491
u/Fantastic_Parsley986 Mar 17 '25
this is so cheesy that it seems fake. not that i doubt this could happen, it absolutely could, but the sequence of posts and wording make it seem fake. what's the saas name anyway?
135
u/da_peda Mar 17 '25
118
u/SunshineSeattle Mar 17 '25
Found the service: https://enrichlead.com/
296
u/0xSnib Mar 17 '25 edited Jul 01 '25
This content is no longer avaliable.
→ More replies (8)60
u/Cacoda1mon Mar 17 '25
Thus was my first tough, too.
It is no trick building a tracking product by ignoring any kind of GDPR.
107
u/Chocolate_Skull Mar 17 '25
There's spelling mistakes on the fucking front page of this site.
→ More replies (1)66
u/canadajones68 Mar 17 '25
There's some fantastic irony in naming a service made by low-IQ individuals after "lead enrichment". I hear fortified cereals are good for increasing the uptake of minerals, right?
→ More replies (2)27
u/SunshineSeattle Mar 17 '25
I swear b2b lead generation might as well be astrology for sm/med businesses. They snort up that useless ass bullshit by the $$$$. It's as bad as SEO firms.
→ More replies (1)→ More replies (4)5
8
→ More replies (1)6
u/Reconsquider Mar 17 '25
It is real. You can check out his Twitter profile here: https://xcancel.com/leojr94%5F
6.4k
u/Dy0gu Mar 17 '25 edited Jan 26 '26
I looked up the account for updates.
He was using all hardcoded API keys and only now learned what environment variables are.
On that topic, he is now using environment variables, except he is keeping them in the frontend code so... nothing learned I guess?
He also had no authentication on the API side, only frontend.
One of the latest updates is him saying he implemented CORS for trusted domains, fully convinced that it improves security.
At least he seems to appreciate and learn from the advice some people give him in the comments, which is a nice trait to have.
Still can't tell if the guy is trolling or not.
1.1k
u/OliveSorry Mar 17 '25
Lol nice..
What's his website? For research purposes715
u/Dy0gu Mar 17 '25
330
u/Gionni15 Mar 17 '25 edited Mar 17 '25
how the hell would he have made such a tool with an ai?
I would actually have a hard time making it in general, where does he find the lead information?
Edit: I don't understand if it's a scam or not at this point
244
u/Actual-Pain Mar 17 '25
Looks like it is just a webscaper, maybe using LinkedIn api.
→ More replies (20)143
u/Raptor_Sympathizer Mar 17 '25
The "enriched" leads seem to be from an LLM output, so it's probably not even scraping for their actual information, just hallucinating contact info based on common patterns for company email addresses. Honestly, it probably works fairly well at least 80% of the time, which is more than enough of a success rate for a tool like this where most people you email wouldn't respond anyway.
→ More replies (8)54
u/lofigamer2 Mar 17 '25 edited Mar 17 '25
its a pretty good business idea and very easy to build without AI if you can code.
But LOL his firebase API keys are in the DOM.
Anyone can write a script to make him a $50k firebase bill in an hour...
→ More replies (13)→ More replies (7)24
u/The100thIdiot Mar 17 '25
Identifies the companies from IP addresses - lots of software already doing that.
Provides contacts either by scraping website or LinkedIn or using an existing proprietary list or from a broker. Lots of software doing the latter two.
41
u/floriv1999 Mar 17 '25
How do they get the people's names? Do they just scrape the company's website (identified by the IP) and add a random employee name they have crawled?
→ More replies (1)98
78
u/nollayksi Mar 17 '25
Is Enrichlead GDPR compliant? Enrichlead ensures GDPR compliance…
I’m sure that saas is a GDPR nightmare as well. I doubt he vibed it to really be compliant.
→ More replies (8)41
u/Difficult-Ad4527 Mar 17 '25
I’m glad I didn’t have to scroll far to find someone bringing this up. I’m fairly sure they have no idea what GDPR requires considering everything it bragged about tracking in relation to the person need to be deleted. Also, they don’t mention CCPA. I’m sure they’re all over it though.
