Hacker News

Favorites Setup
Comment by birdsongs | original | Lovable apps expose passport details and more than 200K private messages
[−]birdsongs · 2026-11-14 Sat 18:11 UTC · link
I can't state my disdain enough for the rabid, careless advancement of AI, and all the bros that keep telling me to catch up or fall behind, while they are actively causing harm to the hundreds of thousands, or millions of users they have, without care or consideration.

Nearly two decades of experience learning how to build safe, performant software, to be replaced by this shit.

We don't care about people, our customers anymore. We actively harm them for profit. This is such a garbage industry now.

[−]fph · 2026-11-14 Sat 18:15 UTC · link
It's surprising how different the standards are between software engineering and all other kinds of engineering, for instance civil or mechanic.

The old joke was "If builders built buildings the way programmers wrote programs, then the first woodpecker that came along would destroy civilization", but in the AI era it feels like a butterfly would be enough.

[−]anonym29 · 2026-11-14 Sat 18:35 UTC · link
Counterpoint: if programmers wrote programs the way structural engineers designed buildings, ecommerce apps would take half a decade to build and the software industry would have just gotten around to inventing Windows Vista and jQuery in the last year or so.
[−]swatcoder · 2026-11-14 Sat 18:42 UTC · link
If you're saying e-commerce would simply be consistent and secure product catalogs with fewer promotional and tracking dark patterns, web scripting would rely on a and extensible and functional library for manipulating markup documents, and a stable OS kernel with few dark patterns and no cloud accounts, many of us would be sold in a heartbeat.

I don't think you're making the counterpoint you mean to be.

[−]anonym29 · 2026-11-14 Sat 19:33 UTC · link
Don't be naïve - the industry wouldn't be any less laden with surveillance crapitalism; the presence of that isn't a product of the pace of development, it is a product of the nature of consumers to eagerly suffer limitless abuse so long as the product "just werks", looks/feels polished, and doesn't require any kind of learning or discomfort.

Freedom from everything you enumerated already exists for anyone who cares enough to pursue it - robust ad and script blockers, operating systems with no coercion or user hostility, simple and stable scripting languages. They're not as polished as the products of manipulative and extractive abusers like Microsoft, Google, Apple, Discord, et al., and accordingly, users shun them, for the reason I explained above.

[−]birdsongs · 2026-11-14 Sat 20:00 UTC · link
> it is a product of the nature of consumers to eagerly suffer limitless abuse

Ah, there's the victim blaming.

> Freedom from everything you enumerated already exists for anyone who cares enough to pursue it

Do you have any idea how daily life is for non-technical people? It isn't reasonable in our society to expect everyone to switch to FOSS, and blaming 60 year olds for getting their identity stolen because they weren't using a Linux phone or rolling their own self hosted matrix chat server is such a cruel and unbelievably out of touch take.

[−]anonym29 · 2026-11-14 Sat 20:17 UTC · link
Hey, if the option is on the table for states to fight back, up and including enacting the corporate death penalty (forced dissolution) against Microsoft, Alphabet, Meta, Apple, etc, I'm all for that.

That would never happen though, the victims would plea and fight too vigorously in defense of their own abusers.

Who should be blamed for the actions of corporations ultimately subject to the society-scale approval of their consumers? No amount of misbehavior, malice, negligence, or abuse from the company can alienate the modal user of their products, they've thoroughly demonstrated this too many times to count.

It's not the doddering elderly folks I blame the most, it's everyone younger than them, the folks who grew up with the technology, aware of every abuse by these companies, who refuse to change their behavior. The ones who know better. The ones who can explain to you in great detail all about the surveillance, the dark patterns, the emotional manipulation, the extractive commercial angle, and who all refuse to adjust their behavior anyway. It's a choice, and it's one they make on a continual basis.

And to answer your question, no, I don't have much of an idea how daily life is for non-technical people besides them voluntarily suffering abuse like theft of their time (advertisements), or voluntarily paying a bribe to avoid the abuse, for no real reason other than that they don't care enough about the abuse or the bribe to spend 5 minutes learning how avoid both for free for the rest of their life.

[−]birdsongs · 2026-11-14 Sat 20:37 UTC · link
> And to answer your question, no, I don't have much of an idea how daily life is for non-technical people

This is very clear. You're incredibly disconnected from how most people in society operate, their motives, and capacity.

And your malice and contempt is entirely misplaced.

[−]anonym29 · 2026-11-14 Sat 20:46 UTC · link
You seem confused.

malice /măl′ĭs/ noun

1. A desire to harm others or to see others suffer; extreme ill will or spite.

2. The intent to commit an unlawful act without justification or excuse.

3. An improper motive for an action, such as desire to cause injury to another.

None of the above apply to me. I don't want to harm or injure anyone, and I don't want anyone to suffer. Consumers choose suffering and choose to voluntarily accept harm and injury, and I wish they wouldn't.

