose those shares you bought are for? "I decided to launder my accountability through a third party" doesn't have quite the same ring to it.
"A computer can never be held accountable, therefore a computer must make every management decision"
"A manager can never be held accountable, therefore a manager must make every computer decision"
HuggingFace incident strong precedent.
You want to do a crime, subtly hint your AI about it.
the site looks terrible too. on-hover menus that take an eternity to show up because of some stupid css transition. a huge blurry pixelated hero image blown up far too large a "new and trending" section that's straight up empty (broken?)
https://www.humblebundle.com/store
I was listing my purchases to download the games I've bought there before deleting my account and it would only show four at a time. Listing the games, it showed all the different versions with identical labels, so it was impossible to know whether I downloaded the Linux, Windows or Macintosh versions.
Also impossible to delete your account, I just found out.
https://dsar.humblebundle.com/, at the bottom of the homepage. It worked for me.
Sounds like shotgun project, cheap model with low effort, at the controls of someone who doesn't know how to build software, end to end.
AI doesn't produce bad software, people do.
AI definitely produces bad software, too.
It's up to the people involved in the process, to gatekeep AI to not *ship* bad software.
> AI definitely produces bad software
Does your IDE of choice produce bad software?
This kind of take is so tiring. There's not even an argument, just a willful misrepresentation of the situation.
No, but it doesn't write domain logic either.
The plain text editor never produced any kind of logic, or any kind of text for that matter, beyond what was explicitly typed into it. We never said the IDE "does" X when it got auto-complete.
My IDE doesn't produce software
Exactly.
Then why is my IDE relevant to your point about LLMs, which definitely produce software?
AI makes bad software like a saw makes bad furniture. The final result is never the tool's fault
I agree that the tool shouldn't be at fault, but I refuse to take responsibility when managers force me to use it.
Comparing AI to simple tools like a hammer or saw just isn’t right.
AI tools are complex systems that definitely can have agency, even though that is mostly human controlled. Bad controls = bad outcomes.
Yes, I totally agree that humans have the most control over them, but that doesn’t mean it’s completely off the hook.
If we really have to draw simplified real life comparisons, maybe a car or a gun would be more suitable “systems” that we can metaphorically compare AI to.
But it's hyper ultra super duper intelligent as far as marketing informs me. No one marketed a saw that way.
It's not really an apples-to-apples: you can ask an "AI" to build software to do a particular thing, and it will happily oblige and spend some of your money on it and produce something that actually runs.
You cannot just turn the saw on (if electric), point it at some wood and expect anything resembling furniture.
Comparing AI to a saw it's like admitting it's the same as an IDE. To some extent it is, it is more autonomous too though. It's more like a brain child robot with a saw and a grin on the face
Ai should randomly cut off people fingers occasionally as a polite reminder
But we’re being sold an “autonomous saw”. Who’s at fault here?
An "autonomous saw" still needs guidance; what's removed is - most of - the repetitive effort.
Not the saw that's being sold as "smarter" than all humanity and being said that it solves navier stokes.
At the end of the day, no matter how you put it, someone has to still actively ask for those solutions. When we get to the point that the saw decides to activate itself and go cutting stuff without being asked, then we can say the tool is actually doing stuff.
It's no more autonomous than a compiler, and a lot more random.
But it's not a tool, anymore than IKEA is a tool.
> AI doesn't produce bad software, people do.
AI makes producing bad software easier.
And faster!
Guns don't kill people, people do.
Nuclear weapons are a totally neutral technology with no particular affordances. That they can be used to kill people is totally beside the point and irrelevant to any discussion about their merits and downsides.
> with no particular affordances
In particular they offer their owner a high maintenance decaying shelf life, or an explosion.
Of the 2,476 explosions to date, two were used specifically to kill people, some of the others did kill people, although such things were supposedly unintentional.
They have not afforded a better way to make canals, mine in a controlled manner, or fart a starship to space .. although people have desired such affordances.
delusional bosses who decide that human work is worthless in comparison to 5 "ultraclaudes" running in a loop for a week is what produces bad software
People produce bad software using AI.
I just used Claude opus 5 high to refactor our permissions model to an hierarchical one. In the validation function, if a part of a permission grant was missing in the hierarchy, claude happily granted them approval instead of rejecting, fail open for permissions.
Always review the code an LLM creates.
(When I told Claude that this is very bad, its reply was “Good catch!”)
That's the problem: it's a possible code, not the best or even the right one.
It does seem particularly weird. You’d have to really try to make something this bad
ah of course if only they used a proper model
Blame anything except the thing that makes them money.
None of the issues raised in the post/article here even require any particular knowledge of how to build software. Anybody with a basic attention to detail would have noticed them. It's just somebody who simply DGAF shipping to live.
Not knowledge of how to build software, but knowledge of basic and preferred security practices required.
probably use gemini because its so bad
Wow, that's an impressive downgrade. Not only is the site uglier (gradients, gradients everywhere!), but I could log in without needing my 2FA at all. Shame too, since I found the old Humble site pretty charming.