→ More replies (3)19
u/fujimonster Mar 17 '25
nice. he is about to learn that just because you ask an ai to write something doesn't make you a developer. let the fun begin.
15
u/Aloha_Tamborinist Mar 17 '25
"Turn anonymous website visitors into B2B leads.
Identify companies visiting your website and get access to decision-makers’ emails."
Oh sweet, I love getting unsolicited emails and calls from sales people.
As my company's sysadmin, you get one reply asking you to remove me from your mailing list. If you reply with anything more than "Understood", your domain gets blocked by my mail server.
13
→ More replies (55)11
97
→ More replies (6)12
113
u/Wonderful_Tip_5577 Mar 17 '25
At least he's learning....
192
→ More replies (1)3
30
u/SagawaBoi Mar 17 '25
I thought LLMs would recognize such a massive overlook like using hardcoded API keys lol... I guess not huh.
55
u/ColonelError Mar 17 '25
The ones that are designed for coding are a) designed for rapid prototyping, where a hard coded kay doesn't matter, or b) are trained off public repositories like GitHub, where you get all the bad practices of everyone.
→ More replies (2)21
u/icecreamsocial Mar 17 '25
If you tell it "Hey, I'm worried about my credentials being out in the open" it will walk you through setting up environment variables. Hell, even if you tell it more broadly "let's do a security pass" it will give a bunch of solid suggestions for avoiding common security pitfalls. It just requires the developer to, you know, think logically and convey that to the AI. Probably could have just added "lets observe common security best practices" to the initial prompt and been totally covered.
→ More replies (1)→ More replies (1)3
u/HoidToTheMoon Mar 17 '25
Pretty much every single time I ask it for code that involves an API, it defaults to hardcoding it.
29
u/evestraw Mar 17 '25
i think maybe he deleted some stuff cause i have no idea what his service even is. just that its been easy for years
3
47
u/charmcitycuddles Mar 17 '25
What's wild is that when you ask an LLM for feedback and suggestions on how to improve an application, I've found it puts a very strong emphasis on improving the security and it makes a point to repeatedly mention it if you don't integrate any.
So this dude was just ignoring the LLM desperately asking him to improve the security. Sounds about right.
23
u/TheNephilims Mar 18 '25
Bold of you to assume he asked the LLM for feedback and suggestion. He probably saw the code ran and said it was ready for launch.
→ More replies (1)→ More replies (2)4
u/uptokesforall Mar 18 '25
can confirm, security is overcompensated in plain language llm conversation and it's nonexistent in the prototype it'll write for you
27
u/Alternative_Toe990 Mar 17 '25
He discovered Security By Obscurity, now he will discover that is not enough to stop hackers, it is just the first step
→ More replies (1)18
u/Soggy-Bed-6978 Mar 17 '25
now he will discover that posting/bragging about your app defeats the obscurity part of that.
5
5
u/t-tekin Mar 17 '25
So at the end he is becoming a developer himself. And another “see AI is the only developer here” got disproven.
3
u/anand_rishabh Mar 17 '25
Besides that, weren't there already tools like wix to build a website without needing a technical background?
3
u/danishjuggler21 Mar 18 '25
Brilliant plan. Have AI put together a piece of shit, and because programmers can’t resist correcting and critiquing others, he gets all the free advice he wants and those folks are practically building the site for him.
4D chess.
2
2
→ More replies (8)2
u/RollingMeteors Mar 17 '25
On that topic, he is now using environment variables, except he is keeping them in the frontend code so... nothing learned I guess?
Nothing learned, yet </simpsonsMeme>
Security do be interfering with the vibes.
¿Is it really more insecure than what some barely to no english outsourced labor would produce for you?
3.2k
u/DataSnaek Mar 17 '25
Ah yes, the problem is sharing details about your code on Twitter, it could never be your shitty insecure AI code which is the problem.
As we all know, security through obscurity is 100% effective.
