Can someone there please just click the rollback button now and we can all forget this ever happened. I don't think that new site can be saved. The old site was fine. Just leave it like it was. I bought a bundle as recently as last month. Three bundles I think.
If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.
I don't know about illegalness, I pressed "Get your games" button accidentally and it immediately deducted 12,99€ from my Paypal account without confirmation. What the hell.
If they don't have any presence in and don't actively target your region, your local laws and regulations might not be the ones that govern the transaction, though. Not sure if Humble Bundle has crossed that threshold yet for most of their non-US markets.
I recently wanted to download a game I bought a long time ago through them (Machinarium, new macOS builds). Unfortunately the file on their CDN is corrupted. Their reply, after a week's worth of back and forth: sucks for you, it was sold too long ago so we won't bother fixing the issue.
As if anyone holds management accountable either. Big companies are full of VPs and Directors who make a mess and transfer orgs just before it comes back to bite them.
> The only party truly above accountability is the shareholder (a questionable decision itself)
This is decidedly not a "questionable" decision. I really, really shouldn't be held accountable for the conduct of any company in my ETF portfolio, as I have zero influence on their operations and zero insight into them (beyond what any member of the public has).
It's not really an apples-to-apples: you can ask an "AI" to build software to do a particular thing, and it will happily oblige and spend some of your money on it and produce something that actually runs.
You cannot just turn the saw on (if electric), point it at some wood and expect anything resembling furniture.
None of the issues raised in the post/article here even require any particular knowledge of how to build software. Anybody with a basic attention to detail would have noticed them. It's just somebody who simply DGAF shipping to live.
Wow, that's an impressive downgrade. Not only is the site uglier (gradients, gradients everywhere!), but I could log in without needing my 2FA at all. Shame too, since I found the old Humble site pretty charming.
The article doesn’t seem to provide any direct proof the new site was vibecoded? I mean, probably it was, but people were writing insecure software long before AI came along.
Without evidence, accusations like this are, ironically, just vibes-based.
What other reason would there be for a complete rewrite without any sort of security? They had a fully functional and secure backend, why would it require replacing just to redesign the site?
I expect marketing types are freaking out even more about the jobpocalypse than devs. While it takes some skill to determine whether resultant code is working, marketing goes by vibes all the way up the chain.
This perspective on vibe coding is both funny and contradictory. The core issue with vibe coding is that people ship things they don’t understand. To flip it around and blame it on the humans involved only after something goes wrong as if the issue is them vibe-coding “wrong” is foolish. The issue is the vibe coding.
Vibe coding is just a really big hammer, what you do with it and what you do with results is still up to humans. Even if this was result of it, fuckup is ultimately fully in hands of somebody responsible (for product, website, clients etc).
If not, company is not viable and will crash badly soon. Market forces and all that.
If I had a dollar for every RoR coder who didn't understand the internals of the interpreter I would still not be richer than Musk because there are not that many coders.
No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.
git pull git@github.com:allofit/allthethings.git engineering patterns is what created this mess to begin with
For the vast majority of these issues, certainly including those mentioned here, simply testing before going live would make them beyond clear. So it's simply a bad developer likely working under bad management and, shockingly enough, producing a bad outcome.
LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart" cousin and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.
So as I understand it, vibecoding means (meant?) that you don't look at the code it produces, you case only about the end results, e.g. website through a browser.
But in this case, they seem to have skipped that as well.
Because it allows you to produce so much code that it's not viable to carefully review each line/module, and get the benefits of the fast output.
Writing code yourself forces your brain to start creating pathways in your brain and you can verify the correctness of those pathways in your mind (e.g. am I actually doing this right, if I have seen such API would I be happy to use it,...)
Not saying we should write code manually, just showing the differences.
And even if you don't carefully review each line of code (or if you do), it helps a lot if you understand the basic principles of what you're trying to build. In this case, the vibe coder clearly had no idea about account security standards.
Programmers don't just write code. They also understand why they're writing the code and what it's supposed to do.
Because if a human was to program it, they might have stopped for a second and thought "Is this really a good idea?" whereas the LLM just goes "You're absolutely right! Here's some updates to the security code:"
I don't think it does, I doubt SOTA models are going to sign off on this.
On the other hand, people incompetent enough to ship this couldn't have produced a working website if they had to handwrite the code, so in that sense LLMs are at fault.
Was going to say the same. In fact we're seeing a huge wave of hacks caused by old human coded systems getting owned by "vibe" attackers.
Vibe coding is such an overused term now. Stats say what, 80% of programmers use AI to generate code? 90%? So everything is vibe coded. If you do well, no, it's still engineering. Someone makes a mistake? Cuts a corner somewhere? Vibe coded.
how many forced "tokenmaxxing" initatives do I need to bring up before we stop blaming developers for this reckless adoption of AI? These decisions come from the top, often from people who do not understand the software.
I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.
I doubt you have to fight anything to get there.
If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.
I wondered why I did not get email code from them for login. Then it arrive one hour later... Seems like pretty big oversight...
Is this actually illegal in a jurisdiction or against ToS of payment providers and they can get permanently banned from using card payments?
This last month has set my expectation that next month + next month is too many CVE's and I'm plugging the dam hole with my finger.
It was pretty frustrating not being able to download the things I'd paid for.
This is decidedly not a "questionable" decision. I really, really shouldn't be held accountable for the conduct of any company in my ETF portfolio, as I have zero influence on their operations and zero insight into them (beyond what any member of the public has).
You want to do a crime, subtly hint your AI about it.
AI doesn't produce bad software, people do.
It's up to the people involved in the process, to gatekeep AI to not *ship* bad software.
You cannot just turn the saw on (if electric), point it at some wood and expect anything resembling furniture.
AI makes producing bad software easier.
Without evidence, accusations like this are, ironically, just vibes-based.
Maybe they should finally change name to Edgy Bundle.
I removed the automatic payment process from paypal so at least that's safe, I'd recommend others to do the same at this point.
Cannot wait for some insider to tell us the story of how this came to be
Let me do 2fa when i have to pay not to just login to services i care very little.
And yes blizzard my wow account is not worth anything either.
i thought i'd be hearing about downsides?.. elaborate plz
It's always up to the skill of the human.
If not, company is not viable and will crash badly soon. Market forces and all that.
No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.
git pull git@github.com:allofit/allthethings.git engineering patterns is what created this mess to begin with
LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart" cousin and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.
But in this case, they seem to have skipped that as well.
Because it allows you to produce so much code that it's not viable to carefully review each line/module, and get the benefits of the fast output.
Writing code yourself forces your brain to start creating pathways in your brain and you can verify the correctness of those pathways in your mind (e.g. am I actually doing this right, if I have seen such API would I be happy to use it,...)
Not saying we should write code manually, just showing the differences.
Programmers don't just write code. They also understand why they're writing the code and what it's supposed to do.
Or more possibly the person incompetent one.
On the other hand, people incompetent enough to ship this couldn't have produced a working website if they had to handwrite the code, so in that sense LLMs are at fault.
Vibe coding is such an overused term now. Stats say what, 80% of programmers use AI to generate code? 90%? So everything is vibe coded. If you do well, no, it's still engineering. Someone makes a mistake? Cuts a corner somewhere? Vibe coded.
I am extremely skeptical that those numbers are even close to accurate.
Given the sentiment that software is getting worse, buggier, and overall less stable, that isn't a comforting statement.