Rendered at 23:43:10 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
oliwarner 14 hours ago [-]
Weird that they lay all this at the feet of vibecoding. I've asked for authentication systems several times and they've tended to come with pretty good feature-sets. Perhaps it's because I know what I'm asking for.
Edit: I've just tried to log in and it's failed through both Google and email. Whatever they've done, they haven't tested it well.
mcv 14 hours ago [-]
Yes, but you're not vibe coding when you ask for an authentication system. You know what you mean by an authentication system and can tell when what the AI delivers is insufficient. A vibe coder can't.
The problem with vibe coding isn't the AI, it's how people use it. It's that people with no idea of what they're doing, now think they can do what used to require an expert.
0gs 12 hours ago [-]
the part that is weird to me: nobody really knows how much they know about designing a system in plain english until they try it. i would not have thought i knew enough words to be dangerous (self-complimentary), but i clearly do. i still think of myself as a know-nothing vibe coder, and the only way to prove it one way or the other would basically be to go back to college. lol
poisonborz 14 hours ago [-]
You do not code your authentication system, in 99% of cases. Take an external provider or a selfhosted OSS project.
soco 13 hours ago [-]
We're talking vibing here, not coding. And who knows what the agent will decide from fuzzy prompts, take an external provider or create a new one from scratch?
oliwarner 14 hours ago [-]
That's fair, I do, but it's alien to me that they wouldn't at least start with the old system as a starting point or another system, or that the LLM wouldn't make that link.
To get what tfa is describing, you'd need to explicitly request a dumbed down system, use a really shitty LLM, or both.
Honestly I'd sooner believe this is the result of a highschooler than a LLM.
mcv 13 hours ago [-]
Oh, absolutely. Why even try to fix what wasn't broken, and 'fix' it in a way that's likely to break it? It betrays a deep misunderstanding of what the site does and is supposed to do.
I've got no problem with people vibe coding a personal project or a prototype or something, but when you've got code in production, that a business depends on, you've got to be a massive idiot to blindly start rewriting it in this way.
syshyk 12 hours ago [-]
I think they wanted a site refresh, and instead of doing it visually and/or adding features at the same time (people do this still, I think its okay), they likely thought that due to AI assistance it would be easy to actually start from scratch.
Not sure why you couldn't take the "its easy with AI" path and actually refresh the current codebase.
This is hearsay mind you, I don't know how much of their old site is there...
NewLogic 14 hours ago [-]
It is the fault of vibe coding, the sell has consistently been AI solves all of this. Clearly someone somewhere has to know what the system should or shouldn't do.
cedws 14 hours ago [-]
No? I have heard literally nobody say that AI guarantees insecure code will never be written again.
Yoric 10 hours ago [-]
Erm.
I've seen a number of companies (and HN contributors) explain that AI produces code that is better than coders. Which, of course, if you actually think about it carefully, doesn't guarantee anything about security, but that's not how executives understand the sentence.
mattmanser 13 hours ago [-]
They do it by implication:
AI Companies: "AI is now amazing at spotting insecure code"
Implication: If it can spot it, all the code it writes must therefore be secure
kbenson 5 hours ago [-]
> Implication: If it can spot it, all the code it writes must therefore be secure
Which is funny to anyone that's prompted one to review some code for security problems where that code is something it generated previously.
Terr_ 3 hours ago [-]
I've had a co-worker "review" my change using an LLM, and the comment concerned a pre-existing behavior... Which was introduced by the same person.
4thguy 14 hours ago [-]
My read was that they didn't test it. How do can someone compare the old version vs the new one and miss something like 2FA?
rrcrsc 14 hours ago [-]
But you have asked for something specific. An authentication system.
If you ask it to rebuild a site that has x, y and z features, the AI will output an average outcome because it's doing broader implementations. Context and thinking only goes so far unless you have thousands upon thousands to burn in tokens.
oliwarner 13 hours ago [-]
The scope of the Humble site feels like 2 free months of Copilot. I've done more with less.
glimshe 11 hours ago [-]
This was likely the result of a CEO replacing their entire dev team by:
Build and maintain our website. Add features as needed. Rewrite everything as needed. Deploy automatically. Make it compatible. Make it fast, secure and bug free. Make it cyber. Make it cloud. Don't make mistakes.
jonlowen 4 hours ago [-]
"Make it cyber. Make it cloud. Don't make mistakes"
This is going to be my new motto from now on
But yeah, you description sounds pretty accurate from the outcome
Gareth321 14 hours ago [-]
I suspect LLMs are going to be used as convenient scapegoats for the foreseeable future. "Boss, I didn't fuck up, Claude did."
NekkoDroid 8 hours ago [-]
"A computer can never be held accountable, therefore a computer must never make a management decision." - IBM slide deck, 1979
Scratch the "management" and replace it with "critical" and we probably have a near universal statement (maybe also add that no sole person should make such decisions).
Yoric 10 hours ago [-]
Might be worse.
1. Boss orders dev to use Claude for everything. Claims proudly "we're AI-native", "we're using an AI factory". Disincentivizes any kind of human review.
2. Dev eventually gives in.
3. Claude makes mistakes.
4. Dev gets blamed, because they're the "human [fuse] in the loop".
soco 13 hours ago [-]
"And who used Claude on it? You did? Well..."
mattmanser 14 hours ago [-]
AI loves copying existing patterns in legacy code without asking, even if they're super-dumb. It's like it reads bad code and that anchors the pattern in its thinking.
It might have been some internal testing mechanism that's been corrupted. Or if they had an existing hole the AI probably convinced itself that was what was necessary.
That's one of the disadvantages of them hiding the "thinking" output they used to cycle through, sometimes you could spot that happening.
Yoric 10 hours ago [-]
> It might have been some internal testing mechanism that's been corrupted.
Yeah, I've seen so often the agent just getting rid of tests (either by removing them or by corrupting them) that it stopped being funny a long time ago.
oliwarner 13 hours ago [-]
Yeah, not a bad shout.
That's still dumber than I've come to expect from LLMs but as others have pointed out, I'm a developer who uses LLMs as a tool, not a manager using a LLM as a developer.
trvz 15 hours ago [-]
This is not AI's fault. In fact, they had to probably fight the LLM to get it this simple.
I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.
WD-42 15 hours ago [-]
This disaster never would have seen the light of day if it weren't for AI.
alex_duf 15 hours ago [-]
I don't know, I'm more inclined to blame the usage rather than the tool here.
Do we blame the bulldozer if it bulldozes the wrong thing? We're just not used to bulldozing yet.
Relic0935 14 hours ago [-]
I'm not blaming the bulldozer. I blame the people who gave everyone bulldozers knowing that they have faulty steering and that nobody is used to bulldozing. And the people who shut down every attempt to prevent that with the argument "bulldozers are the future, you can't stop them!".
And yes, I also blame the people getting on that bulldozer, bulldozing like there's no tomorrow. But mainly I blame the first two groups.
kbenson 5 hours ago [-]
Bulldozers aren't restricted vehicles, anyone can buy them. What you seem to be upset at is that they became very cheap and easy to obtain, and everyone is using them to landscape their small front yards and the damage caused is often outweighing the time saved by using something simpler that takes more time and effort. The bulldozers work fine, but if you use a large one to clear everything you might just find you've also taken out the walkway to your door inadvertently, when a small one that took a bit more time and effort would have allowed for you to target what needed attention.
That metaphor has been stretched about as far as I can take it, but it's the tools and people getting access to tools they've not been trained on to do tasks they have no prior experience with. As someone who just laid laminate flooring myself for the first time, I'm keenly aware of both having the right tool for the job and the knowledge of how to use it and knowledge of how to do the task in general affects the end product. The mistakes I made are my own, not the cause of the incorrect tools I used at times.
3form 14 hours ago [-]
I'm not going to blame the tool. I'm sure as fuck going to blame the peddlers of the tools that are always ready to support this kind of nonsense; worse, they tell everyone around that this is perfectly fine.
seba_dos1 14 hours ago [-]
Once you can't go for a walk without experiencing a bulldozer bulldozing the wrong thing somewhere on your path, it becomes a distinction without difference.
syshyk 11 hours ago [-]
The bulldozer goes in the direction the person is sitting enough of the time we can call it "all the time" without having to argue "what if it breaks down, or a lever breaks and sticks on".
latexr 9 hours ago [-]
> I'm more inclined to blame the usage rather than the tool here.