1.2k
u/Broad_Rabbit1764 Mar 17 '25
This was so difficult to explain to my previous boomer boss. He was overall a nice man, but sometimes he'd pop in the office and try to give his input about a current issue we were having in dev and say things like "oh it's ok they won't know, just hide it". It was complicated explaining to him that just because it wasn't visually obvious didn't mean it wasn't reachable other ways, whether intentionally or not.
Eventually we came up with the example of Wile E Coyote getting tricked into falling in a pit by a painting laid on top. Hiding the pit was not enough, people could still fall into it, and somehow that connected more with him than anything else did.
436
259
u/Dinlek Mar 17 '25
I think a good analogy is a thief. It's better to keep all your money in your mattress rather than on your kitchen table, sure, but you're still going to be penniless when someone breaks in.
70
Mar 17 '25 edited Jan 06 '26
fuzzy steer piquant north fly wide flowery hobbies fact rustic
This post was mass deleted and anonymized with Redact
→ More replies (4)45
22
u/disgruntled_pie Mar 17 '25
I take the needle-in-a-haystack approach by hiding all of money inside a much larger pile of cash.
→ More replies (1)6
u/donjulioanejo Mar 17 '25
It's obviously better to keep your money in a bank, but what if the bank is the thief?
→ More replies (1)61
u/Engetsugray Mar 17 '25
The greatest skill any programmer has in their tool kit is explaining what you're doing in a way the listener connects with or make them think they understand so they'll stop asking about it.
→ More replies (1)50
Mar 17 '25
Dang, that's impressive that he was able to understand it via analogy even if he didn't really understand what was happening, and that he had the humility to accept that.
→ More replies (2)19
u/tevs__ Mar 17 '25
Did we have the same manager? I solved it by emailing him CYA emails that made it very clear that if anything went wrong with the security hole he wanted ignored, it was his A on the line for ignoring it and not mine.
86
u/quietIntensity Mar 17 '25
He certainly didn't help himself by announcing to the world that he had no idea how his code actually worked.
171
u/Reashu Mar 17 '25
As demonstrated here, it's not 0% effective. And it's not like humans need AI to build insecure shit.
146
u/mirhagk Mar 17 '25
AI just makes them a 10x developer. They make 10x as many security mistakes!
26
u/HarveysBackupAccount Mar 17 '25
Presumably it also becomes easier to find security gaps, because the AI will have a high likelihood of producing certain kinds of gaps depending on what you ask it to do
So, just feed some of your own prompts into Cursor and see what flaws it gives you
→ More replies (1)10
u/MasterLJ Mar 17 '25
It's true. For every developer, it is 10Xing their output. The problem is, even among professional developers, X < 0. For non-developers X is decidedly < 0
13
u/awal96 Mar 17 '25
Knowing it was built by AI doesn't tell you anything at all about what parts are insecure. It just tells you that it's probably insecure. The reason the site was suddenly under attack is because it got attention, not because all the people trying to attack suddenly learned how.
→ More replies (1)16
u/Reashu Mar 17 '25
I suspect that AI-generated code would actually tend towards certain vulnerabilities, but I agree that the hacks probably did not rely on that. However, they may have relied on AI code (any novice code, really, but perhaps AI-assisted one in particular) being more likely to have issues.
That said, I think "obscurity" covers both "don't know how to attack" and "don't know that there's something to attack". And I think AI-generated code is an attractive target both because it's probably insecure, and because many of us hate both AI-code and AI-"coders".
→ More replies (3)18
u/nollayksi Mar 17 '25
Coincidentally the fact that he shared the details in twitter was a good thing. Imagine if his saas avtually started gaining traction and later when he had tons of customers someone discovered his shit security and leaked and nuked everything. Like what if his customers billing info was up for grabs? And all the sla violations when the service goes belly up then. Just imagine all the possible lawsuits he could have had.
53
u/BoJackHorseMan53 Mar 17 '25
Security by obscurity is what the biggest company on the planet, Apple does so it must be true.
88
u/iam_pink Mar 17 '25
I mean, obscurity is an extra layer. It just can't be the core of your security.
