Edit: I've just tried to log in and it's failed through both Google and email. Whatever they've done, they haven't tested it well.
The problem with vibe coding isn't the AI, it's how people use it. It's that people with no idea of what they're doing, now think they can do what used to require an expert.
To get what tfa is describing, you'd need to explicitly request a dumbed down system, use a really shitty LLM, or both.
Honestly I'd sooner believe this is the result of a highschooler than a LLM.
I've got no problem with people vibe coding a personal project or a prototype or something, but when you've got code in production, that a business depends on, you've got to be a massive idiot to blindly start rewriting it in this way.
Not sure why you couldn't take the "its easy with AI" path and actually refresh the current codebase.
This is hearsay mind you, I don't know how much of their old site is there...
If you ask it to rebuild a site that has x, y and z features, the AI will output an average outcome because it's doing broader implementations. Context and thinking only goes so far unless you have thousands upon thousands to burn in tokens.
AI Companies: "AI is now amazing at spotting insecure code"
Implication: If it can spot it, all the code it writes must therefore be secure
Build and maintain our website. Add features as needed. Rewrite everything as needed. Deploy automatically. Make it compatible. Make it fast, secure and bug free. Make it cyber. Make it cloud. Don't make mistakes.
It might have been some internal testing mechanism that's been corrupted. Or if they had an existing hole the AI probably convinced itself that was what was necessary.
That's one of the disadvantages of them hiding the "thinking" output they used to cycle through, sometimes you could spot that happening.
That's still dumber than I've come to expect from LLMs but as others have pointed out, I'm a developer who uses LLMs as a tool, not a manager using a LLM as a developer.
I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.
Do we blame the bulldozer if it bulldozes the wrong thing? We're just not used to bulldozing yet.
And yes, I also blame the people getting on that bulldozer, bulldozing like there's no tomorrow. But mainly I blame the first two groups.
The people who make the bulldozer don't market it as "intelligent."
AI has caused a generational set back on how stakeholders view the value of expertise knowledge, but the gun is still people, AI is just one of the bullets along with things like obsessive cost cutting.
My large orgs entire marketing strategy is now run by an MBA using Claude to generate 'idea and best practice docs'.
The process that lead us to not having a CMO or any other marketing leadership with domain knowledge? Consulting partnerships using MBAs.
The reason we're not changing any strategies even though we're burning money pper CPA? MBAs concerned seeking alignment and having the right narrative to change course.
Thr planned new course? More Claude.
The technology itself is not to blame, but maybe the marketing around it should be. AI coding tools are marketed as magic tools that can somehow spit out perfect solutions even if the input spec is garbage. Of course that is impossible, and no amount of technology can solve that problem unless every AI coding agent is equipped with guardrails that makes it stop if it gets the impression that its user is an idiot.
Thought experiment. A startup is at the end of their runway. Need to show income or go down. Businessmodel is to sell "one off" sales, and vast majority of their accounts buy once or twice (a year or ever).
What if they "accidentally" make it easier for hackers to take over those accounts. Accidentally, as part of a large overhaul or rewrite of their systems. Then, at least for a while, their accounts suddenly "buy" much more products per month or year.
Cynical, I know. But not unthinkable.
I doubt you have to fight anything to get there.
I wondered why I did not get email code from them for login. Then it arrive one hour later... Seems like pretty big oversight...
I've been involved in many "rewrites". Almost exclusively, the result is worse for users at release.
Especially with "big bang releases". Where a team is working behind the scenes for months or longer, attempting to rewrite the old system "bug for bug". Releasing and then finding out that some users would "hold the space bar to make the CPU heat up, and configuring emacs to interpret that as 'control'" (XKCD 1172). First, users don't see any improvements for all the time that the new system was being built. Secondly, they get all the new stuff bundled. So while they may even get value from the rewrite, it is bundled with the stuff that makes it worse. Three new features, one new bug. And all everyone sees is that new bug.