But you can't force people to not harm themselves, it's something they have to choose for themselves. Anyone who's ever lived with or loved an alcoholic or drug addict understands this. The contempt isn't for the person, it's for the theft of the person's faculties. The response to the person being unwilling to change is frustration with their choices, not contempt for the human being.

[−]birdsongs · 2026-11-14 Sat 18:45 UTC · link
Maybe that's okay.
[−]dawnerd · 2026-11-14 Sat 18:50 UTC · link
Hmmm but that software would also last a century so… your point? Moving fast and building unstable software isn’t really that great.
[−]andrew_lettuce · 2026-11-14 Sat 18:17 UTC · link
I am interviewing with a small company that has adopted agentic development in a big way and is looking for a vp of engineering to guide things. I tried to present a balanced view of excitement for the possibilities built on first solving governance, guardrails and mitigating the lethal trifecta. Senior executives are not interested and my position likely disqualified me, even after I talked about needing to speak to your client data governance teams and CISOs. Crickets. They actually said we're looking for someone who's a big AI booster. Bullet dodged.
[−]barrenko · 2026-11-14 Sat 18:24 UTC · link
When the Republic gains in strength, the Jedi go hiding in the desert.
[−]gedy · 2026-11-14 Sat 18:51 UTC · link
They sound like a team looking to get funding or sell out and need the AI sauce to sweeten the deal, not deal with messy real business needs.
[−]jacquesm · 2026-11-14 Sat 19:53 UTC · link
A lot of CTOs should be looking into D&O insurance.
[−]Rendello · 2026-11-14 Sat 18:22 UTC · link
These past few years, it feels as though the brake pedal has been replaced with another gas pedal.
[−]TZubiri · 2026-11-14 Sat 22:46 UTC · link
The way out of the hole is to keep digging. If your project with a 12.5B budget fucks up, maybe you need to go out and ask for a 50B budget to replace the old legacy decrepit systems with something more modern hip and AI.
[−]tortasaur · 2026-11-14 Sat 18:25 UTC · link
The idea that companies invested in "safe, performant software" before AI is laughable. Tech companies have never cared about the customers beyond their effect on KPIs.
[−]uvdn7 · 2026-11-14 Sat 18:35 UTC · link
But people care. A self respecting engineer cares.
[−]hk__2 · 2026-11-14 Sat 18:40 UTC · link
Self respecting engineers care also in the age of AI.
[−]birdsongs · 2026-11-14 Sat 18:44 UTC · link
Exactly. I cared, and the amazing engineers that taught me cared. We didn't have KPIs in 2008, we had code reviews and mean senior engineers (that were secretly kind) that would tear your code apart and send you back until you got it right.

And we were allowed to? I raised so many tickets over time that had no real business impact beyond "this is a security risk" and nearly all of them I was allowed to adress.

Maybe that makes me some kind of tech-boomer, like people responding to me are implying, but I don't really give a shit.

[−]tortasaur · 2026-11-14 Sat 18:50 UTC · link
Sure, but the parent said "this is such a garbage industry now", implying it was not this way before LLMs. The individuals who care about quality can still pursue quality. In fact, they are better equipped to create quality software than ever. It's a matter of spending time and attention.

The underlying problem is that quality isn't profitable. It goes beyond tech. The companies that cared about quality had their lunch eaten by the companies that chased razor-thin margins and produced disposable junk. I'm not sure what it is about AI that makes everyone forget what the world was like five years ago.

[−]birdsongs · 2026-11-14 Sat 19:00 UTC · link
While better equipped for security with frontier models (and I agree with that) I don't know any engineers in my circle that have the time to utilise it. Half of them are laid off, by the way.

The rest, including me, are supposed to take up the slack with ridiculous deadlines and pressure. I don't have time anymore. I have to trust that my prompt and testing descriptions and harness will take care of it. And I have no clue whether that's truly happening, because I have another ticket before I get time to review, or send some swarm of test/probe agents at it. And right now I don't trust it. (Literally look at the parent article?)

I did have that time and capacity in the past. Maybe you didn't. But the landscape is, to me, objectively different now.

[−]tortasaur · 2026-11-14 Sat 19:29 UTC · link
I fully agree that tech workers have never been less empowered. When I said that individuals have never been better equipped to pursue quality, I meant within projects they control. There will likely never be agency again at a large company.

We're on the same page about most of this, but my perspective differs in a couple of ways: - I have worked at companies that didn't prioritize quality and had unreasonable deadlines for most of my career. It's the default state of corporations with leverage over their workers. - This was getting worse before AI. Big tech was the anomaly in terms of pay, perks, benefits, etc, and they were already jointly deciding not to do that anymore around the time of Musk's Twitter layoffs. The main reason they had offered such a compelling environment was to prevent talented people from being hired by their competition, in which case they were perfectly happy to let them "play around" and focus on quality.