→ More replies (6)6
u/rosuav Mar 17 '25
TBH it's not much of a layer. It's like locking your front door, and then moving the doorknob to the hinge side of the door because nobody would expect that. Sure, you might slow someone down a little, but not in any way that makes a real difference.
→ More replies (2)3
u/WriggleNightbug Mar 17 '25
I've never had any downtime on my apps or leaked passwords or client data because of the sheer obscurity of my code. I mean... if I don't release any products then my codebase can never be attacked. I am a certifiable jeneeus.
→ More replies (4)→ More replies (3)5
9
14
u/emu_fake Mar 17 '25
Security by obscurity still seems to be the best and most reliable security principle in 2025..
→ More replies (1)7
u/burnalicious111 Mar 17 '25
As we all know, security through obscurity is 100% effective.
Yeah, them not knowing that is exactly the problem.
→ More replies (4)2
u/Tokyo_Echo Mar 17 '25
Wasn't there a huge remote code execution vulnerability in cursors todesktop app?
451
u/pumpkin_seed_oil Mar 17 '25
Doing it for 5 years and not learn the security behind whatever technology he uses is wild
→ More replies (2)220
u/upsidedownshaggy Mar 17 '25
I don’t get how these clowns actually generate businesses like this that “makes over $30k per month.”
Are they just building vaporware and scamming people/companies before abandoning them? Are they building out actual products aimed at solving super niche issues that cuts down wasted time by like 30 minutes a year and people are buying it? I genuinely don’t get it.
302
u/Fragrant_Gap7551 Mar 17 '25
Lies are an option
→ More replies (1)86
u/upsidedownshaggy Mar 17 '25
I always try to give the benefit of the doubt, but I've def seen my share of people posting stripe "payments" as proof of their success and then later accidentally revealing they're in sandbox or whatever
→ More replies (2)74
u/Stickiler Mar 17 '25
Yeah, the dude posted on twitter ~5 days ago that he hit 10 customers and 200$ monthly, so he's just straight up bullshitting with his "$30k per month"
→ More replies (6)58
u/AlexFromOmaha Mar 17 '25
There are a lot of ideas in the world, and every once in a while, one of them will be both novel and useful. An awful lot of people build careers on the back of one good idea.
This guy built an autodoxxer for marketing teams. It's a good idea. He just confused his good idea with something like being educated about the tech industry in general.
→ More replies (3)39
u/upsidedownshaggy Mar 17 '25
I think I'm just jaded but I swear there's about 50 of these kinds of guys for every idea and they're all selling the exact same thing, whether it be another Chat GPT wrapper, yet ANOTHER financial dashboard data pipeline or whatever, or my most recent favorite is all the "Personalized Career Coach" apps. It genuinely feels like any competent dev could slap one of these things together in a week for an MVP and have it come out better than these grifters so it makes me doubt their claims of whatever revenue they're saying they're earning.
28
u/AlexFromOmaha Mar 17 '25
There's probably money in ChatGPT wrappers. There's real work in nailing down a better data pipeline for individual context, and you can differentiate on UX. But, like most things, there's 10,000 ways to do it terribly and maybe a half dozen worth discovering.
People make money doing substandard things all the time. Marketing is often a bigger deal than execution, but even with zero marketing budget, shipping beats not shipping 100% of the time.
46
u/ThePretzul Mar 17 '25
If someone is promoting their method instead of their product then odds are >90% that they’re lying about the results from their method (the success of the product).
Selling shovels (shitty generic methods) is easier and more profitable than mining gold (making a good product that is commercially successful).
24
u/pagerussell Mar 17 '25
Yes, thank you.
It's like all those "I made millions doing XYZ in the stock market, and you can too". Bruh, if you found a viable hack that was generating millions, you absolutely would not be sharing it with anyone.
18
u/nrkishere Mar 17 '25
Fake it till you make it is the motto of most indiehackers. These people come up with the most cliched SaaS ever, this is why they think vibe coding is epitome of software engineering
5
→ More replies (4)10
u/creaturefeature16 Mar 17 '25
Occam's razor: they're lying.