Which is what your parent comment is doing. They didn’t say AI was to blame, they said this wouldn’t have happened without it. It may be your fault if you blow up your hands with a firecracker, but it’s also true that it wouldn’t have happened if firecrackers weren’t a thing.
> Do we blame the bulldozer if it bulldozes the wrong thing?
That’s such a tired analogy. By this point it’s honestly hard to believe it is made in good faith.
There isn’t a massive industry with tendrils in every facet of society trying to sell you on autonomous bulldozers that do the bulldozing for you without interaction, is there? Caterpillar is working on autonomous bulldozers, but even those aren’t targeted and advertised at every household as something you have to use.
reaperducer 14 hours ago [-]
Do we blame the bulldozer if it bulldozes the wrong thing?
The people who make the bulldozer don't market it as "intelligent."
weego 14 hours ago [-]
Disagree on which end of the telescope were looking down.
AI has caused a generational set back on how stakeholders view the value of expertise knowledge, but the gun is still people, AI is just one of the bullets along with things like obsessive cost cutting.
My large orgs entire marketing strategy is now run by an MBA using Claude to generate 'idea and best practice docs'.
The process that lead us to not having a CMO or any other marketing leadership with domain knowledge? Consulting partnerships using MBAs.
The reason we're not changing any strategies even though we're burning money pper CPA? MBAs concerned seeking alignment and having the right narrative to change course.
Thr planned new course? More Claude.
ulrikrasmussen 14 hours ago [-]
That is true, but this can be said about so many things. Hit and runs would also not exist if it weren't for cars.
The technology itself is not to blame, but maybe the marketing around it should be. AI coding tools are marketed as magic tools that can somehow spit out perfect solutions even if the input spec is garbage. Of course that is impossible, and no amount of technology can solve that problem unless every AI coding agent is equipped with guardrails that makes it stop if it gets the impression that its user is an idiot.
p2detar 15 hours ago [-]
A fool with a tool is still a fool.
adastra22 14 hours ago [-]
AI is a massive multiplier. It’ll 100x anyone. It’s just many people start with negative coefficients…
berkes 14 hours ago [-]
What if it was intentional?
Thought experiment. A startup is at the end of their runway. Need to show income or go down. Businessmodel is to sell "one off" sales, and vast majority of their accounts buy once or twice (a year or ever).
What if they "accidentally" make it easier for hackers to take over those accounts. Accidentally, as part of a large overhaul or rewrite of their systems.
Then, at least for a while, their accounts suddenly "buy" much more products per month or year.
Cynical, I know. But not unthinkable.
geraneum 15 hours ago [-]
It’s the person’s fault who says you don’t need to review/read/understand the code. “2fa? that’s just gobbledygook”.
I doubt you have to fight anything to get there.
forgetfreeman 15 hours ago [-]
Nah. Pre-AI you'd never make it deep enough into a project to actually ship with this level of incompetence.
UqWBcuFx6NV4r 14 hours ago [-]
This just simply isn’t true. How short is your memory? Bad software, AND bad software of this nature, existed in plentiful quantities before “AI”.
forgetfreeman 7 hours ago [-]
No. This isn't "bad software". This is Code Bootcamp 2nd semester lab levels of incompetent. Most of the security lessons this product ignores were known (and solved) 20 years ago. The last time I saw a website in the wild that fell down this badly on basic user account security it was written in Perl.
15 hours ago [-]
1313ed01 15 hours ago [-]
Can someone there please just click the rollback button now and we can all forget this ever happened. I don't think that new site can be saved. The old site was fine. Just leave it like it was. I bought a bundle as recently as last month. Three bundles I think.
If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.
marisen 15 hours ago [-]
That's assuming the LLM manned for rollacks
imtringued 14 hours ago [-]
This is something I don't get. The old development process was slow, but it was mostly safe and reliable.
People are rebuilding working things from scratch with AI just because they can.
AI eroded the greenfield advantage of rewriting a project from scratch because a rewrite generally meant that the code went through the fingers of the new developer. With AI that advantage is gone so you are better off incrementally improving the old code base to minimize overall maintenance costs and reduce the needed headcount as a result of this work.
ulrikrasmussen 14 hours ago [-]
To be fair, the greenfield advantage of a complete rewrite was also overestimated and frequently just lead to ungodly amounts of wasted resources on systems that never shipped or ended up being overly complicated. See https://en.wikipedia.org/wiki/Second-system_effect
AI lowered the cost of rewriting which means that more shitty systems ship because the rewriters don't run out of money before the rewrite is canceled. But it doesn't the solve the underlying problem of the people in charge of rewriting not understanding what features in the old system were actually important and which had to go.
Dannymetconan 11 hours ago [-]
I don't think the kind of people that did zero manual testing before deploy had a robust rollback plan
Ekaros 16 hours ago [-]
Perfect example of when rewrite is functionally worse for users and done for sake of doing it...
I wondered why I did not get email code from them for login. Then it arrive one hour later... Seems like pretty big oversight...
berkes 14 hours ago [-]
> rewrite is functionally worse for users
I've been involved in many "rewrites". Almost exclusively, the result is worse for users at release.
Especially with "big bang releases". Where a team is working behind the scenes for months or longer, attempting to rewrite the old system "bug for bug". Releasing and then finding out that some users would "hold the space bar to make the CPU heat up, and configuring emacs to interpret that as 'control'" (XKCD 1172). First, users don't see any improvements for all the time that the new system was being built. Secondly, they get all the new stuff bundled. So while they may even get value from the rewrite, it is bundled with the stuff that makes it worse. Three new features, one new bug. And all everyone sees is that new bug.
But even rewrites where parts are swapped out and released immediately, (strangler vine pattern!) are worse for the users. They do get value fast. And in small increments. They can give feedback early. But the (much longer) period in which the replacements are implemented, is almost always one of confusion, complexity, and "having to learn new things every week". We all know the systems where "change email" is a link that leads to a form on some other site, in an old design rather than part of the "edit account" page. Because the "account service" has been extracted, but the "notification service" replacement on the backlog still.
"rewrites" are almost always for the benefit of the business, the technical team, or other internal reasons. If "benefit to the users" is a part of it, it's almost always secondary: so that we can build and release and scale new features and cool stuff for users faster than with the old legacy spaghetti debt.
dtech 14 hours ago [-]
> You can also change your password without confirmation - you don't need to either enter the previous password or double-enter the new password.
This seems to be mostly people who don't know what they are doing? I'd any model would default to requiring this since it's pretty much the default everywhere.
Jolter 14 hours ago [-]
If they asked Fable (or Opus?) to build this, for sure it would not mess up like that. Maybe they used something cheaper?
bigstrat2003 3 hours ago [-]
That's hogwash. It doesn't matter what model you use, they all will create crappy software unless you are involved sanity checking everything they do.
rrcrsc 14 hours ago [-]
My experience with Opus 5.5 is that, it wouldn't, unless there is a framework that guides them to do it. Most of the times if I don't instruct him to do something more complex, it usually avoids it.
nyktas 15 hours ago [-]
After they repeatedly reinstated, without consent, recurring payment for their subscription plan Humble Choice, which I repeatedly chose to pause (yes, they offered it as a first-party option), I had to cancel the plan entirely, as an early subscriber back when it's called Monthly.
It showed me that they just don't care anymore.
But it still baffles me as to how an LLM could make it this worse, when they already had decent security measures. No top-of-the-line model should've done this. I guess it can only be concluded that they didn't even care to spend some money on SOTA models, even DeepSeek 4.1 Flash, instead turning to the cheaper but also much less capable models to save a few pennies.
looperhacks 15 hours ago [-]
Maybe it was different when you used it, but when I had Humble Choice years ago, I remember that it was very clearly communicated that the "pause" is for one month only. Maybe a dark pattern that you have to remember, but it was shown
Ekaros 14 hours ago [-]
To me it was always pretty clear. Though I have heard there was some probable weirdness in the functionality. Still bit questionable of grandfathered "classic" subscribers were forced to go through this to keep their status. But that is pretty normal, only have seen one site that allows coming back later to subs at old sub.