I find it frustrating when people imply that employment was an idyllic wonderland before AI ruined everything. AI is another step, potentially the final step, in boiling the middle class. It didn't invent poor working conditions, it brought tech workers down closer to everyone else's level.

The best move right now is to move to a small startup or start something on your own. I fully understand that this is easier said than done, when you have bills to pay and deadlines keep you too exhausted to escape. To some extent, that's probably part of why the deadlines exist.

[−]JDups · 2026-11-14 Sat 19:06 UTC · link
Companies never cared, and most engineers didn't care much either, at least not directly. But a lot still cared to cover their ass and try to do things correctly the first time to reduce future work and headaches. Now that it's all just a few prompts away "Who cares? Ship it now, if it's broken we'll just have Claude fix it later."
[−]jeppester · 2026-11-14 Sat 19:29 UTC · link
In the past the price of caring was that you were slightly slower, but it would be obvious that the delivered quality was better.

Now you'll be at least 50% slower and likely fired if you care, because caring means understanding the code.

[−]anonym29 · 2026-11-14 Sat 18:29 UTC · link
>I can't state my disdain enough for the rabid, careless advancement of AI, and all the bros that keep telling me to catch up or fall behind, while they are actively causing harm to the hundreds of thousands, or millions of users they have, without care or consideration.

Have you ever considered that the people who are pro-AI are not a monolith, and that it can be simultaneously true that you should absolutely be learning how to effectively and safely use LLMs in engineering workflows, while it is also true that there are people who are using them very unsafely?

Beig opposed to learning how to use AI correctly because some people use it recklessly is like being opposed to learning AWS in 2015 because some people left sensitive data in open S3 buckets.

Do not confuse negligent misuse of the tool for the value proposition of the tool itself.

[−]birdsongs · 2026-11-14 Sat 18:40 UTC · link
Re-read my post before quoting it and getting defensive. I'm not anti-AI, I use Claude daily, partly because that's all the industry is now, partly because it can be an amazing tool.

I'm furious about slop-shovelling profit-driven development that actively causes harm to people. And the lack of care for, or outright disdain of customers, specifically fuelled by a misuse of AI, and the people telling me to get used to this, the people telling me to stop reading my own PRs, the people telling me this is just how it is now. When we all know that doesn't have to be true.

[−]beardbandit · 2026-11-14 Sat 20:36 UTC · link
Just bide your time until there are some absolutely catastrophic breaches like what is happening in Japan right now on a daily basis, and then people and legislators will slowly start demanding accountability.

I just don't see any grassroots movement advocating for responsible software development winning out with a demographic that can't even unionize for their own self benefit.

There is no part of me that believes people will fundamentally do the right thing without an incentive to do so (money) or punishment (fines, jail). There won't be action until there is so much suffering that governments can no longer ignore it.

[−]birdsongs · 2026-11-14 Sat 20:43 UTC · link
Yeah, makes sense.

Only counterpoint is we have very well functioning unions in Norway for engineers.

But yeah, I don't see grassroots movements winning anywhere. Not even here.

https://en.wikipedia.org/wiki/Norwegian_Society_of_Engineers...

https://en.wikipedia.org/wiki/Tekna_(Norway)

[−]Betelbuddy · 2026-11-14 Sat 18:29 UTC · link
You won’t lose your job to AI...but to someone using AI...and they will lose everything...to someone who knows cybersecurity.
[−]kpil · 2026-11-14 Sat 18:35 UTC · link
I think this more or less sums it up.

Interesting times.

Regarding losing jobs - what I hope will keep me employed: opiniated creativity and common sense. Not sure if I'm right.

[−]r_lee · 2026-11-14 Sat 18:40 UTC · link
if those are the reasons... I'd feel very uneasy
[−]TZubiri · 2026-11-14 Sat 22:44 UTC · link
Are companies hiring devs that don't vibecode yet? Or do I have to wait a couple more months?
[−]gandhiandy69 · 2026-11-14 Sat 19:10 UTC · link
Well the customer also shouldn’t trust anyone, especially not with handling their private data.
[−]rwmj · 2026-11-14 Sat 19:26 UTC · link
How can the customer know?
[−]birdsongs · 2026-11-14 Sat 19:28 UTC · link
Bad take. That's impossible in our society. I wouldn't get updates from my child's kindergarten. I wouldn't be able to use public transit. I can't access my bank. I can't communicate with my family, friends, spouse, work network.

We don't have an option. Which is why a lack of care for users is abhorrent.

