So you trusted 22-year-old coffee junkies copying and pasting from stack overflow 10 years ago but when a language model does it it's suddenly offensive? We should be instead celebrating how we have a mini software company at our fingertips ready to fix the broken hobbyist shit we've never had time for. OpenLogi is a perfect example of this use case and that it's open source makes it more trustworthy not less.
If you really wanna worry about all of these things you better not use any open source from now on. Or even private software as well, because you can't even audit and know what "vibe code" touched.
Being generous in my assumptions, you may have missed that my intent by "recent sprawl" indicates, "things are getting worse, at a rapid rate". At no point did I mean malware didn't exist 15 years ago.
It is getting worse, faster. That's objectively true.
> you trusted 22-year-old coffee junkies copying and pasting from stack overflow 10 years ago
Absolutely. There is a limit to how much code can be shared on stack overflow and, in the pre-AI days, code snippets had to be understood well enough to integrate into a larger hand crafted work.
Furthermore, stack overflow code is shared by consenting users and is licensed per the terms of service, unlike AI generated code which is trained on non-consenting users and is both ethically and legally dubious.
I don't think stackoverflow contains code to integrate a keylogger in a mouse driver. Copy-paste isn't that bad. Most of the (coding) LLMs however probably do know how to do that. They enable script kiddies to make more dangerous tools. So yes, vibe coding is a danger.
Where did I say you should audit all the code you run daily?
Not sure if you're being manipulative on purpose or if you genuinely did not understand my point. I was talking about "trust", which is a whole concept in itself.
I understood your comment the same way as the guy you're replying to. Maybe it'll help if you expand on whether we can trust vibe coded software? That's really the crux of the issue, and if you're not addressing that your comment is just a truism
Code can make your computer do stuff. If you run code in an environment where it has the possibility to do harm, then it is a possibility, and therefore a risk. Whether or not you accept that risk depends on the situation, but it is important to realise that the risk exists.
> I don't really see how its provenance matters
The fact that the code was vibe coded does not change the capabilities it has. If you run random code written by a human with root access, the code can do what root can do. If you run random vibe-coded code with root access, the code can do what root can do.
When you run code, what the code is allowed to do in the environment it is running is independent from who or what wrote that code.
> you should not run code you don't trust, period.
Trust does not mean that you have to review all the source code everyday, yourself. Trust means that you accept the risk given the provenance.
When you drive you car, you trust that it won't explode. You don't review the whole car assembly every day. When you cross a bridge, you trust that it won't collapse. You don't check the whole structure everytime yourself.
When you run your laptop, you trust that the battery won't catch fire. You trust that your OS isn't a malware.
In your life, you trust many many things. Many times you don't have a choice, many times it's institutional trust ("I live in a country where bridges don't collapse", for instance).
Now when you run code you find on the internet, I'm sure you apply that. Say it comes from Google: you probably trust it (after all, if you don't trust Google you're pretty much screwed).
Now if a random username on Reddit tells you to execute some code, do you happily do it? I don't think so. At least you shouldn't unless you understand what it does.
What's the difference between random code you find on Reddit and vibe-coded code? I don't see one. I don't base my trust on the fact that it was written with AI.
The fact that it comes from AI means "it is not an author that I trust, but it doesn't mean that the code is malware". I just need to find another way to trust it (maybe someone else audits it, maybe I do, maybe I run it in an environment where it doesn't matter, etc).
Let's say you follow a link to a github project and you have to assess whether to trust that code, how do you do it?
Before AI just having a good README and superficially looking good code (we're not going to do a deep review of it) was a gauge of quality that at the very least the person that wrote it knows what it's doing.
How do you do it now? Maybe the AI was expertly guided, but maybe it was vibe-coded by someone who hasn't even heard of basic security principles and your whole data is sent in plain-text somewhere. It doesn't have to be nefarious, it could be a debug feature that was never removed, or maybe the user never asked the llm to "make it prod safe". And there's no way to know unless you read the whole thing, because superficially the README and the code will look as good as any other llm project.