With them killing the "classic" it doesn't really matter anymore. Better just to cancel.
nyktas 12 hours ago [-]
Could be muddy memories, but yeah, leaving a Classic subscriber to that is a shame.
p2detar 15 hours ago [-]
I think we need to hold our horses a bit here. Do we have evidence they used AI and what exactly did they use? Was it the same dev team? The post doesn’t mention anything except this line:
> turns out to be an AI shop.
If you check Reddit, people had been already complaining about HB functionally and design 6 years ago.
My bet is they outsourced to get cheaper devs, who did a sloppy job, even if they were using AI.
nyktas 12 hours ago [-]
You are right, so to be precise: that was a hypothesis. It could well be a cheaper human dev doing something they don't understand.
Keeeeeeeks 12 hours ago [-]
- The UI components are the ones that cheap AIs default to
- multiple regressions in functionality (can’t delete a card easily, no 2FA check, a lot of purchases are missing because somehow they botched a migration?)
- they had a consistent design system for the FE before this, and now it looks like “Generic Gaming Website From 2025-2026. [Phrase 1. Phrase 2. Phrase 3]”
Even if they outsourced to devs that used AI, they are asking for a lawsuit to remove core security safeguards, while rolling old subscription plans onto the new plan in the same rewrite/migration.
anilakar 15 hours ago [-]
You're very familiar with the dark pattern in the cancel flow.
You have to click through multiple primary cancel buttons, but the final one cancels the cancellation.
nyktas 15 hours ago [-]
To be "fair" (if a victim "failing" to recognize a dark pattern should be counted on the victim), I wasn't exactly familiar with dark patterns, back when I cancelled the plan.
Interestingly, they didn't seem to set up much dark pattern for the cancellation of it - I recorded the automatically reinstated payment in a private rant post, but not a dark pattern in cancellation. To this point I don't really care to conspiracy this into the theory that they knew users who were angry enough to cancel couldn't be stopped, and/or the law might be against a dark cancellation pattern, but no so much as to a pause.
scaglio 15 hours ago [-]
For anyone interested in deleting their account, I think this is the right link (at the bottom of the homepage): https://dsar.humblebundle.com/
gcatellani2k 15 hours ago [-]
Thx. Was trying to delete my account. I couldn’t find the option in the settings of the page. A quick search told me to go via the sepetate Support Page, but alas the Login Button there only leads to a 404. What a mess! Using your link and confirming Ziff Davis is the parent company of Humble Bundle before entering my data, worked. They should now hopefully close my account.
syshyk 9 hours ago [-]
They do this annoying thing where their form has "Delete account" option but their response is another step in the chain, basically hope you forget or miss it.
This reminds me a bit of trying to close a patreon account years ago. They said they could only do it if I accept data terms for a 3rd party which would clear my data. Of course I didn't want to give my data to ANOTHER party just to clear my data. I refused many times over and got nowhere. No idea where I could have gone really.
jjbinx007 15 hours ago [-]
Perfect. I closed my account and then unlinked my connected accounts but this seems like a much better option. I don't want my data to be involved in yet another hack.
u2secured_team 3 hours ago [-]
Early in development phase, we realised vibecoding required more guard rails and also human checks. Had this problem where agent would try to use the ssh key , connection string.
Started additing permission deny to claude instructions helped, however, not 100% fool proof
aeQu5igh 15 hours ago [-]
They deleted the download link for the original humble bundle. I can no longer download Gish.
nvgeele 15 hours ago [-]
I recently wanted to download a game I bought a long time ago through them (Machinarium, new macOS builds). Unfortunately the file on their CDN is corrupted. Their reply, after a week's worth of back and forth: sucks for you, it was sold too long ago so we won't bother fixing the issue.
agilob 16 hours ago [-]
> so bad that they have one-click payments enabled (which is illegal) for purchases.
Is this actually illegal in a jurisdiction or against ToS of payment providers and they can get permanently banned from using card payments?
petetnt 15 hours ago [-]
I don't know about illegalness, I pressed "Get your games" button accidentally and it immediately deducted 12,99€ from my Paypal account without confirmation. What the hell.
FinnKuhn 15 hours ago [-]
Definitely illegal in Germany at least as any payment button needs to be clearly labeled as buying/paying for something. Probably illegal in more places as that button description doesn't really indicate that you are agreeing to a purchase.
ZiiS 15 hours ago [-]
It used to infringe Amazon's patent; which is why it has only become common recently. Not illegal.
consp 15 hours ago [-]
It is where I live. Not going to create an account to check if it is enabled there as well.
lxgr 15 hours ago [-]
If they don't have any presence in and don't actively target your region, your local laws and regulations might not be the ones that govern the transaction, though. Not sure if Humble Bundle has crossed that threshold yet for most of their non-US markets.
ghurtado 16 hours ago [-]
Probably the latter, not that it's any better.
nitroedge 15 hours ago [-]
sad when the honorable ones get infiltrated.
This last month has set my expectation that next month + next month is too many CVE's and I'm plugging the dam hole with my finger.
swiftcoder 14 hours ago [-]
Didn't the new management layoff basically the whole staff a couple of years back?
timmytokyo 11 hours ago [-]
I'm surprised this is so far down the list of comments. Yes, they let all of their staff go 2 years ago.
Oh wow, when I read that the information came from Reddit, I thought it was one more of those fake ragebaits...
But it's true. I couldn't login no matter how I tried to do it. The thing is broken.
dava96 16 hours ago [-]
I wonder if the issues I was having trying to download my ebooks from them is related to "vibe coding".
It was pretty frustrating not being able to download the things I'd paid for.
wduquette 2 hours ago [-]
Been waiting for this sort of thing. It was inevitable; and we'll be seeing more of it.
dofm 14 hours ago [-]
The flow/interaction of changing passwords and email addresses is somehow a bit of a pickle for people to get their head around.
In general I think it is obvious that logged-in users must need their password to change their email address, and forgot-password users must need access to their email address to change their password.
I would be a little surprised if any coding-focussed AI, frontier or otherwise, didn't offer that by default if not prompted, but I will have to test this now with the local models I use — has anyone else?
But for some reason not everyone agrees re: the first of these.
InsideOutSanta 15 hours ago [-]
I'd love to verify this for myself, but I can't even open the website anymore, I get:
The server at www.humblebundle.com sent back an error: 431 Request Header Fields Too Large
thenickdude 12 hours ago [-]
It might be due to the sort of bug that PayPal regularly inflicts upon themselves. Once so many different teams and different project revisions have each set their own cookies, the aggregate cookie header is now so long that their server won't even entertain your request long enough to serve you a custom error page.
Deleting cookies for the domain might solve it.
15 hours ago [-]
dromologist 15 hours ago [-]
Are my humble bundle games gone? Sucks, cest la vie
jjbinx007 15 hours ago [-]
Thanks for this. Been a Humble subscriber for years but this has just persuaded me to cancel
londons_explore 15 hours ago [-]
> managed to fuck up so bad that they have one-click payments enabled (which is illegal
Since when are one click payments illegal? Amazon's one-click payment patent expired in 2017
lptome 15 hours ago [-]
One-click payments are not illegal in themselves, but the EU requires that online purchases go through an explicit Checkout Confirmation screen. From what others have said on this thread, it appears this is the step that Humble Bundle skips.
Update: this is not relevant or related to Humble Bundle.
staz 14 hours ago [-]
Article is from 2024 it's Humble Game not Humble Bundle
swiftcoder 9 hours ago [-]
Nonetheless, at the same time they made Humble Games redundant, they put the Humble Bundle on life support, and my understanding is that its now operated by contractors rather than an in-house development team.