The article doesn’t seem to provide any direct proof the new site was vibecoded? I mean, probably it was, but people were writing insecure software long before AI came along.
Without evidence, accusations like this are, ironically, just vibes-based.
What other reason would there be for a complete rewrite without any sort of security? They had a fully functional and secure backend, why would it require replacing just to redesign the site?
Incompetence. Corporate politics. Malice. Shady intent. Or a mix of some of that + AI.
You get regressions in design and security when you: - never documented how the old site work - never asked a good model/person to comb through the old codebase, and write a spec + PRD for how it works - ask a cheap LLM to redesign the whole website (without migrating auth, or some material % of old content)
It was ok before, not perfect but more than ok and secure. The new version it is indeed vibecoded doesn't matter if with ai or not, vibecoding to me means careless and sloppiness, either it be human or not
Yeah we just say that about anything now.
This is a horrible update - I suspect it used either a real dirt cheap LLM model or a real dirt cheap developer team!
I logged in to humble bundle through my gmail auth and purchases only show my last purchase from two weeks ago....
What happened to hundreds of dollars of purchases over last years?
This is what I see on: https://www.humblebundle.com/home/purchases
``` Some of your older order history is still on its way. We'll add anything left to show once it arrives. ```
It is funny, I downloaded the latest purchase and thought, maybe i should download my previous purchases on another computer, but why bother, all of my purchases were there two weeks ago...
WTF Humble????
EDIT: I checked https://www.humblebundle.com/home/library
It shows more items but still not complete...
``` Welcome to your new library! We're still moving a few things in. Your unrevealed content has already been moved over from our previous site, so it's ready for you here. The rest of your order history is being migrated automatically in the background. There's nothing you need to do, and all of your purchases are safe.
If something isn't showing yet, it will appear on its own soon. Thank you for your patience! ```
Extremely unprofessional
They fired their devs and put marketing people to code
I expect marketing types are freaking out even more about the jobpocalypse than devs. While it takes some skill to determine whether resultant code is working, marketing goes by vibes all the way up the chain.
Yeah this is really bad. Feels like they fired the dev team and let a PM with a claude sub just push to production. Even asking Claude to go through the site and note down things that don't make sense would've prevented at least some of this. There's really no excuse. I'm working on an android app (hobby, no ones is depending on it), and admittedly going by vibes, but I let Claude spin up emulators and even have a physical phone hooked up. It genuinely can do all the checks itself. It still breaks and misses some stuff, but I'm just a doing a hobby project. Major letdown this.
Humble hasn't been humble since the IGN acquisition.
Maybe they should finally change name to Edgy Bundle.
If you don't have any security, you can get rid of all those expensive security engineers!
If you try to log in, it gives you three captchas, once when you input your username and twice when you input your password lmao.
I removed the automatic payment process from paypal so at least that's safe, I'd recommend others to do the same at this point.
Cannot wait for some insider to tell us the story of how this came to be
But seriously, why would they not even check their vibecoding results from a security pov? Before ' launching' their new website?
"2-factor authentication no longer exists" WHY!?
Immediately rotated password and unlinked everything. This is a shit show.
I hate on hover menus with a passion.
What doesn't help is if you click it it hides it again. This is a common design issue though.
I thrashed 3x in a row trying to open the menu!
Wow, Humble Bundle still exists?
At least 2fa got removed. Man i hate this, every single shit wants 2fa.
Let me do 2fa when i have to pay not to just login to services i care very little.
And yes blizzard my wow account is not worth anything either.
> And yes blizzard my wow account is not worth anything either.
Plenty of other players would strongly disagree. Blizzard pushes so strongly for 2FA because the support costs associated with people complaining about their WoW accounts getting compromised and drained are massive. If every player were to just shrug and start over from scratch, Blizzard wouldn't have bothered with it.
There is a differecen between Blizzard adding it as an optional feature and forcing it onto me.
For a lot of services I'd rather just get a 'magic' link in my email and not have to deal with a password at all. I've got good email security so it's worth hanging a few lesser services off of that.
> And yes blizzard my wow account is not worth anything either.
You’d be surprised; a friend of mine had a battle.net account under one of his emails, because apparently his email was used to make a WoW account in college and was banned. He had never played wow before, contacted support, and they didn’t say what happened but revoked the ban
I wholly agree with this. People already took shortcuts with passwords, excessive MFA causes the same _need_ from people to flow through it, and we see it everywhere already (addons to autofill MFA etc).
I have mixed feelings about the removal, mostly because their 2FA sucked anyway.
IIRC it was only via email, which is a PITA. I don't want to switch to my email every time I login.
> IIRC it was only via email, which is a PITA.
Nope, it was also the regular time-based ones.
it honestly feels like they slopped this up with opus 4.5 a year ago, and then it was sitting for a year in corporate purgatory until the 10 layers of management managed to sign off on it.