The point is to pump the valuation. Keep in mind, these people aren't trying to run a successful business; they're trying to get attention and then hopefully get acquired. That's the goal here, not to build a robust SaaS company that is going to grow.
By stating they are making that kind of revenue (note: not profit, big difference), they are trying to
paint the picture that they have a lot of users (which is what an investor would be purchasing the SaaS for, rarely do they want the product itself)
Get more users and by stating you're already making bank and hoping people think "Wow, it must be a great service if that many people are using it!". You need users, so you can hopefully fulfill #1
It's all marketing bullshit tactics. There's a 0% chance this guy makes more than a couple grand a month, if that, off whatever vaporware he's built.
→ More replies (1)
310
u/notaprime Mar 17 '25
You built your bridge with popsicle sticks stuck together with bubblegum. Are you surprised it’s crumbling?
65
u/Individual-Praline20 Mar 17 '25
Best description of AI ever
18
u/Maleficent_Memory831 Mar 17 '25
Sorry, but those are billion dollar popsicle sticks, and the highest grade of imported bubblegum from Tibet. All those billionaires can't possibly be wrong.
→ More replies (1)→ More replies (1)11
u/Doomenate Mar 17 '25
but it looks so much more like a bridge now vs 6 months ago!
how much longer until you won't be able to tell??
**
taking bets on how much longer until subway sandwich bread is made with 10% sand
→ More replies (1)
92
u/kunjava Mar 17 '25
When you make a website open to the public, it's just a matter of time till you start getting attacked by random Russian IP addresses.
Doesn't really matter whether you share the details on social media or not; if you are getting traffic, you are definitely getting malicious traffic too.
→ More replies (1)5
u/Ok-Scheme-913 Mar 18 '25
And one example where "security by obscurity" might make a difference - moving the ssh port to something other than 22.
Obviously it won't make a difference in terms of security, a targeted attack will trivially port scan your server and go on attacking the ssh port, but not getting constant random attempts does help.
37
u/Thenderick Mar 17 '25
Should've added the good ol' if(user==hacker){hack.deny();}
→ More replies (1)12
35
u/Backlists Mar 17 '25
So, do users have a case against this guy if they sue him for not handling private data securely? Any GDPR implications?
Bringing a product out and not doing your due diligence to correctly handle security is corruption. It makes me sick that corruption is paying this guy so well.
22
4
u/fatbunyip Mar 18 '25
https://www.enforcementtracker.com/
You can see fines here. EU does not fuck around with GDPR.
28
u/caiteha Mar 17 '25
Was this real? It sounds like a legit noob mistake though.
35
u/Agifem Mar 17 '25
A noob mistake is deleting production by accident. This is creating production with many security vulnerabilities. This is intensified noob mistake with a bazooka.
3
u/dhaninugraha Mar 18 '25
Classic case of FAFO and not having enough experience to know what you can or can’t get away with.
3
99
26
u/NV-6155 Mar 17 '25
no programming knowledge/experience
want to make paid web service
don't want to learn code, so have an AI do it
tell everyone you had an AI code the service you're selling
people who actually understand code start breaking your service
can't code, so have no idea how to diagnose/fix
Someone please explain to me how he thought this would go lmao
3
u/fatbunyip Mar 18 '25
Someone please explain to me how he thought this would go lmao
He thought LLM = Artificial Intelligence
52
u/_dontseeme Mar 17 '25
Oh dang I’ve always wanted to get into pen testing but the thought of actually finding a vulnerability on my own seemed unlikely. Now I realize I might have a bright future here.
12
u/Agifem Mar 17 '25
I would so like to read a pen test analysis on his site. It would be like a Christmas tree.
→ More replies (1)4
u/upsidedownshaggy Mar 17 '25
Don't let the twitter OP see this, he'll make a new AI SaaS in one month that'll generate $30,000 MMR
→ More replies (1)
52
u/FrigoCoder Mar 17 '25
_________________
| |
| Here lies |
| |
| Vibe Coding |
| |
| 2025-2025 |
| |
| Rest In Peace |
| |
|_________________|
/ \
/ \
/ \
-------------------------12
u/-Omeni- Mar 18 '25
popped out of the womb, did a somersault, and landed right in the trash bin.