My order history is gone. The "new" look is bad, it seems another hallucinated neon brain fuck. Wasn't perfect before but why the need to change just for the sake of it? Why? What was improved? This is what pisses me off the most, using LLMs for doing things just for the sake of it
rozenmd 16 hours ago [-]
"A computer can never be held accountable, therefore a computer must never make a management decision"
solyin 15 hours ago [-]
> A COMPUTER
CAN NEVER BE HORNY OR SAD
> THEREFORE A COMPUTER MUST NEVER
MAKE AN ARTISTIC DECISION
roncesvalles 15 hours ago [-]
As if anyone holds management accountable either. Big companies are full of VPs and Directors who make a mess and transfer orgs just before it comes back to bite them.
throwaway27448 15 hours ago [-]
The only party truly above accountability is the shareholder (a questionable decision itself)
adwn 15 hours ago [-]
> The only party truly above accountability is the shareholder (a questionable decision itself)
This is decidedly not a "questionable" decision. I really, really shouldn't be held accountable for the conduct of any company in my ETF portfolio, as I have zero influence on their operations and zero insight into them (beyond what any member of the public has).
crote 15 hours ago [-]
You do have influence, you just chose to give it away. Your ETF provider definitely votes in shareholder meetings in your name, using the voting rights which come with the shares they bought for you. If the fund you use doesn't offer pass-through voting or at least the choice of several voting policies, then you've got only yourself to blame for rubberstamping the asset manager's choices.
As to insight: a shareholder having information beyond what the public has is called "insider trading", so that's not going to happen. But nothing is stopping you from pushing the board to release more information to the public. At the moment there's little reason to do so as companies being secretive provides a competitive advantage, which is in the shareholder's interest - but that equation would obviously change when that same secrecy exposes the shareholder to risks of unknown size, and when all companies are forced to be transparent it is no longer a competitive disadvantage.
throwaway27448 15 hours ago [-]
I disagree. I think you should be held responsible for all the stock that you own. If that means that ETFs are too dangerous for you that's good. Otherwise, it's rather foolish to expect shareholders make rational decisions beyond profit maximization.
Ygg2 15 hours ago [-]
If that is the case shareholders shouldn't have any influence outside of collect dividend and sell.
amanaplanacanal 15 hours ago [-]
If you were accountable, you would be a lot more careful about what stocks you were investing in.
tempfile 15 hours ago [-]
> I have zero influence on their operations
What do you suppose those shares you bought are for? "I decided to launder my accountability through a third party" doesn't have quite the same ring to it.
15 hours ago [-]
ruined 16 hours ago [-]
"A computer can never be held accountable, therefore a computer must make every management decision"
ghurtado 15 hours ago [-]
"A manager can never be held accountable, therefore a manager must make every computer decision"
dist-epoch 15 hours ago [-]
HuggingFace incident strong precedent.
You want to do a crime, subtly hint your AI about it.
NietTim 15 hours ago [-]
Also impossible to delete your account, I just found out.
the site looks terrible too.
on-hover menus that take an eternity to show up because of some stupid css transition.
a huge blurry pixelated hero image blown up far too large
a "new and trending" section that's straight up empty (broken?)
I was listing my purchases to download the games I've bought there before deleting my account and it would only show four at a time. Listing the games, it showed all the different versions with identical labels, so it was impossible to know whether I downloaded the Linux, Windows or Macintosh versions.
xx__yy 16 hours ago [-]
Sounds like shotgun project, cheap model with low effort, at the controls of someone who doesn't know how to build software, end to end.
AI doesn't produce bad software, people do.
zendist 16 hours ago [-]
AI definitely produces bad software, too.
It's up to the people involved in the process, to gatekeep AI to not *ship* bad software.
skeledrew 15 hours ago [-]
> AI definitely produces bad software
Does your IDE of choice produce bad software?
Timon3 13 hours ago [-]
This kind of take is so tiring. There's not even an argument, just a willful misrepresentation of the situation.
Skinney 15 hours ago [-]
No, but it doesn't write domain logic either.
skeledrew 14 hours ago [-]
The plain text editor never produced any kind of logic, or any kind of text for that matter, beyond what was explicitly typed into it. We never said the IDE "does" X when it got auto-complete.
boomlinde 14 hours ago [-]
My IDE doesn't produce software
skeledrew 9 hours ago [-]
Exactly.
boomlinde 5 hours ago [-]
Then why is my IDE relevant to your point about LLMs, which definitely produce software?
skeledrew 3 hours ago [-]
There was a time when people had to walk around in a room flipping switches to create routines that were combined to produce software. Then there was creating and feeding punch cards or paper tape into machines. Go forward some more, and there was typing into a writer (couldn't even see what was being written!), and running through an assembler. And then there was the text editor, into which one typed (finally can actually see what's written so changes can be made) and saved, then switched to a terminal and ran a compiler (and maybe linker) on the thing saved. After that came the IDE which was not just the text editor with a "compile" menu option, but there was also a lot of templating and auto-complete and external libraries. Today there are coding agents bringing all this together even more with a few instructions.
Know what changes? The amount of human effort needed to produce increasingly sophisticated software keeps falling. And know what doesn't change? People are still inputting requirements into the machine, testing what comes out, and iterating until it works as they'd like it to. That's the software production process in a nutshell. Doesn't matter if it takes a few thousand iterations over many months, or a single iteration that takes a few hours. It's still people who actually produce software, not the IDE nor the LLM (both of course generate code to help in the production process).
Timon3 2 hours ago [-]
> And know what doesn't change? People are still inputting requirements into the machine
Before LLMs, only incredibly few programs were written by "inputting requirements into the machine", most code was about inputting instructions that fulfill requirements. Usually code is/was related to the requirements, but for anything non-trivial it was almost never a direct translation of the requirements.
So as far as I can see, you're trying to gaslight here.
skeledrew 2 hours ago [-]
Given the context, there really isn't much difference between "requirements" and "instructions", per se. It's the result that matters. Flipping switches, using punch cards/tape, typing hex/alphanumeric characters or using speech with coding tools all result in code.
Few programs were written in the past because the effort required was huge. Can you imagine how long it'd take to correctly code a simple calculator using only 0's and 1's? Or even hexadecimal? And then suddenly it took just a few lines of C. The transformation scale is similar now we can use natural language instead of having to learn a programming language.
Timon3 2 hours ago [-]
You're pretending there's not much difference between "requirements" and "instructions", but there very obviously is - it's the entire goddamn reason programmers were/are needed. If you were correct, there'd be no reason to spend so much money on people who translate requirements into instructions, but that's not how the absolute majority of our industry worked before LLMs.
> Few programs were written in the past because the effort required was huge.
What are you talking about? A lot of programs were written in the past.
0xbadcafebee 15 hours ago [-]
AI makes bad software like a saw makes bad furniture. The final result is never the tool's fault
toledocavani 15 hours ago [-]
I agree that the tool shouldn't be at fault, but I refuse to take responsibility when managers force me to use it.
zahrc 15 hours ago [-]
Comparing AI to simple tools like a hammer or saw just isn’t right.
AI tools are complex systems that definitely can have agency, even though that is mostly human controlled. Bad controls = bad outcomes.
Yes, I totally agree that humans have the most control over them, but that doesn’t mean it’s completely off the hook.
If we really have to draw simplified real life comparisons, maybe a car or a gun would be more suitable “systems” that we can metaphorically compare AI to.
necovek 15 hours ago [-]
It's not really an apples-to-apples: you can ask an "AI" to build software to do a particular thing, and it will happily oblige and spend some of your money on it and produce something that actually runs.
You cannot just turn the saw on (if electric), point it at some wood and expect anything resembling furniture.
boomlinde 6 hours ago [-]
But it's hyper ultra super duper intelligent as far as marketing informs me. No one marketed a saw that way.
hollowturtle 15 hours ago [-]
Comparing AI to a saw it's like admitting it's the same as an IDE. To some extent it is, it is more autonomous too though. It's more like a brain child robot with a saw and a grin on the face
blitzar 15 hours ago [-]
Ai should randomly cut off people fingers occasionally as a polite reminder
geraneum 15 hours ago [-]
But we’re being sold an “autonomous saw”. Who’s at fault here?
skeledrew 15 hours ago [-]
An "autonomous saw" still needs guidance; what's removed is - most of - the repetitive effort.
geraneum 13 hours ago [-]
Not the saw that's being sold as "smarter" than all humanity and being said that it solves navier stokes.
skeledrew 9 hours ago [-]
At the end of the day, no matter how you put it, someone has to still actively ask for those solutions. When we get to the point that the saw decides to activate itself and go cutting stuff without being asked, then we can say the tool is actually doing stuff.