Now this is how winners think
>To start with, 2-factor authentication no longer exists, it does not ask for any tokens to log in, so your password is the only security on there.
i thought i'd be hearing about downsides?.. elaborate plz
Why blame vibe coding?
It's always up to the skill of the human.
This perspective on vibe coding is both funny and contradictory. The core issue with vibe coding is that people ship things they don’t understand. To flip it around and blame it on the humans involved only after something goes wrong as if the issue is them vibe-coding “wrong” is foolish. The issue is the vibe coding.
It’s never about the tool, but about the responsibility. In humans are those that take responsibility for the tool they use, be it vim or opencode.
Most software teams I’ve seen were pushing things they don’t understand well before AI
Exactly, there were always shitty software teams. We should all strive to be that one day.
Vibe coding is just a really big hammer, what you do with it and what you do with results is still up to humans. Even if this was result of it, fuckup is ultimately fully in hands of somebody responsible (for product, website, clients etc).
If not, company is not viable and will crash badly soon. Market forces and all that.
For the vast majority of these issues, certainly including those mentioned here, simply testing before going live would make them beyond clear. So it's simply a bad developer likely working under bad management and, shockingly enough, producing a bad outcome.
LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart cousin" and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.
Is it about MBA mantras or simply folks never sticking around in one spot to have long term consequences affect them and their reputations?
So as I understand it, vibecoding means (meant?) that you don't look at the code it produces, you case only about the end results, e.g. website through a browser.
But in this case, they seem to have skipped that as well.
You don't need to look at the code to see that the website is lacking 2FA, a "confirm password" field, etc.
Vibe-coding is a skill (like tying shoelaces), not a tool. And there's always room for improvement.
If I had a dollar for every RoR coder who didn't understand the internals of the interpreter I would still not be richer than Musk because there are not that many coders.
No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.
git pull git@github.com:allofit/allthethings.git engineering patterns is what created this mess to begin with
Software is hard. But especially, evolving software over many years is hard.
I've seen people build great software but fail to evolve it.
All the lessons from agile, clean code, TDD and testable architectures, CI/CD, DevOps are really about building software that can evolve, yet most of those get ignored from time to time due to cost (frequently called time) pressures.
GenAI stresses this loop even more, and no human can effectively deal with the level of output you need to fit in to continue effectively shipping. This can only mean more bugs rather than fewer bugs.
Yes, in a well executed project, LLM agents can bring immediate value and find and fix bugs: because the system has the good feedback loop built in. As soon as you lose that (over shorter time with LLMs than with humans), it starts getting exponentially worse.
And this is all even before you stop and think if you are even building the right thing.
"Why blame vibe coding?"
Because it allows you to produce so much code that it's not viable to carefully review each line/module, and get the benefits of the fast output.
Writing code yourself forces your brain to start creating pathways in your brain and you can verify the correctness of those pathways in your mind (e.g. am I actually doing this right, if I have seen such API would I be happy to use it,...)
Not saying we should write code manually, just showing the differences.
And even if you don't carefully review each line of code (or if you do), it helps a lot if you understand the basic principles of what you're trying to build. In this case, the vibe coder clearly had no idea about account security standards.
Programmers don't just write code. They also understand why they're writing the code and what it's supposed to do.
Because "skill" is too generic to be a useful categorization of reality, so people identify more specific causes
I'm too old to keep up with the hip jargon these days; isn't "vibe coding" different from just using a coding agent?
There probably was no human in the loop.
Or more possibly the person incompetent one.
Because if a human was to program it, they might have stopped for a second and thought "Is this really a good idea?" whereas the LLM just goes "You're absolutely right! Here's some updates to the security code:"
My SOTA LLM spends disturbingly much time stopping me and telling me to shape up and do things right, especially on the security/legal/privacy side. Speaking from recent experience, it would NOT have anything CLOSE to this—I’d expect it to literally refuse to ship.
Whether that says more about me or about LLMs These Days, I’m not sure…
Are they programming with a SOTA model?
I don't think it does, I doubt SOTA models are going to sign off on this.
On the other hand, people incompetent enough to ship this couldn't have produced a working website if they had to handwrite the code, so in that sense LLMs are at fault.
The human who thought pressing publish on this wouldn’t have thought stopped to think about security even if it was handmade.
Was going to say the same. In fact we're seeing a huge wave of hacks caused by old human coded systems getting owned by "vibe" attackers.
Vibe coding is such an overused term now. Stats say what, 80% of programmers use AI to generate code? 90%? So everything is vibe coded. If you do well, no, it's still engineering. Someone makes a mistake? Cuts a corner somewhere? Vibe coded.
> Stats say what, 80% of programmers use AI to generate code? 90%?
I am extremely skeptical that those numbers are even close to accurate.
>So everything is vibe coded.
Given the sentiment that software is getting worse, buggier, and overall less stable, that isn't a comforting statement.
how many forced "tokenmaxxing" initatives do I need to bring up before we stop blaming developers for this reckless adoption of AI? These decisions come from the top, often from people who do not understand the software.
Vibecoding amplifies human mediocrity and enables grift.