[−]pluralmonad · 2026-11-14 Sat 21:08 UTC · link
Keeping _more_ of your data private is not impossible. It won't necessarily be the most comfortable thing, as tradeoffs will be made, but you can claw back quite a bit of privacy if that is important to you.
[−]birdsongs · 2026-11-14 Sat 22:25 UTC · link
Of course, but that's not what the person I was responding to said. They blamed people for trusting services (many of which) they don't have an option to opt out of.

And this whole thread is just proving my point by blaming people and customers for the mistakes of technology companies.

[−]gandhiandy69 · 2026-11-15 Sun 00:26 UTC · link
Lovable is not the same as using your bank account or your health insurance. You create a website and put it on the internet and maybe even host sensitive data and information. This should only be done if you know what you are doing and if that’s not the case and you haven’t read the terms of service it’s mostly your fault that you trust any company on the web especially those coked out VC backed startups.

If you invest more money you’ll get a good website and your data will be taken good care of by human professionals. It’s simple as that.

[−]schrodinger · 2026-11-15 Sun 01:49 UTC · link
If there are passports in these dumps, Lovable is obviously being used for sites that _are_ as serious as your bank account or health insurance. That's exactly the problem birdsong's bringing up in this thread.

If it were only used for prototypes and blogs, who cares. But it's being used by _real businesses_ that don't give a shit about security.

[−]gandhiandy69 · 2026-11-15 Sun 08:25 UTC · link
I specifically chose banks and health insurances specifically because you can not get around using their websites and online services in your daily life.

For all other services: is it really necessary to give them your passport info on the internet ?

[−]jacquesm · 2026-11-15 Sun 00:07 UTC · link
Customers are absolutely without blame here. They have no way of knowing which parties are and which parties are not running a tight ship. Every e-commerce store already handles your private data, how will you ensure that across all of those each and every one is going to be careful with your data? I'm not the most active online shopper in our household by a long shot and yet I've had two reported breaches in the last year alone, one a specialty welding store, the other a store for home automation products. Now, both of these are 'niche' and probably don't have a security budget to match their responsibilities. Even so I would have expected some basic precautions and that trust seems to have been misplaced. I expect each and every website where I've ever filled out a form to be hacked sooner or later. Nobody seems to do anything about blast radius reduction, which would be trivial. But marketing wants to keep the last 20 years of purchases live so they can send out some more spam, when what they really should do is move those records to cold storage for tax compliance only the moment the package is delivered.
[−]sky2224 · 2026-11-14 Sat 19:16 UTC · link
My perspective is to figure out how to shape the way we use AI to show the right way to use it. This comes from a place of caring about the software and its users.

I strongly believe that when used properly, AI can remove a lot of overhead that comes with writing the code (from both a critical thinking standpoint and physically it actually takes a lot more time than people realize to manually type code). You can focus on the design and have your team much more integrated in the designs and specifications of things without it being a slog to document the damn thing.

If I can go off and write up a draft and get feedback from my team in a day instead of in a week, I think that's fine. We can collectively walk through and use everyone's domain knowledge to correct details. Once everyone is onboard with the spec, I can feed that into a model to progressively do small changes rapidly but in such a way that's still manageable and reviewable for myself and the rest of my team.

If I go off and merge 45000 lines of code into main: fucking fire me and my whole team that approved that.

As with all new things that have extreme views on either side (AI is complete shit versus AI is the second coming of Christ in this case), there's generally a middle ground in between that we can collectively correct toward.

[−]schrodinger · 2026-11-15 Sun 01:53 UTC · link
Anthropic brags¹ that they merge 30k PRs / day and don't review code anymore — just the title ("intent") of the PR!

So the very company you're (possibly) using to "remove a lot of the overhead" is doing what you think is fireable! That's the irony!

¹https://www.anthropic.com/research/redesigning-source-contro...

[−]sky2224 · 2026-11-15 Sun 08:35 UTC · link
Oh I agree! However, while they do brag about 30,000 PRs per day, they don't state what products these apply to.

I suspect for their public facing products (i.e., the claude ecosystem, which is like four products), the review process is much more rigorous, and the PRs merged in per day is likely much much lower.

A few things about their post: they're doing trunk development on a mono-repo. With their tool, Antique, instead of having branches, they just merge in stacks of commits, which they call "Change Requests". I have to wonder if their engineers have the models running and don't even realize the models are putting up a change request and if that's contributing to the high number.

Additionally, I would guess that a lot of the code merged into that mono repo is for experimental projects or other internal tooling that is in prototyping stage.

[−]schrodinger · 2026-11-15 Sun 01:47 UTC · link
Amen. It's kind of ironic that the same tools that are better at finding vulnerabilities than humans (e.g. https://www.sshhole.com) are creating a proliferation of shit-code and shit-sites full of vulnerabilities faster than anyone can keep up with.