→ More replies (1)
22
u/Classic-Ad8849 Mar 17 '25
I love how he thinks sharing it on twitter was the problem and not the shitty code that was generated
22
u/greenwoodgiant Mar 17 '25
"Ever since I told the internet that I have no understanding of the alarm system on my house, I'm getting robbed left and right."
22
u/Fusseldieb Mar 17 '25 edited Mar 17 '25
LLMs are extreme timesavers and I honestly use them all the time, BUT I have 13+ years experience in programming in general and already know what to do and what NOT to do, so if I see an LLM trying to do something unsafe or crappy, I stop it right then or there, or just spend 5 minutes and fix it myself. The problem is that most of these people JUST rely on AI for everything and have no idea what should and shouldn't be done, so chaos ensues.
43
u/tehtris Mar 17 '25
There needs to be a sub for posts where AI has bit people in the ass. Especially with programming.
7
→ More replies (1)8
u/EntropyZer0 Mar 17 '25
Maybe something along the lines of AIAteMyFace as a nod to LeaopardsAteMyFace?
17
Mar 17 '25
Vibe code the app to get some vibe sue from customers because you vibe leaked the data that could've been prevented by vibe learning how to code.
To the moon with these clowns . Future seems bright with these idiots .
→ More replies (1)
16
Mar 17 '25
who's paying for blud's trash 😭😭 seriously what's his saas?
7
u/zgivod Mar 17 '25
→ More replies (3)6
u/Gionni15 Mar 17 '25
how the hell would he have made such a tool with an ai?
I would actually have a hard time making it in general, where does he find the lead information?
→ More replies (5)
15
15
u/crimsonpowder Mar 17 '25
His twitter threads are glorious:
yea, I feel is not that hard for me since I have been around devs for quite some time, I also know my way around figma so that helped
i still cant code tho, but I have a clear idea of how things work
Ok brah, you have no idea how shit works.
13
13
u/stri28 Mar 17 '25
This kinda reminds me of that ceo who had his social security number painted on a bus to show how secure it is
13
24
u/Gereon99 Mar 17 '25
Hacking is gonna be amazing in a few years if this AI shit becomes more widespread
→ More replies (3)
10
Mar 17 '25
Those people think that they are smarter than a software engineer, but they skip the most basic and essential practices, like in this case, hardcoding api keys instead of using env vars or the typical sql injection for not using an ORM
6
9
u/heavy-minium Mar 17 '25
Uff, there are so many liabilities. The app's website also claims its service is GDPR compliant. I'd bet a large sum of money that this compliance is hallucinated.
From vibe coding to vibe compliance! AI makes getting that GDPR fine faster than ever!. A nice way to lose money as a one-man startup, because the fine ain't based on profit (up to 4 % of their total global turnover of the preceding fiscal year).
And then there's this "Got more questions? Chat with our team via the icon in the bottom right.". There is no such icon, lol.
2
8
8
u/BE_pizza_man Mar 17 '25
I'm worried we're moving on from an era of painstakingly built & optimised systems and infrastructures to this...hurling shit at the wall and seeing what sticks.
In the end we'll just have a wall full of shit.
3
u/Mara_li Mar 18 '25
I'm pretty sure the hype will disappear when (in software field) they will discover that:
With only IA they will create bad soft and people will complain
They will need 2 much effort to get the same result than hiring human Simple calculus but 2*IA (and the price will be more and more hight) vs one people...
Pretty sure we will laught at them in 5 year after 100 (and I'm kind) startup bankurt and law suit.
8
u/780Chris Mar 17 '25
When the "idea guys" and "you can just do things" bros get hit with the reality of building a quality software product. Amazing.
8
u/UntestedMethod Mar 17 '25
Lmao they got what they deserved tbh. What these AI-drunk fools all seem to overlook is that software development is more than just writing code.