0xbadcafebee 8 hours ago [-]
It's no more autonomous than a compiler, and a lot more random.
vconnor 15 hours ago [-]
But it's not a tool, anymore than IKEA is a tool.
rajayonin 15 hours ago [-]
> AI doesn't produce bad software, people do.
AI makes producing bad software easier.
Maxion 15 hours ago [-]
And faster!
l-mdev 15 hours ago [-]
Guns don't kill people, people do.
boomlinde 14 hours ago [-]
Nuclear weapons are a totally neutral technology with no particular affordances. That they can be used to kill people is totally beside the point and irrelevant to any discussion about their merits and downsides.
defrost 14 hours ago [-]
> with no particular affordances
In particular they offer their owner a high maintenance decaying shelf life, or an explosion.
Of the 2,476 explosions to date, two were used specifically to kill people, some of the others did kill people, although such things were supposedly unintentional.
They have not afforded a better way to make canals, mine in a controlled manner, or fart a starship to space .. although people have desired such affordances.
zahrc 15 hours ago [-]
[flagged]
0815beck 16 hours ago [-]
delusional bosses who decide that human work is worthless in comparison to 5 "ultraclaudes" running in a loop for a week is what produces bad software
vrganj 15 hours ago [-]
People produce bad software using AI.
halflife 15 hours ago [-]
I just used Claude opus 5 high to refactor our permissions model to an hierarchical one. In the validation function, if a part of a permission grant was missing in the hierarchy, claude happily granted them approval instead of rejecting, fail open for permissions.
Always review the code an LLM creates.
(When I told Claude that this is very bad, its reply was “Good catch!”)
postepowanieadm 12 hours ago [-]
That's the problem: it's a possible code, not the best or even the right one.
devilsdata 4 hours ago [-]
You forgot to add “make no mistakes”, obviously
jonplackett 16 hours ago [-]
It does seem particularly weird. You’d have to really try to make something this bad
0815beck 16 hours ago [-]
ah of course if only they used a proper model
johnnyanmac 16 hours ago [-]
Blame anything except the thing that makes them money.
somenameforme 15 hours ago [-]
None of the issues raised in the post/article here even require any particular knowledge of how to build software. Anybody with a basic attention to detail would have noticed them. It's just somebody who simply DGAF shipping to live.
skeledrew 15 hours ago [-]
Not knowledge of how to build software, but knowledge of basic and preferred security practices required.
tonyhart7 16 hours ago [-]
probably use gemini because its so bad
xavdid 16 hours ago [-]
Wow, that's an impressive downgrade. Not only is the site uglier (gradients, gradients everywhere!), but I could log in without needing my 2FA at all. Shame too, since I found the old Humble site pretty charming.
brindleth 15 hours ago [-]
The article doesn’t seem to provide any direct proof the new site was vibecoded? I mean, probably it was, but people were writing insecure software long before AI came along.
Without evidence, accusations like this are, ironically, just vibes-based.
Kwpolska 15 hours ago [-]
What other reason would there be for a complete rewrite without any sort of security? They had a fully functional and secure backend, why would it require replacing just to redesign the site?
Bishonen88 14 hours ago [-]
Incompetence. Corporate politics. Malice. Shady intent.
Or a mix of some of that + AI.
srgb_vs_cmyk 14 hours ago [-]
[dead]
Keeeeeeeks 11 hours ago [-]
You get regressions in design and security when you:
- never documented how the old site work
- never asked a good model/person to comb through the old codebase, and write a spec + PRD for how it works
- ask a cheap LLM to redesign the whole website (without migrating auth, or some material % of old content)
hollowturtle 15 hours ago [-]
It was ok before, not perfect but more than ok and secure. The new version it is indeed vibecoded doesn't matter if with ai or not, vibecoding to me means careless and sloppiness, either it be human or not
gbingles 15 hours ago [-]
Yeah we just say that about anything now.
pona-a 3 hours ago [-]
I love how every time a vibe-coding disaster comes to the frontpage, the entire comment section switches from "singularity was last Thursday, time to prep for post-scarcity" into majority anti-AI with a shade of "well, they shouldn't have used the 'make shit quick' tool to actually make shit, quick; they should have reviewed and polished the shit, until it's neither quick nor shit".
sireat 10 hours ago [-]
This is a horrible update - I suspect it used either a real dirt cheap LLM model or a real dirt cheap developer team!
I logged in to humble bundle through my gmail auth and purchases only show my last purchase from two weeks ago....
What happened to hundreds of dollars of purchases over last years?
```
Some of your older order history is still on its way.
We'll add anything left to show once it arrives.
```
It is funny, I downloaded the latest purchase and thought, maybe i should download my previous purchases on another computer, but why bother, all of my purchases were there two weeks ago...
```
Welcome to your new library! We're still moving a few things in.
Your unrevealed content has already been moved over from our previous site, so it's ready for you here. The rest of your order history is being migrated automatically in the background. There's nothing you need to do, and all of your purchases are safe.
If something isn't showing yet, it will appear on its own soon. Thank you for your patience!
```
Extremely unprofessional
mococa 16 hours ago [-]
They fired their devs and put marketing people to code
somenameforme 15 hours ago [-]
I expect marketing types are freaking out even more about the jobpocalypse than devs. While it takes some skill to determine whether resultant code is working, marketing goes by vibes all the way up the chain.
midasz 15 hours ago [-]
Yeah this is really bad. Feels like they fired the dev team and let a PM with a claude sub just push to production. Even asking Claude to go through the site and note down things that don't make sense would've prevented at least some of this. There's really no excuse. I'm working on an android app (hobby, no ones is depending on it), and admittedly going by vibes, but I let Claude spin up emulators and even have a physical phone hooked up. It genuinely can do all the checks itself. It still breaks and misses some stuff, but I'm just a doing a hobby project. Major letdown this.
anilakar 15 hours ago [-]
Humble hasn't been humble since the IGN acquisition.
Maybe they should finally change name to Edgy Bundle.
globalise83 14 hours ago [-]
If you don't have any security, you can get rid of all those expensive security engineers!
DuncanCoffee 15 hours ago [-]
If you try to log in, it gives you three captchas, once when you input your username and twice when you input your password lmao.
I removed the automatic payment process from paypal so at least that's safe, I'd recommend others to do the same at this point.
Cannot wait for some insider to tell us the story of how this came to be
totallygeeky 3 hours ago [-]
So I was a customer for a long time, stopping just around the sale to Ziff Davis I think, have several hundred items attached to my account. Astounded to see that while my library does seem to mostly be intact, the library shows 5 items at a time, no more. I have 506 pages of purchases, with no reasonable way to look at them, considering each also requires an additional click in to see the key.
Regardless of AI use (which like others I do suspect), this needed several more weeks/months to cook before being released, this is atrocious.
bronlund 16 hours ago [-]
I hate on hover menus with a passion.
syshyk 15 hours ago [-]
What doesn't help is if you click it it hides it again. This is a common design issue though.
genxy 15 hours ago [-]
I thrashed 3x in a row trying to open the menu!
sinbadbuilds 11 hours ago [-]
But seriously, why would they not even check their vibecoding results from a security pov? Before ' launching' their new website?
b3lvedere 11 hours ago [-]
"2-factor authentication no longer exists" WHY!?
Immediately rotated password and unlinked everything. This is a shit show.
moffkalast 14 hours ago [-]
Wow, Humble Bundle still exists?
origini 15 hours ago [-]
At least 2fa got removed. Man i hate this, every single shit wants 2fa.
Let me do 2fa when i have to pay not to just login to services i care very little.
And yes blizzard my wow account is not worth anything either.
crote 15 hours ago [-]
> And yes blizzard my wow account is not worth anything either.
Plenty of other players would strongly disagree. Blizzard pushes so strongly for 2FA because the support costs associated with people complaining about their WoW accounts getting compromised and drained are massive. If every player were to just shrug and start over from scratch, Blizzard wouldn't have bothered with it.
origini 11 hours ago [-]
There is a differecen between Blizzard adding it as an optional feature and forcing it onto me.
venzaspa 14 hours ago [-]
For a lot of services I'd rather just get a 'magic' link in my email and not have to deal with a password at all. I've got good email security so it's worth hanging a few lesser services off of that.
syshyk 15 hours ago [-]
I wholly agree with this. People already took shortcuts with passwords, excessive MFA causes the same _need_ from people to flow through it, and we see it everywhere already (addons to autofill MFA etc).
