But do we still trust the open source software that is created now everything is vibe coded?
Recently there was a thread about Chatto [1], a Slack replacement completely vibe coded by one person. It works and looks nice. But looking at the code, I wouldn’t trust any of my personal information to it. It’s just tousands of lines of skills and vague instructions. It seems that trust in OSS is eroding and big SaaS might win here because they have the reputation.
Now if only there was one for Razer.
Running code is dangerous. I don't really see how its provenance matters: you should not run code you don't trust, period.
This reduces to "you should not use a computer, period." No-one can audit all the code they run daily.
Not sure if you're being manipulative on purpose or if you genuinely did not understand my point. I was talking about "trust", which is a whole concept in itself.
Code can make your computer do stuff. If you run code in an environment where it has the possibility to do harm, then it is a possibility, and therefore a risk. Whether or not you accept that risk depends on the situation, but it is important to realise that the risk exists.
> I don't really see how its provenance matters
The fact that the code was vibe coded does not change the capabilities it has. If you run random code written by a human with root access, the code can do what root can do. If you run random vibe-coded code with root access, the code can do what root can do.
When you run code, what the code is allowed to do in the environment it is running is independent from who or what wrote that code.
> you should not run code you don't trust, period.
Trust does not mean that you have to review all the source code everyday, yourself. Trust means that you accept the risk given the provenance.
When you drive you car, you trust that it won't explode. You don't review the whole car assembly every day. When you cross a bridge, you trust that it won't collapse. You don't check the whole structure everytime yourself.
When you run your laptop, you trust that the battery won't catch fire. You trust that your OS isn't a malware.
In your life, you trust many many things. Many times you don't have a choice, many times it's institutional trust ("I live in a country where bridges don't collapse", for instance).
Now when you run code you find on the internet, I'm sure you apply that. Say it comes from Google: you probably trust it (after all, if you don't trust Google you're pretty much screwed).
Now if a random username on Reddit tells you to execute some code, do you happily do it? I don't think so. At least you shouldn't unless you understand what it does.
What's the difference between random code you find on Reddit and vibe-coded code? I don't see one. I don't base my trust on the fact that it was written with AI.
The fact that it comes from AI means "it is not an author that I trust, but it doesn't mean that the code is malware". I just need to find another way to trust it (maybe someone else audits it, maybe I do, maybe I run it in an environment where it doesn't matter, etc).
Before AI just having a good README and superficially looking good code (we're not going to do a deep review of it) was a gauge of quality that at the very least the person that wrote it knows what it's doing.
How do you do it now? Maybe the AI was expertly guided, but maybe it was vibe-coded by someone who hasn't even heard of basic security principles and your whole data is sent in plain-text somewhere. It doesn't have to be nefarious, it could be a debug feature that was never removed, or maybe the user never asked the llm to "make it prod safe". And there's no way to know unless you read the whole thing, because superficially the README and the code will look as good as any other llm project.
That's problem number one, before you could quickly see if it's made by someone who knows what it's doing, and thus that you can trust. With vibe-coded software not so much.
The second issue is not inherent to vibe-coded software but it's caused by it: it's a sea of garbage. It's very possible that the absolute amount of good software has increased, but it's become harder to find it.
> It's very possible that the absolute amount of good software has increased, but it's become harder to find it.
It was like that long before AI. Most software written by humans is very bad, and it was accelerating before AI. And there was too much software to review everything long before AI as well.
If anything, I find that AI writes better code than the average human-written code. Of course it makes it harder to judge the contributor (before I could clearly see that they were not good coders, now I can't). But as a maintainer, I was reviewing the code before, and I am still reviewing it now. Some people will send unreadable AI-generated PRs that I won't review, some people will send readable PRs that I will review and merge without any consideration of provenance.
A problem could be that I may receive too many PRs to review (I think it happens to Linux). And the consequence of that may be that opening a PR to big open source projects may have to become less accessible eventually.
But that is orthogonal to the problem of trust.
