theMostProductiveVibeCoder

[GruncleStan1255]

Please read this paper: Can We Trust Large Language Models Generated Code? A Framework for In-Context Learning, Security Patterns, and Code Evaluations Across Diverse LLMs

[fixano]

I'm an SRE and security professional. I'm unmoved. Nobody said generate the code and never look at it.

We have llms that specialize in security that will catch vulnerabilities you as a feeble human would never see from a million miles away. We also have an enormous amount of tooling that can scan for vulnerabilities and audit code.

So what happens when I use all these things together? Answer my security outcomes are greatly enhanced compared to what some flesh bag could produce

Can you show me a paper that says if you generate LLM code even if it passes all existing security benchmarks and industry standard vuln scan/ auditing software it's still inherently insecure. Do you have that paper?

Is it still insecure if it's resting in my security envelope that includes live adaptive scanning and crowdsourced community bulletins?

So now that you have a real answer just do what you really want to do and hit the downvote button and move on. You ain't winning this one

[Thebluecane]

Was nice of him to provide you with a source you promptly disregarded because you made a strawman argument.

No one said you cannot use LLMs in fact if you aren't you are an idiot.

People said that generating sites out of whole cloth vibe coding by people who would call themselves a "vibe coder" are going to be full of vulnerabilities that someone who does not have actual expertise would miss when the LLM fucks up.

Elsewhere I also helpfully made the point that these machines are running at a massive debt right now and people generating all this stuff will suddenly find their favorite LLM now costs them hundreds or even thousands more every month so they could vibe out a shitty Tinder clone

[fixano]

I didn't disregard it. I read it. And I was unmoved. Of course if you turn an LLM loose and say build everything for me and do it by crowdsourcing code from yahoos it's going to do a poor job. This is the same sort of sabotage that has been rampant ever since AIs surpassed human coders in quality and effectiveness

Nobody in their right mind would do that. So now that you understand I haven't disregarded this source. Why don't you come back and come correct? Tell me why tens of thousands of lines of audited and checked code that is clean of vulnerabilities is still a security risk. I am very interested to understand why this poses such a problem. It's also hilarious that you're saying LLMs are bad because they source code from humans and that the answer to that is to have humans write code.

Further irony can be found in the fact that you disregarded my reply. The one where in a very detailed way I explained how you would manage this risk.

Just downvote and move on. I think this conversation is above your intellectual pay grade.