Keeeeeeeks 11 hours ago [-]
> And yes blizzard my wow account is not worth anything either.
You’d be surprised; a friend of mine had a battle.net account under one of his emails, because apparently his email was used to make a WoW account in college and was banned. He had never played wow before, contacted support, and they didn’t say what happened but revoked the ban
m000 14 hours ago [-]
I have mixed feelings about the removal, mostly because their 2FA sucked anyway.
IIRC it was only via email, which is a PITA. I don't want to switch to my email every time I login.
latexr 10 hours ago [-]
> IIRC it was only via email, which is a PITA.
Nope, it was also the regular time-based ones.
sznio 14 hours ago [-]
it honestly feels like they slopped this up with opus 4.5 a year ago, and then it was sitting for a year in corporate purgatory until the 10 layers of management managed to sign off on it.
ares623 15 hours ago [-]
Now this is how winners think
15 hours ago [-]
GodSmasher 14 hours ago [-]
[flagged]
laruss5 16 hours ago [-]
[flagged]
dorkwood 16 hours ago [-]
[dead]
gabucino 16 hours ago [-]
>To start with, 2-factor authentication no longer exists, it does not ask for any tokens to log in, so your password is the only security on there.
i thought i'd be hearing about downsides?.. elaborate plz
aurareturn 16 hours ago [-]
Why blame vibe coding?
It's always up to the skill of the human.
solid_fuel 16 hours ago [-]
This perspective on vibe coding is both funny and contradictory. The core issue with vibe coding is that people ship things they don’t understand. To flip it around and blame it on the humans involved only after something goes wrong as if the issue is them vibe-coding “wrong” is foolish. The issue is the vibe coding.
cpa 16 hours ago [-]
It’s never about the tool, but about the responsibility. In humans are those that take responsibility for the tool they use, be it vim or opencode.
denkmoon 16 hours ago [-]
Most software teams I’ve seen were pushing things they don’t understand well before AI
eddythompson80 15 hours ago [-]
Exactly, there were always shitty software teams. We should all strive to be that one day.
kakacik 15 hours ago [-]
Vibe coding is just a really big hammer, what you do with it and what you do with results is still up to humans. Even if this was result of it, fuckup is ultimately fully in hands of somebody responsible (for product, website, clients etc).
If not, company is not viable and will crash badly soon. Market forces and all that.
somenameforme 16 hours ago [-]
For the vast majority of these issues, certainly including those mentioned here, simply testing before going live would make them beyond clear. So it's simply a bad developer likely working under bad management and, shockingly enough, producing a bad outcome.
LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart cousin" and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.
bonoboTP 15 hours ago [-]
Is it about MBA mantras or simply folks never sticking around in one spot to have long term consequences affect them and their reputations?
_flux 16 hours ago [-]
So as I understand it, vibecoding means (meant?) that you don't look at the code it produces, you case only about the end results, e.g. website through a browser.
But in this case, they seem to have skipped that as well.
enronmusk 12 hours ago [-]
You don't need to look at the code to see that the website is lacking 2FA, a "confirm password" field, etc.
boomlinde 4 hours ago [-]
I'm sure it's both different groups of morons, but the constant shifting back and forth between "if you're reading code in 2026 you're wasting time" and "you wouldn't blame a hammer if you hit your thumb" is absolutely hilarious. LLMs are either a simple tool or a hyper-intelligent system depending on which characterization is anticipated to sell the most snake oil in any given instance.
At the very least, if these are indeed different groups of morons, one group is shutting up whenever the other is spewing their flavor of bullshit.
skeledrew 15 hours ago [-]
Vibe-coding is a skill (like tying shoelaces), not a tool. And there's always room for improvement.
15 hours ago [-]
p00ki3 15 hours ago [-]
If I had a dollar for every RoR coder who didn't understand the internals of the interpreter I would still not be richer than Musk because there are not that many coders.
No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.
git pull git@github.com:allofit/allthethings.git engineering patterns is what created this mess to begin with
necovek 15 hours ago [-]
Software is hard. But especially, evolving software over many years is hard.
I've seen people build great software but fail to evolve it.
All the lessons from agile, clean code, TDD and testable architectures, CI/CD, DevOps are really about building software that can evolve, yet most of those get ignored from time to time due to cost (frequently called time) pressures.
GenAI stresses this loop even more, and no human can effectively deal with the level of output you need to fit in to continue effectively shipping. This can only mean more bugs rather than fewer bugs.
Yes, in a well executed project, LLM agents can bring immediate value and find and fix bugs: because the system has the good feedback loop built in. As soon as you lose that (over shorter time with LLMs than with humans), it starts getting exponentially worse.
And this is all even before you stop and think if you are even building the right thing.
throwaw12 16 hours ago [-]
"Why blame vibe coding?"
Because it allows you to produce so much code that it's not viable to carefully review each line/module, and get the benefits of the fast output.
Writing code yourself forces your brain to start creating pathways in your brain and you can verify the correctness of those pathways in your mind (e.g. am I actually doing this right, if I have seen such API would I be happy to use it,...)
Not saying we should write code manually, just showing the differences.
mcv 15 hours ago [-]
And even if you don't carefully review each line of code (or if you do), it helps a lot if you understand the basic principles of what you're trying to build. In this case, the vibe coder clearly had no idea about account security standards.
Programmers don't just write code. They also understand why they're writing the code and what it's supposed to do.
eviks 16 hours ago [-]
Because "skill" is too generic to be a useful categorization of reality, so people identify more specific causes
b00ty4breakfast 16 hours ago [-]
I'm too old to keep up with the hip jargon these days; isn't "vibe coding" different from just using a coding agent?
agilek 16 hours ago [-]
There probably was no human in the loop.
Or more possibly the person incompetent one.
voidUpdate 15 hours ago [-]
Because if a human was to program it, they might have stopped for a second and thought "Is this really a good idea?" whereas the LLM just goes "You're absolutely right! Here's some updates to the security code:"
alwa 15 hours ago [-]
My SOTA LLM spends disturbingly much time stopping me and telling me to shape up and do things right, especially on the security/legal/privacy side. Speaking from recent experience, it would NOT have anything CLOSE to this—I’d expect it to literally refuse to ship.
Whether that says more about me or about LLMs These Days, I’m not sure…
voidUpdate 14 hours ago [-]
Are they programming with a SOTA model?
user43928 15 hours ago [-]
I don't think it does, I doubt SOTA models are going to sign off on this.
On the other hand, people incompetent enough to ship this couldn't have produced a working website if they had to handwrite the code, so in that sense LLMs are at fault.
FranzFerdiNaN 15 hours ago [-]
The human who thought pressing publish on this wouldn’t have thought stopped to think about security even if it was handmade.
15 hours ago [-]
resonious 16 hours ago [-]
Was going to say the same. In fact we're seeing a huge wave of hacks caused by old human coded systems getting owned by "vibe" attackers.
Vibe coding is such an overused term now. Stats say what, 80% of programmers use AI to generate code? 90%? So everything is vibe coded. If you do well, no, it's still engineering. Someone makes a mistake? Cuts a corner somewhere? Vibe coded.
bigstrat2003 15 hours ago [-]
> Stats say what, 80% of programmers use AI to generate code? 90%?
I am extremely skeptical that those numbers are even close to accurate.
johnnyanmac 16 hours ago [-]
>So everything is vibe coded.
Given the sentiment that software is getting worse, buggier, and overall less stable, that isn't a comforting statement.
15 hours ago [-]
johnnyanmac 16 hours ago [-]
how many forced "tokenmaxxing" initatives do I need to bring up before we stop blaming developers for this reckless adoption of AI? These decisions come from the top, often from people who do not understand the software.
roncesvalles 16 hours ago [-]
Vibecoding amplifies human mediocrity and enables grift.
Edit: I've just tried to log in and it's failed through both Google and email. Whatever they've done, they haven't tested it well.
The problem with vibe coding isn't the AI, it's how people use it. It's that people with no idea of what they're doing, now think they can do what used to require an expert.
To get what tfa is describing, you'd need to explicitly request a dumbed down system, use a really shitty LLM, or both.