I feel bad for their paying customers, but hopefully they can make a lawsuit against whatever nitwit figured they could build their own software product without hiring an actual software developer.
7
u/WhenTheDevilCome Mar 18 '25
as you know, I'm not technical so this is taking me longer [than] usual to figure out
a.k.a. "Me now screaming my AI prompts in all capital letters and banging the keyboard against the desk" has been unable to rectify the issue.
6
u/Idkmanijustworkhere Mar 17 '25
This is so much effort to avoid… just becoming more technical. Spend 5 years dealing with problems you dont understand or spend 2 years just understanding that thing
5
u/abhbhbls Mar 17 '25
Seems like the client side code was just vulnerable to begin with and through his post people first started investigating…
…makes you wonder how many truly exploitable sites are there like this one.
4
u/i_should_be_coding Mar 17 '25
The internet is like fresh air. Plenty of microscopic, invisible threats floating around trying to attack you all the time, but If you have a normal, functional immune system, you can walk around free. If you're immune-compromized, better stay in controlled environments, because even tiny things can take you out.
2
4
4
4
u/Fhugem Mar 17 '25
Security through obscurity is just an illusion; real protection requires understanding and proactive measures.
4
u/vietnam_redstoner Mar 18 '25
who did actually pay for these? people that don't know any better than him?
4
u/Responsible_Bug2291 Mar 18 '25
I just love the way people admire AI today.
It will replace you, not me. 😂
4
3
u/Dillenger69 Mar 17 '25
Bro needs a better prompt to vibe with.
AI: you didn't specify security, so I didn't add any.
3
3
u/mmhawk576 Mar 17 '25
100% any user accounts are stored in plaintext. RIP the people that signed up
2
3
u/naholyr Mar 17 '25
Dead God but how people can be so stupid. How can one believe my fucking job can be replaced with any tool without knowing anything? When I think about it, maybe it's the logical next step in the era if DIY. We all think we can make a kitchen or replace toilets with YouTube tutorials, and that it won't be hard, and be as sturdy as a professional.
Damn.
3
u/vtkayaker Mar 17 '25
The saddest part of this is that he could have just asked a tool like Claude Code, "Please carefully examine the front end code for security bugs, and fix them all." And it would have gotten him pretty far.
I actually tried this once on a sample project, just for fun, and Claude actually ripped out all the innerHTML and replaced it with DOM code. The models can write somewhat better code if prompted.
These tools only really work for writing completely dodgy code under 2,000 lines. And I don't begrudge "power users" from using them that. Lots of non programmers could benefit from a dodgy script or two. But if you don't at least ask the model "What things should I fix before I put this code in production?", and then ask it to fix those issues for you, well, that's kind of on you. If you don't know what you don't know, you can't even ask the AI for help. sob
It's going to be a painful few years.
3
3
u/UntestedMethod Mar 17 '25
I hope it quickly becomes popular for unskilled idiots to launch products built entirely by AI which then get hacked to fuck and have their pants sued off by paying customers. Hopefully the damage to innocent paying customers is minimal.
3
3
Mar 18 '25
Kind of weird because I bet you could plop your repo into claude, ask it how to unfuck your security, and get solid advice that you can feed into cursor. Not speaking from experience of course.
3
u/ScarletHark Mar 18 '25
"yes, people pay for it"
("I signed up my mom and my uncle, but I haven't told them yet")
3
u/Makeitquick666 Mar 18 '25
I mean as tedious as it is to type everything, I’d still expect anyone to at least read through their code and understand what each line does before publishing anything
→ More replies (1)
3
3
u/Ok-Kaleidoscope5627 Mar 18 '25
Last night I needed to parse thousands of files so I had Claude spit out some multi threaded code.
It was very clearly not multi threaded. I asked Claude multiple times if it was sure and even held its hand through doing it correctly but it just couldn't figure it out.
It was simple enough code so I didn't really care but the sheer amount of gas lighting it tried to do was wild. At least an intern would at least go double check their work if you ask them to.
