No vibe coding needed. Many years ago, my friend, a new yet overly-confident web developer, pulled the entire list of usernames and passwords from the back-end when the login page opened. It was to "check if password is correct faster".
That was pretty common some years back. Earlier versions of popular discussion boards like phpBB and stuff would store everything in the mysql db in plain text. The practice only changed when sql injections became popular with script kiddies. Malicious admins would also just check user's email and password and try them elsewhere, reusing passwords was even more commonplace then than it still is today.
The UK already did that iirc. Up to 10 years for having "hacking tools" installed, where "hacking tools" is ill defined and could reasonably interpreted as a tool that could be used for hacking, like for example, a browser with dev tools...
"What a great question! You've clearly considered the security implications of putting development tools in the hands of an end user, you are a pioneer in the field of cyber security!...."
Proceeds to provide unrelated advice about disabling Https certification
That static JSON I'm seeing; isn't it possible that some server-side script, invisible to the user, could pre-generate that based on real numbers? (Not saying that it's the case here, just curious)
35 Comments
owenfromcanada@lemmy.ca · 152 pts · 203d
I feel like people are going to look back at the vibe coding era and wonder if we were all drunk...
TomMasz@piefed.social · 35 pts · 203d
I worked with a guy in the '90s who swore he did some of his best coding after our usual Friday after-work beers (the bar was next door).
surewhynotlem@lemmy.world · 33 pts · 203d
I hear this a lot from unmedicated high functioning ADHD types. The alcohol quiets the noise.
QueenMidna@lemmy.ca · 4 pts · 203d
Sure does!
Signed, a now-medicated, ADHD having, former alcoholic.
ninjakttty@lemmy.world · 16 pts · 203d
To paraphrase Hemingway. Code drunk, debug sober!
Quetzalcutlass@lemmy.world · 5 pts · 203d
I'm sure he did great work so long as he remembered to never, ever have any more than slightly less than two drinks.
matlag@sh.itjust.works · 3 pts · 203d
Since vibe coding produces code that looks like it was written by a drunk-dead dev, they might actually be on the right track!
its_kim_love@lemmy.blahaj.zone · 11 pts · 203d
This comic has contributed more than Windows ME in me remembering ME was a thing at all.
Quetzalcutlass@lemmy.world · 1 pts · 203d
Yaky@slrpnk.net · 80 pts · 203d
No vibe coding needed. Many years ago, my friend, a new yet overly-confident web developer, pulled the entire list of usernames and passwords from the back-end when the login page opened. It was to "check if password is correct faster".
(And yes, he stored passwords in plaintext)
jaredwhite@humansare.social · 28 pts · 203d
Maybe the entire database should be downloaded into the browser. Then it'll go really, really fast!
driving_crooner@lemmy.eco.br · 19 pts · 203d
It was faster?
Whelks_chance@lemmy.world · 13 pts · 203d
Webscale
kadu@scribe.disroot.org · 16 pts · 203d
And why is the database storing the passwords in plain text? Sure the web dev is wrong, but the back end guy is not the brightest either.
faythofdragons@slrpnk.net · 26 pts · 203d
Having been there, it's probably the same guy, lol
Sometimes you really do just gotta learn the hard way.
driving_crooner@lemmy.eco.br · 5 pts · 203d
Guess this is a "Fight Club" situation.
viking@infosec.pub · 2 pts · 203d
That was pretty common some years back. Earlier versions of popular discussion boards like phpBB and stuff would store everything in the mysql db in plain text. The practice only changed when sql injections became popular with script kiddies. Malicious admins would also just check user's email and password and try them elsewhere, reusing passwords was even more commonplace then than it still is today.
danielquinn@lemmy.ca · 5 pts · 203d
This is probably the code on which the LLM was trained.
cy_narrator@discuss.tchncs.de · 60 pts · 203d
I checked their website and its fixed now
30p87@feddit.org · 57 pts · 203d
But we know that thousands more very obvious bugs are on there... rl hack the box
cypherpunks@lemmy.ml · 56 pts · 203d
obvious solution is to vibe legislate a law to prohibit opening developer tools on other people's websites
TechieDamien@lemmy.ml · 29 pts · 203d
The UK already did that iirc. Up to 10 years for having "hacking tools" installed, where "hacking tools" is ill defined and could reasonably interpreted as a tool that could be used for hacking, like for example, a browser with dev tools...
wulrus@lemmy.world · 42 pts · 203d
When pointed out, the vibe coder will prompt: "How can I stop developer tools from working on my website?"
javiwhite@feddit.uk · 6 pts · 203d
"What a great question! You've clearly considered the security implications of putting development tools in the hands of an end user, you are a pioneer in the field of cyber security!...."
Proceeds to provide unrelated advice about disabling Https certification
Mwa@thelemmy.club · 26 pts · 203d
I remember one of my friends found a Vibe coded tool that did a similar thing, it had the supabase key on the client where anyone can see.
humanspiral@lemmy.ca · 17 pts · 203d
what is the waitlist? to use the expense tracker?
Tangent5280@lemmy.world · 7 pts · 203d
But its a super cool expense tracker that will change the world and put all other expense trackers to shame dontyaknow
mvirts@lemmy.world · 11 pts · 203d
Looks good, push it ✅💯
Wispy2891@lemmy.world · 10 pts · 203d
I always assumed those numbers are the result of some function like Math.random()*100...
GreenKnight23@lemmy.world · 5 pts · 203d
usually they are, because marketing 101 says, "don't let them know they're the only ones"
ComradeRachel@lemmy.blahaj.zone · 8 pts · 203d
Wait so everyone’s emails are just stored in JavaScript that anyone can see in their web browsers inspect tool? That’s a new level of if fail.
ADTJ@feddit.uk · 7 pts · 203d
You can see in the screenshot that it's a server response, not in the JS. Still bad though
FalschgeldFurkan@lemmy.world · 7 pts · 203d
That static JSON I'm seeing; isn't it possible that some server-side script, invisible to the user, could pre-generate that based on real numbers? (Not saying that it's the case here, just curious)
Batman@lemmy.world · 16 pts · 203d
still super non performant, why send so much data when you could just send an integar.
capuccino@lemmy.world · 4 pts · 203d
Relevant.
TheEighthDoctor@lemmy.zip · 1 pts · 203d
I've seen this vulnerability before but it was in websockets, all the connected user details were listed.