Honestly I'd sooner believe this is the result of a highschooler than a LLM.
I've got no problem with people vibe coding a personal project or a prototype or something, but when you've got code in production, that a business depends on, you've got to be a massive idiot to blindly start rewriting it in this way.
Not sure why you couldn't take the "its easy with AI" path and actually refresh the current codebase.
This is hearsay mind you, I don't know how much of their old site is there...
I've seen a number of companies (and HN contributors) explain that AI produces code that is better than coders. Which, of course, if you actually think about it carefully, doesn't guarantee anything about security, but that's not how executives understand the sentence.
AI Companies: "AI is now amazing at spotting insecure code"
Implication: If it can spot it, all the code it writes must therefore be secure
Which is funny to anyone that's prompted one to review some code for security problems where that code is something it generated previously.
If you ask it to rebuild a site that has x, y and z features, the AI will output an average outcome because it's doing broader implementations. Context and thinking only goes so far unless you have thousands upon thousands to burn in tokens.
Build and maintain our website. Add features as needed. Rewrite everything as needed. Deploy automatically. Make it compatible. Make it fast, secure and bug free. Make it cyber. Make it cloud. Don't make mistakes.
But yeah, you description sounds pretty accurate from the outcome
Scratch the "management" and replace it with "critical" and we probably have a near universal statement (maybe also add that no sole person should make such decisions).
1. Boss orders dev to use Claude for everything. Claims proudly "we're AI-native", "we're using an AI factory". Disincentivizes any kind of human review.
2. Dev eventually gives in.
3. Claude makes mistakes.
4. Dev gets blamed, because they're the "human [fuse] in the loop".
It might have been some internal testing mechanism that's been corrupted. Or if they had an existing hole the AI probably convinced itself that was what was necessary.
That's one of the disadvantages of them hiding the "thinking" output they used to cycle through, sometimes you could spot that happening.
Yeah, I've seen so often the agent just getting rid of tests (either by removing them or by corrupting them) that it stopped being funny a long time ago.
That's still dumber than I've come to expect from LLMs but as others have pointed out, I'm a developer who uses LLMs as a tool, not a manager using a LLM as a developer.
I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.
Do we blame the bulldozer if it bulldozes the wrong thing? We're just not used to bulldozing yet.
And yes, I also blame the people getting on that bulldozer, bulldozing like there's no tomorrow. But mainly I blame the first two groups.
That metaphor has been stretched about as far as I can take it, but it's the tools and people getting access to tools they've not been trained on to do tasks they have no prior experience with. As someone who just laid laminate flooring myself for the first time, I'm keenly aware of both having the right tool for the job and the knowledge of how to use it and knowledge of how to do the task in general affects the end product. The mistakes I made are my own, not the cause of the incorrect tools I used at times.
Which is what your parent comment is doing. They didn’t say AI was to blame, they said this wouldn’t have happened without it. It may be your fault if you blow up your hands with a firecracker, but it’s also true that it wouldn’t have happened if firecrackers weren’t a thing.
> Do we blame the bulldozer if it bulldozes the wrong thing?
That’s such a tired analogy. By this point it’s honestly hard to believe it is made in good faith.
There isn’t a massive industry with tendrils in every facet of society trying to sell you on autonomous bulldozers that do the bulldozing for you without interaction, is there? Caterpillar is working on autonomous bulldozers, but even those aren’t targeted and advertised at every household as something you have to use.
The people who make the bulldozer don't market it as "intelligent."
AI has caused a generational set back on how stakeholders view the value of expertise knowledge, but the gun is still people, AI is just one of the bullets along with things like obsessive cost cutting.
My large orgs entire marketing strategy is now run by an MBA using Claude to generate 'idea and best practice docs'.
The process that lead us to not having a CMO or any other marketing leadership with domain knowledge? Consulting partnerships using MBAs.
The reason we're not changing any strategies even though we're burning money pper CPA? MBAs concerned seeking alignment and having the right narrative to change course.
Thr planned new course? More Claude.
The technology itself is not to blame, but maybe the marketing around it should be. AI coding tools are marketed as magic tools that can somehow spit out perfect solutions even if the input spec is garbage. Of course that is impossible, and no amount of technology can solve that problem unless every AI coding agent is equipped with guardrails that makes it stop if it gets the impression that its user is an idiot.
Thought experiment. A startup is at the end of their runway. Need to show income or go down. Businessmodel is to sell "one off" sales, and vast majority of their accounts buy once or twice (a year or ever).
What if they "accidentally" make it easier for hackers to take over those accounts. Accidentally, as part of a large overhaul or rewrite of their systems. Then, at least for a while, their accounts suddenly "buy" much more products per month or year.
Cynical, I know. But not unthinkable.
I doubt you have to fight anything to get there.
If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.
People are rebuilding working things from scratch with AI just because they can.
AI eroded the greenfield advantage of rewriting a project from scratch because a rewrite generally meant that the code went through the fingers of the new developer. With AI that advantage is gone so you are better off incrementally improving the old code base to minimize overall maintenance costs and reduce the needed headcount as a result of this work.
AI lowered the cost of rewriting which means that more shitty systems ship because the rewriters don't run out of money before the rewrite is canceled. But it doesn't the solve the underlying problem of the people in charge of rewriting not understanding what features in the old system were actually important and which had to go.
I wondered why I did not get email code from them for login. Then it arrive one hour later... Seems like pretty big oversight...
I've been involved in many "rewrites". Almost exclusively, the result is worse for users at release.
Especially with "big bang releases". Where a team is working behind the scenes for months or longer, attempting to rewrite the old system "bug for bug". Releasing and then finding out that some users would "hold the space bar to make the CPU heat up, and configuring emacs to interpret that as 'control'" (XKCD 1172). First, users don't see any improvements for all the time that the new system was being built. Secondly, they get all the new stuff bundled. So while they may even get value from the rewrite, it is bundled with the stuff that makes it worse. Three new features, one new bug. And all everyone sees is that new bug.
But even rewrites where parts are swapped out and released immediately, (strangler vine pattern!) are worse for the users. They do get value fast. And in small increments. They can give feedback early. But the (much longer) period in which the replacements are implemented, is almost always one of confusion, complexity, and "having to learn new things every week". We all know the systems where "change email" is a link that leads to a form on some other site, in an old design rather than part of the "edit account" page. Because the "account service" has been extracted, but the "notification service" replacement on the backlog still.
"rewrites" are almost always for the benefit of the business, the technical team, or other internal reasons. If "benefit to the users" is a part of it, it's almost always secondary: so that we can build and release and scale new features and cool stuff for users faster than with the old legacy spaghetti debt.
This seems to be mostly people who don't know what they are doing? I'd any model would default to requiring this since it's pretty much the default everywhere.
It showed me that they just don't care anymore.
But it still baffles me as to how an LLM could make it this worse, when they already had decent security measures. No top-of-the-line model should've done this. I guess it can only be concluded that they didn't even care to spend some money on SOTA models, even DeepSeek 4.1 Flash, instead turning to the cheaper but also much less capable models to save a few pennies.
With them killing the "classic" it doesn't really matter anymore. Better just to cancel.
> turns out to be an AI shop.
If you check Reddit, people had been already complaining about HB functionally and design 6 years ago.
My bet is they outsourced to get cheaper devs, who did a sloppy job, even if they were using AI.
Even if they outsourced to devs that used AI, they are asking for a lawsuit to remove core security safeguards, while rolling old subscription plans onto the new plan in the same rewrite/migration.
You have to click through multiple primary cancel buttons, but the final one cancels the cancellation.
Interestingly, they didn't seem to set up much dark pattern for the cancellation of it - I recorded the automatically reinstated payment in a private rant post, but not a dark pattern in cancellation. To this point I don't really care to conspiracy this into the theory that they knew users who were angry enough to cancel couldn't be stopped, and/or the law might be against a dark cancellation pattern, but no so much as to a pause.
To save people time, you need to go here: https://dsar.humblebundle.com/
This reminds me a bit of trying to close a patreon account years ago. They said they could only do it if I accept data terms for a 3rd party which would clear my data. Of course I didn't want to give my data to ANOTHER party just to clear my data. I refused many times over and got nowhere. No idea where I could have gone really.
