[larve]

This take is toxic. You could write the same article in 2001 and lament all the newcomers writing insecure applications in php3, or in 2009 with all the newcomers writing insecure applications with node.js.

The solution is not to aggressively shame people into doing things the way you learned to do them, but to provide not just education and support, but better tools and frameworks to build applications such as these securely.

What are we doing?

[hammyhavoc]

Is it really toxic though? The dev shipped something that compromises the privacy of their users and shows zero regard for quality or law. Once you cross the line of shipping something, it's no longer a hobby thing, and likewise, this is something that Apple approved into the App Store. Both the dev and Apple failed in their due diligence.

The post points out exactly what's wrong, however, if it wasn't, it should have been sent to the dev prior to publishing the vuln(s). How can you educate somebody who doesn't actually know how to develop something? It's just prompting an AI.

The real story here is that Apple has continually slipping standards.

[jonplackett]

> shipped something that compromises the privacy of their users and shows zero regard for quality or law

*cough* Facebook *cough*

[AlienRobot]

There are millions of apps, small software shops, and small shop websites everywhere. The idea that all of these are following best practices is pure fantasy.

[larve]

Not only would you contact the author first, but spamming users with edgy notifications is puerile at best. As for “it’s just prompting an AI”, who cares, this person built an application that people find useful. This is the world we are at now, where a new set of people can use computers to make things happen. More senior developers can rage against the clouds, but that only gets you so far. This kind of gatekeeping happens at each wave of democratization of building software.

There’s also some pervasive view that handcrafted human code is somehow of superior quality which… uh…

[mrkeen]

> What are we doing?

We are listening to our bosses tell us that "we're way behind in AI adoption" and that we need to catch up to vibe coders like this.

I don't mind these data points at all.

[larve]

what about having vibe coders catch up to experienced software developers also using LLMs / AI tools?

[imiric]

> What are we doing?

Building tools that enable people with no experience to create and ship software without following any good software engineering practices.

This is in no way comparable to any previous period in the industry.

Education and support are more accessible than ever. Even the tools used to create such software can be educational. But you can't force people to learn when you give them the tools to create something without having to learn. You also can't blame them for using these tools as they're marketed. This situation is entirely in the hands of AI companies. And it's only going to get worse.

The only thing experienced software developers outside of the AI industry can do is observe from the sidelines, shake our heads, and get some laughs out of this shit show. And now we're the bad guys? Give me a break.

[larve]

A computer always was a tool to enable people without technical knowledge to build software. That was true for me as 9 year old in the 80ies.

LLMs are incredible engineering tools and brushing them aside as nonsense is imo doing a disservice to everybody, and especially ourselves if we take our craft seriously. You can literally replace llm with php and post the same take on usenet in 1999, or whenever you started writing software.

I am tired of engineers just throwing their hands up and being defeatist while fully endorsing whatever narratives the ai industry is throwing out there, when what we are talking about is a big pile of floats that is able to generate something that makes it into the App Store. It is unprecedented in its abilities, but it’s also nothing new conceptually. It makes computer things easier.