But even rewrites where parts are swapped out and released immediately, (strangler vine pattern!) are worse for the users. They do get value fast. And in small increments. They can give feedback early. But the (much longer) period in which the replacements are implemented, is almost always one of confusion, complexity, and "having to learn new things every week". We all know the systems where "change email" is a link that leads to a form on some other site, in an old design rather than part of the "edit account" page. Because the "account service" has been extracted, but the "notification service" replacement on the backlog still.
"rewrites" are almost always for the benefit of the business, the technical team, or other internal reasons. If "benefit to the users" is a part of it, it's almost always secondary: so that we can build and release and scale new features and cool stuff for users faster than with the old legacy spaghetti debt.
This seems to be mostly people who don't know what they are doing? I'd any model would default to requiring this since it's pretty much the default everywhere.
If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.
People are rebuilding working things from scratch with AI just because they can.
AI eroded the greenfield advantage of rewriting a project from scratch because a rewrite generally meant that the code went through the fingers of the new developer. With AI that advantage is gone so you are better off incrementally improving the old code base to minimize overall maintenance costs and reduce the needed headcount as a result of this work.
AI lowered the cost of rewriting which means that more shitty systems ship because the rewriters don't run out of money before the rewrite is canceled. But it doesn't the solve the underlying problem of the people in charge of rewriting not understanding what features in the old system were actually important and which had to go.
Is this actually illegal in a jurisdiction or against ToS of payment providers and they can get permanently banned from using card payments?
But it's true. I couldn't login no matter how I tried to do it. The thing is broken.
It showed me that they just don't care anymore.
But it still baffles me as to how an LLM could make it this worse, when they already had decent security measures. No top-of-the-line model should've done this. I guess it can only be concluded that they didn't even care to spend some money on SOTA models, even DeepSeek 4.1 Flash, instead turning to the cheaper but also much less capable models to save a few pennies.
With them killing the "classic" it doesn't really matter anymore. Better just to cancel.
> turns out to be an AI shop.
If you check Reddit, people had been already complaining about HB functionally and design 6 years ago.
My bet is they outsourced to get cheaper devs, who did a sloppy job, even if they were using AI.
Even if they outsourced to devs that used AI, they are asking for a lawsuit to remove core security safeguards, while rolling old subscription plans onto the new plan in the same rewrite/migration.
You have to click through multiple primary cancel buttons, but the final one cancels the cancellation.
Interestingly, they didn't seem to set up much dark pattern for the cancellation of it - I recorded the automatically reinstated payment in a private rant post, but not a dark pattern in cancellation. To this point I don't really care to conspiracy this into the theory that they knew users who were angry enough to cancel couldn't be stopped, and/or the law might be against a dark cancellation pattern, but no so much as to a pause.
https://www.pcgamer.com/gaming-industry/humble-games-layoffs...
In general I think it is obvious that logged-in users must need their password to change their email address, and forgot-password users must need access to their email address to change their password.
I would be a little surprised if any coding-focussed AI, frontier or otherwise, didn't offer that by default if not prompted, but I will have to test this now with the local models I use — has anyone else?
But for some reason not everyone agrees re: the first of these.
The server at www.humblebundle.com sent back an error: 431 Request Header Fields Too Large
Deleting cookies for the domain might solve it.
It was pretty frustrating not being able to download the things I'd paid for.
All staff laid off?!
Update: this is not relevant or related to Humble Bundle.
Since when are one click payments illegal? Amazon's one-click payment patent expired in 2017
AI doesn't produce bad software, people do.
It's up to the people involved in the process, to gatekeep AI to not *ship* bad software.
AI tools are complex systems that definitely can have agency, even though that is mostly human controlled. Bad controls = bad outcomes.
Yes, I totally agree that humans have the most control over them, but that doesn’t mean it’s completely off the hook.
If we really have to draw simplified real life comparisons, maybe a car or a gun would be more suitable “systems” that we can metaphorically compare AI to.
You cannot just turn the saw on (if electric), point it at some wood and expect anything resembling furniture.
In particular they offer their owner a high maintenance decaying shelf life, or an explosion.
Of the 2,476 explosions to date, two were used specifically to kill people, some of the others did kill people, although such things were supposedly unintentional.