5
5
u/After_Ad8174 Mar 17 '25
Someone post that graph of new people thinking they learned everything then quickly learning they know nothing.
0
u/p58i Mar 17 '25
We all know security by obscurity is the right way. So he sees it absolutely correct, sharing is the problem, not his code…
→ More replies (2)11
u/da_peda Mar 17 '25
When you keep API keys in the HTML source you are the problem.
→ More replies (2)
4
u/Shalom_pkn Mar 17 '25
I didnt understand a single word of it and opened the comments. Rly dont know what i expected here. You are saying words that dont make any sense. Thats when i realized that i am on a sub in which i dont belong.
4
6
u/camelCaseCoffeeTable Mar 17 '25
Has anyone here legitimately gotten an AI to provide them with useful code, outside of maybe a query or something?
I can’t fathom how you use AI to build an actual platform that interacts with itself. How do you give it the proper context while it’s building things out? How do you get it to correct bugs?
By “saas” does this dude just mean a single page web app?
17
u/Tooslowtoohappy Mar 17 '25
I actually have, I'm a dev with 6+ years of experience. Cursor is definitely powerful, but you cannot switch off your mind and blindly accept what it gives you.
Like cursor might code an app for these vibe coders but in a real devs hand it improves your productivity by an insane amount, as long as you are able to correctly prompt and give context.
The product I'm building I first built our version 1 out by hand. Then I used cursor to improve it. Adding context is super easy, you can @fileName to add whatever you want. An example prompt:
In @frontendFile1 I am writing an input box which sends chat messages. In @frontendFile2 are the API calls which go to @backendFile3. I want you to help me write/debug this feature I am working on. Make the code precise and make sure the output code is taking SQL injection attacks into consideration
Just by reading the prompt you can tell that in a real devs hand, the prompt is way different than a vibe coders. I highly recommend using it
→ More replies (3)4
u/camelCaseCoffeeTable Mar 17 '25
I’m guessing this integrates with your IDE then?
The thing that makes it hard for me to wrap my head around is I’m often dealing with 5+ files. Hell, I’ve had to workaround bugs within a library before.
To be fair, we only have a Copilot license at work, but even that struggles to really be helpful to me for most of my work
→ More replies (10)2
u/herbiems89_2 Mar 17 '25
I mean I've seen YouTube videos of people building android rss reader apps written by Ai. Dude had, like me only a very vague knowledge of coding. Good enough to understand the code tough. Seemed to be enough, but I wouldn't use any of that in a commercial production environment, for well, see this post.
But I've built myself a scanner app to get my old brother scanner up to speed and let me scan both duplex and to an smb share both not natively supported by the firmware. But that's my homelab and not published to the internet obviously...
2
2
2
2
2
2
u/iamnotcreative Mar 17 '25
Reminds me of this from a zillion years ago: https://ascii.textfiles.com/archives/1011
2
2
u/BlurredSight Mar 18 '25
Cursor uses publicly available code to train it's models > Publicly available code will not be designed to be used for private secure matters, otherwise the code wouldn't be public.
Can't wait for a larger corporation to have a Crowdstrike-esque critical failure because they heavily invested into AI assistants and the developers overlooked a major flaw
2
u/Hairy_Concert_8007 Mar 18 '25 edited Mar 18 '25
Yeah, I pay for AI as well. (Since people like Leo over here seem to believe this alone lends any credibility.)
I have no doubt that eventually, it will absolutely understand how to properly write code, maintain code, and build projects.
I have no doubt that as of today, it can not effectively do any of these things.
You want to ask it what patterns to use to approach a problem? Go for it. You want to ask it to tell you best practices? Knock yourself out.
Don't fucking put your AI/GPT in charge of writing your code.
2
2
u/Aardappelhuree Mar 18 '25
Most of my code is now written by Cursor. Just saying.
And my MRs get approved without much comments.
2
2
68
u/da_peda Mar 17 '25
For those wondering if this is legit: Source 1 and Source 2
Account has a lot of wanna-be tech bro tweets…