That's problem number one, before you could quickly see if it's made by someone who knows what it's doing, and thus that you can trust. With vibe-coded software not so much.
The second issue is not inherent to vibe-coded software but it's caused by it: it's a sea of garbage. It's very possible that the absolute amount of good software has increased, but it's become harder to find it.
I disagree with your premise that anyone seemingly competent can be trusted.
> It's very possible that the absolute amount of good software has increased, but it's become harder to find it.
It was like that long before AI. Most software written by humans is very bad, and it was accelerating before AI. And there was too much software to review everything long before AI as well.
If anything, I find that AI writes better code than the average human-written code. Of course it makes it harder to judge the contributor (before I could clearly see that they were not good coders, now I can't). But as a maintainer, I was reviewing the code before, and I am still reviewing it now. Some people will send unreadable AI-generated PRs that I won't review, some people will send readable PRs that I will review and merge without any consideration of provenance.
A problem could be that I may receive too many PRs to review (I think it happens to Linux). And the consequence of that may be that opening a PR to big open source projects may have to become less accessible eventually.
LLMs are making code cheaper to produce, which in turn means people are running more code. There’s more code that needs to be audited for trust than before.
And so now we have a new twist on an old problem, and I think it’s going to get worse before it gets better.
I am not sure. I was already selective before LLMs. I never ran random code from the Internet, and for those who did I think it was a mistake, already before LLMs.
There was already more code than I was able to review before LLMs. Because more code is being produced doesn't mean that I must run more code, I don't see that. I will keep running code that I can reasonably trust for the task. LLMs just add candidates or help making the better projects even better. But we will (as we should) keep auditing code, I'm sure of that.
Sure, yeah. But "vibe-coded and reviewed by Linus Torvalds" is probably better than "manually-written by a random person on the Internet".
Sometimes the provenance itself is enough to trust it, sometimes the fact that people I trust audited it is enough to trust it, and sometimes I audit it myself. Or I run it in a safe environment, sometimes that's fine too.
My point is that because it was vibe-coded does not make it more dangerous than random code found on the Internet.
> So you trusted 22-year-old coffee junkies copying and pasting from stack overflow 10 years ago
Absolutely yes... The difference between those "22 year old coffee junkies" and some dude prompting an LLM is that the 22 year olds from 10 years ago still had to actually use their brains. They thought of the problem, came up with possible solutions, architecture, software stack, implementation etc... Some of this undoubtedly was copy/paste from stack overflow, but in that process: googled/researched things, read results from google (blog posts, stack overflow posts, maybe even books). And in that process they actually learned about software development and mastered the craft. That isn't a thing with vibe coding, LLM's don't "care" about the project/software they build. Most vibe coders don't even care.
I hate that I have to say this but inevitably people get mad if you don't: I'm not anti ai and LLM's are obviously useful in 2026. But I definitely have way more trust in software made the "old" way, by people who actually gave a shit, compared to software "written by" vibe coders.
That was not my experience pre LLM's working with other software devs. I acknowledge that not everyone that writes software cares, but the majority of people I worked with pre-LLM did actually care that the software they wrote was bug free and well written before making a PR. With LLM's people seem to just get claude to vomit up whatever, give a quick review (if that) and press merge. Not sure if using LLM's made people care less, gave people an excuse to care less, or actually just don't care and were faking it before (or some combination of the above).
You're still talking about Slack here? Or some other large tech companies? It's rare that 22 year old devs are leading anything at orgs that size. The reason their quality is higher is because the business enforces quality controls, layers of technical experience, etc.
> that it's open source makes it more trustworthy not less.
You aren't addressing the point the person you responded to made - people will lose trust because of _quality_, not because the code is available to you on Github. If 90% of open source becomes buggy, single-use software with massive security gaps, it makes sense people would stop trusting those projects.
Now if only there was one for Razer.