Started additing permission deny to claude instructions helped, however, not 100% fool proof
Is this actually illegal in a jurisdiction or against ToS of payment providers and they can get permanently banned from using card payments?
This last month has set my expectation that next month + next month is too many CVE's and I'm plugging the dam hole with my finger.
https://www.pcgamer.com/gaming-industry/humble-games-layoffs...
But it's true. I couldn't login no matter how I tried to do it. The thing is broken.
It was pretty frustrating not being able to download the things I'd paid for.
In general I think it is obvious that logged-in users must need their password to change their email address, and forgot-password users must need access to their email address to change their password.
I would be a little surprised if any coding-focussed AI, frontier or otherwise, didn't offer that by default if not prompted, but I will have to test this now with the local models I use — has anyone else?
But for some reason not everyone agrees re: the first of these.
The server at www.humblebundle.com sent back an error: 431 Request Header Fields Too Large
Deleting cookies for the domain might solve it.
Since when are one click payments illegal? Amazon's one-click payment patent expired in 2017
All staff laid off?!
Update: this is not relevant or related to Humble Bundle.
Update: see also https://en.wikipedia.org/wiki/Balor_Games
> THEREFORE A COMPUTER MUST NEVER MAKE AN ARTISTIC DECISION
This is decidedly not a "questionable" decision. I really, really shouldn't be held accountable for the conduct of any company in my ETF portfolio, as I have zero influence on their operations and zero insight into them (beyond what any member of the public has).
As to insight: a shareholder having information beyond what the public has is called "insider trading", so that's not going to happen. But nothing is stopping you from pushing the board to release more information to the public. At the moment there's little reason to do so as companies being secretive provides a competitive advantage, which is in the shareholder's interest - but that equation would obviously change when that same secrecy exposes the shareholder to risks of unknown size, and when all companies are forced to be transparent it is no longer a competitive disadvantage.
What do you suppose those shares you bought are for? "I decided to launder my accountability through a third party" doesn't have quite the same ring to it.
You want to do a crime, subtly hint your AI about it.
https://www.humblebundle.com/store
AI doesn't produce bad software, people do.
It's up to the people involved in the process, to gatekeep AI to not *ship* bad software.
Does your IDE of choice produce bad software?
Know what changes? The amount of human effort needed to produce increasingly sophisticated software keeps falling. And know what doesn't change? People are still inputting requirements into the machine, testing what comes out, and iterating until it works as they'd like it to. That's the software production process in a nutshell. Doesn't matter if it takes a few thousand iterations over many months, or a single iteration that takes a few hours. It's still people who actually produce software, not the IDE nor the LLM (both of course generate code to help in the production process).
Before LLMs, only incredibly few programs were written by "inputting requirements into the machine", most code was about inputting instructions that fulfill requirements. Usually code is/was related to the requirements, but for anything non-trivial it was almost never a direct translation of the requirements.
So as far as I can see, you're trying to gaslight here.
Few programs were written in the past because the effort required was huge. Can you imagine how long it'd take to correctly code a simple calculator using only 0's and 1's? Or even hexadecimal? And then suddenly it took just a few lines of C. The transformation scale is similar now we can use natural language instead of having to learn a programming language.
> Few programs were written in the past because the effort required was huge.
What are you talking about? A lot of programs were written in the past.
AI tools are complex systems that definitely can have agency, even though that is mostly human controlled. Bad controls = bad outcomes.
Yes, I totally agree that humans have the most control over them, but that doesn’t mean it’s completely off the hook.
If we really have to draw simplified real life comparisons, maybe a car or a gun would be more suitable “systems” that we can metaphorically compare AI to.
You cannot just turn the saw on (if electric), point it at some wood and expect anything resembling furniture.
AI makes producing bad software easier.
In particular they offer their owner a high maintenance decaying shelf life, or an explosion.
Of the 2,476 explosions to date, two were used specifically to kill people, some of the others did kill people, although such things were supposedly unintentional.
They have not afforded a better way to make canals, mine in a controlled manner, or fart a starship to space .. although people have desired such affordances.
Always review the code an LLM creates.
(When I told Claude that this is very bad, its reply was “Good catch!”)
Without evidence, accusations like this are, ironically, just vibes-based.
I logged in to humble bundle through my gmail auth and purchases only show my last purchase from two weeks ago....
What happened to hundreds of dollars of purchases over last years?
This is what I see on: https://www.humblebundle.com/home/purchases
``` Some of your older order history is still on its way. We'll add anything left to show once it arrives. ```
It is funny, I downloaded the latest purchase and thought, maybe i should download my previous purchases on another computer, but why bother, all of my purchases were there two weeks ago...
WTF Humble????
EDIT: I checked https://www.humblebundle.com/home/library
It shows more items but still not complete...
``` Welcome to your new library! We're still moving a few things in. Your unrevealed content has already been moved over from our previous site, so it's ready for you here. The rest of your order history is being migrated automatically in the background. There's nothing you need to do, and all of your purchases are safe.
If something isn't showing yet, it will appear on its own soon. Thank you for your patience! ```
Extremely unprofessional
Maybe they should finally change name to Edgy Bundle.
I removed the automatic payment process from paypal so at least that's safe, I'd recommend others to do the same at this point.
Cannot wait for some insider to tell us the story of how this came to be
Regardless of AI use (which like others I do suspect), this needed several more weeks/months to cook before being released, this is atrocious.
Immediately rotated password and unlinked everything. This is a shit show.
Let me do 2fa when i have to pay not to just login to services i care very little.
And yes blizzard my wow account is not worth anything either.
Plenty of other players would strongly disagree. Blizzard pushes so strongly for 2FA because the support costs associated with people complaining about their WoW accounts getting compromised and drained are massive. If every player were to just shrug and start over from scratch, Blizzard wouldn't have bothered with it.
You’d be surprised; a friend of mine had a battle.net account under one of his emails, because apparently his email was used to make a WoW account in college and was banned. He had never played wow before, contacted support, and they didn’t say what happened but revoked the ban
IIRC it was only via email, which is a PITA. I don't want to switch to my email every time I login.
Nope, it was also the regular time-based ones.
i thought i'd be hearing about downsides?.. elaborate plz
It's always up to the skill of the human.
If not, company is not viable and will crash badly soon. Market forces and all that.
LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart cousin" and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.
But in this case, they seem to have skipped that as well.
At the very least, if these are indeed different groups of morons, one group is shutting up whenever the other is spewing their flavor of bullshit.
No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.
git pull git@github.com:allofit/allthethings.git engineering patterns is what created this mess to begin with
I've seen people build great software but fail to evolve it.
All the lessons from agile, clean code, TDD and testable architectures, CI/CD, DevOps are really about building software that can evolve, yet most of those get ignored from time to time due to cost (frequently called time) pressures.
GenAI stresses this loop even more, and no human can effectively deal with the level of output you need to fit in to continue effectively shipping. This can only mean more bugs rather than fewer bugs.
Yes, in a well executed project, LLM agents can bring immediate value and find and fix bugs: because the system has the good feedback loop built in. As soon as you lose that (over shorter time with LLMs than with humans), it starts getting exponentially worse.
And this is all even before you stop and think if you are even building the right thing.
Because it allows you to produce so much code that it's not viable to carefully review each line/module, and get the benefits of the fast output.
Writing code yourself forces your brain to start creating pathways in your brain and you can verify the correctness of those pathways in your mind (e.g. am I actually doing this right, if I have seen such API would I be happy to use it,...)
Not saying we should write code manually, just showing the differences.
Programmers don't just write code. They also understand why they're writing the code and what it's supposed to do.
Or more possibly the person incompetent one.
Whether that says more about me or about LLMs These Days, I’m not sure…
On the other hand, people incompetent enough to ship this couldn't have produced a working website if they had to handwrite the code, so in that sense LLMs are at fault.
Vibe coding is such an overused term now. Stats say what, 80% of programmers use AI to generate code? 90%? So everything is vibe coded. If you do well, no, it's still engineering. Someone makes a mistake? Cuts a corner somewhere? Vibe coded.
I am extremely skeptical that those numbers are even close to accurate.
Given the sentiment that software is getting worse, buggier, and overall less stable, that isn't a comforting statement.