They have not afforded a better way to make canals, mine in a controlled manner, or fart a starship to space .. although people have desired such affordances.
Always review the code an LLM creates.
(When I told Claude that this is very bad, its reply was “Good catch!”)
Without evidence, accusations like this are, ironically, just vibes-based.
Maybe they should finally change name to Edgy Bundle.
I removed the automatic payment process from paypal so at least that's safe, I'd recommend others to do the same at this point.
Cannot wait for some insider to tell us the story of how this came to be
> THEREFORE A COMPUTER MUST NEVER MAKE AN ARTISTIC DECISION
This is decidedly not a "questionable" decision. I really, really shouldn't be held accountable for the conduct of any company in my ETF portfolio, as I have zero influence on their operations and zero insight into them (beyond what any member of the public has).
As to insight: a shareholder having information beyond what the public has is called "insider trading", so that's not going to happen. But nothing is stopping you from pushing the board to release more information to the public. At the moment there's little reason to do so as companies being secretive provides a competitive advantage, which is in the shareholder's interest - but that equation would obviously change when that same secrecy exposes the shareholder to risks of unknown size, and when all companies are forced to be transparent it is no longer a competitive disadvantage.
What do you suppose those shares you bought are for? "I decided to launder my accountability through a third party" doesn't have quite the same ring to it.
You want to do a crime, subtly hint your AI about it.
Let me do 2fa when i have to pay not to just login to services i care very little.
And yes blizzard my wow account is not worth anything either.
You’d be surprised; a friend of mine had a battle.net account under one of his emails, because apparently his email was used to make a WoW account in college and was banned. He had never played wow before, contacted support, and they didn’t say what happened but revoked the ban
Plenty of other players would strongly disagree. Blizzard pushes so strongly for 2FA because the support costs associated with people complaining about their WoW accounts getting compromised and drained are massive. If every player were to just shrug and start over from scratch, Blizzard wouldn't have bothered with it.
IIRC it was only via email, which is a PITA. I don't want to switch to my email every time I login.
i thought i'd be hearing about downsides?.. elaborate plz
It's always up to the skill of the human.
If not, company is not viable and will crash badly soon. Market forces and all that.
LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart cousin" and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.
But in this case, they seem to have skipped that as well.
No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.
git pull git@github.com:allofit/allthethings.git engineering patterns is what created this mess to begin with
I've seen people build great software but fail to evolve it.
All the lessons from agile, clean code, TDD and testable architectures, CI/CD, DevOps are really about building software that can evolve, yet most of those get ignored from time to time due to cost (frequently called time) pressures.
GenAI stresses this loop even more, and no human can effectively deal with the level of output you need to fit in to continue effectively shipping. This can only mean more bugs rather than fewer bugs.
Yes, in a well executed project, LLM agents can bring immediate value and find and fix bugs: because the system has the good feedback loop built in. As soon as you lose that (over shorter time with LLMs than with humans), it starts getting exponentially worse.
And this is all even before you stop and think if you are even building the right thing.
Because it allows you to produce so much code that it's not viable to carefully review each line/module, and get the benefits of the fast output.
Writing code yourself forces your brain to start creating pathways in your brain and you can verify the correctness of those pathways in your mind (e.g. am I actually doing this right, if I have seen such API would I be happy to use it,...)
Not saying we should write code manually, just showing the differences.
Programmers don't just write code. They also understand why they're writing the code and what it's supposed to do.
Or more possibly the person incompetent one.
Whether that says more about me or about LLMs These Days, I’m not sure…
On the other hand, people incompetent enough to ship this couldn't have produced a working website if they had to handwrite the code, so in that sense LLMs are at fault.
Vibe coding is such an overused term now. Stats say what, 80% of programmers use AI to generate code? 90%? So everything is vibe coded. If you do well, no, it's still engineering. Someone makes a mistake? Cuts a corner somewhere? Vibe coded.
I am extremely skeptical that those numbers are even close to accurate.
Given the sentiment that software is getting worse, buggier, and overall less stable, that isn't a comforting statement.