It's incredible how little understanding the average person has about data, privacy, and security.
Allowing anyone to build and host a public app without a basic understanding of these things is like letting people fly a passenger plane without a license.
You’re right, only if the person building the application is using sound judgement, which goes against the premise.
You and I wouldn’t build applications naively that could lead to people dying. People who don’t understand what they’re building might.
People are vibe coding at your hospital. They’re vibe coding at your utility company. They’re vibe coding at your pharma lab. I’ve met these people. They’re smart. They have phds. I tell them about SSL.
[−]JumpCrisscross · 2026-11-14 Sat 19:39 UTC ·
link
Woman has an abusive ex and moves to a new address.
Keeps it private from him and is very careful who she shares it with.
Buys something online from a website she had no idea was built on Lovable (doesn't even know what that is, why would she?).
He finds her address, knock knock.
Unlikely? Yes, at the individual level. But the odds that just one customer out of all the folks using the 4,000 websites estimated by this researcher to leak private information is in a situation where their address becoming public puts them at risk? Probably pretty high...
It's easy to shrug these situations off, especially when you're not affected. But if you had all of the information needed to steal your identity — including your fucking *Passport,* you might understand the severity of the consequences a bit more viscerally. And FFS, who the hell is using Lovable to build a website that does something serious enough to warrant collecting Passport information?
Keep in mind these no-code sites are proliferating at the very same time that LLMs are becoming incredibly effective at finding vulnerabilities — even Postgres delayed their latest release to focus on a backlog of serious bugs uncovered by an LLM (Opus?). sshhole.com is another example of an egregious bug in ssh being uncovered after years in the wild by LLMs. It's really a perfect storm…
> Allowing anyone to build and host a public app without a basic understanding of these things is like letting people fly a passenger plane without a license
Is it now? How many hundreds of people have died as a result? How much infrastructure was destroyed?
I get the point you're trying to make, but computer security as a field has already a big problem with maximalist mindset, and it doesn't help in keeping systems of consequence actually secure and people safe from danger.
They already have — thank them for every fucking cookie banner. UGH! Whoever thought that was a good idea is a huge fucking moron — it just trains people to click "Yes, allow, whatever gets this things out of my way the fastest." It's almost as bad as Canadian Geese — don't get me started.
(That doesn't mean I don't appreciate/envy the GDPR, as a US citizen.)
Allowing anyone to design, install, and maintain the plumbing, heating, and electricity of your house without a basic understanding of these things is like...
I strongly disagree with the second part. Building public app should not require same level of skill as flying an airplane. Not even the same as getting a driver license. It had to be simple, secure and compliant.
The problem are product managers and engineers who build things like Lovable, that are not secure by design. Those products have no right to exist, but their alternatives could exist and let their users focus on what matters, instead of paying web development tax.
When the number of things you can possibly build is infinite and LLMs are not guaranteed to catch security issues you need some skill or you constrain what can be built to a subset. I.e. build a platform where users own their data and it is partitioned and the slop runs atop that. Similar to running the slop on an airgapped laptop.
The plane analogy would be selling tickets to passengers. Who then don't need a pilot license to get somewhere.
I’ve been mentioning it for years, but data, privacy, and security do not matter to most people, despite them saying so. Personally I operate assuming that my IDs, passport and etc. have already been leaked at some point. So, if someone says my PII has leaked once again, I’d just shrug and move on.
When Equifax thing happened, there was basically no repercussions. And that’s the only data breach I recall being in the news cycle for more than a week. Everything else has just been a blip since then. Also as there were no real repercussions other than some fines, companies took it as a signal that nobody cares (rightfully).
I've got a similar viewpoint. I'm always surprised when someone freaks out about their credit card info being leaked, for example. At least in the US, you're almost always guaranteed to get the money back ASAP for any unauthorized charges and a new credit card sent to you (overnight if you need it, for higher-end cards). So why are people so afraid of their credit cards being "stolen"?
Allowing anyone to build and host a public app without a basic understanding of these things is like letting people fly a passenger plane without a license.
You and I wouldn’t build applications naively that could lead to people dying. People who don’t understand what they’re building might.
People are vibe coding at your hospital. They’re vibe coding at your utility company. They’re vibe coding at your pharma lab. I’ve met these people. They’re smart. They have phds. I tell them about SSL.
And then they could do something else that might result in property damage. Not at all comparable to the danger of an unlicensed pilot.
Keeps it private from him and is very careful who she shares it with.
Buys something online from a website she had no idea was built on Lovable (doesn't even know what that is, why would she?).
He finds her address, knock knock.
Unlikely? Yes, at the individual level. But the odds that just one customer out of all the folks using the 4,000 websites estimated by this researcher to leak private information is in a situation where their address becoming public puts them at risk? Probably pretty high...
It's easy to shrug these situations off, especially when you're not affected. But if you had all of the information needed to steal your identity — including your fucking *Passport,* you might understand the severity of the consequences a bit more viscerally. And FFS, who the hell is using Lovable to build a website that does something serious enough to warrant collecting Passport information?
Keep in mind these no-code sites are proliferating at the very same time that LLMs are becoming incredibly effective at finding vulnerabilities — even Postgres delayed their latest release to focus on a backlog of serious bugs uncovered by an LLM (Opus?). sshhole.com is another example of an egregious bug in ssh being uncovered after years in the wild by LLMs. It's really a perfect storm…
Is it now? How many hundreds of people have died as a result? How much infrastructure was destroyed?
I get the point you're trying to make, but computer security as a field has already a big problem with maximalist mindset, and it doesn't help in keeping systems of consequence actually secure and people safe from danger.
(That doesn't mean I don't appreciate/envy the GDPR, as a US citizen.)
You can watch DIY channels on YouTube where homeowners explain their methods.
In particular, they are vibe-rehabbing entire homes.
The problem are product managers and engineers who build things like Lovable, that are not secure by design. Those products have no right to exist, but their alternatives could exist and let their users focus on what matters, instead of paying web development tax.
The plane analogy would be selling tickets to passengers. Who then don't need a pilot license to get somewhere.
When Equifax thing happened, there was basically no repercussions. And that’s the only data breach I recall being in the news cycle for more than a week. Everything else has just been a blip since then. Also as there were no real repercussions other than some fines, companies took it as a signal that nobody cares (rightfully).