Sometimes the provenance itself is enough to trust it, sometimes the fact that people I trust audited it is enough to trust it, and sometimes I audit it myself. Or I run it in a safe environment, sometimes that's fine too.
My point is that because it was vibe-coded does not make it more dangerous than random code found on the Internet.
And so now we have a new twist on an old problem, and I think it’s going to get worse before it gets better.
There was already more code than I was able to review before LLMs. Because more code is being produced doesn't mean that I must run more code, I don't see that. I will keep running code that I can reasonably trust for the task. LLMs just add candidates or help making the better projects even better. But we will (as we should) keep auditing code, I'm sure of that.
The recent sprawl of viruses, worms, and malware should give everyone pause when installing fresh software.
Oh dear.
If you really wanna worry about all of these things you better not use any open source from now on. Or even private software as well, because you can't even audit and know what "vibe code" touched.
I have no problem with vibe coded software.
It is getting worse, faster. That's objectively true.
Absolutely yes... The difference between those "22 year old coffee junkies" and some dude prompting an LLM is that the 22 year olds from 10 years ago still had to actually use their brains. They thought of the problem, came up with possible solutions, architecture, software stack, implementation etc... Some of this undoubtedly was copy/paste from stack overflow, but in that process: googled/researched things, read results from google (blog posts, stack overflow posts, maybe even books). And in that process they actually learned about software development and mastered the craft. That isn't a thing with vibe coding, LLM's don't "care" about the project/software they build. Most vibe coders don't even care.
I hate that I have to say this but inevitably people get mad if you don't: I'm not anti ai and LLM's are obviously useful in 2026. But I definitely have way more trust in software made the "old" way, by people who actually gave a shit, compared to software "written by" vibe coders.
The vast majority of software engineers, pre and post LLMs, don’t care.
That’s different from caring about the software you build.
> that it's open source makes it more trustworthy not less.
You aren't addressing the point the person you responded to made - people will lose trust because of _quality_, not because the code is available to you on Github. If 90% of open source becomes buggy, single-use software with massive security gaps, it makes sense people would stop trusting those projects.
Absolutely. There is a limit to how much code can be shared on stack overflow and, in the pre-AI days, code snippets had to be understood well enough to integrate into a larger hand crafted work.
Furthermore, stack overflow code is shared by consenting users and is licensed per the terms of service, unlike AI generated code which is trained on non-consenting users and is both ethically and legally dubious.
Whether it's vibe-coded or not doesn't change that. If it is vibe-coded and unreadable, how is it different from manually-written and unreadable? If it is vibe-coded and readable, how is it different from manually-written and readable?
Judge the code by its quality, not by its provenance.
That being said: I wouldn't really trust SaaS to not be vibe-coded either. The only difference there is that SaaS likely has a financial incentive to stay maintainable so you could argue that helps.
and it seems... fine? SO MANY comments, but that seems pretty standard for LLM code these days.
Be careful of prompt injection. Some people think nothing of adding harmful instructions to their repositories. Sol and Opus seem to be smart enough not to fall for it, but I don't know about other models.
The provenance of the code matters insofar as how much you should initially trust it, but the fact that it's open source means it's still verifiable. The increase in productivity that AI has unlocked means there is now much more output to verify.
Big SAAS is doing the same thing at scale. One would hope they put a bit more diligence in it but we know that's not the case.
If I think tool/software would be useful I throw GLM 5.2 (now 5.3) at it and ask to do an audit ;-)
Yes because everyone trusts what SalesForce is doing with their data..
Do you trust all OSS repos coded before 2024? AI-generated code is no different than code written by a human with different levels of seniority, different levels of focus, or different levels of discipline. A human is perfectly capable of generating spaghetti code too.
I hate Options+ as much as the next guy - but don't have the time / technical knowledge to audit thoroughly enough to establish trust in this.
I'm nearing the replacement point on my current MX Master - so is there a better alternative to Logitech?
reputation of what? sucking your soul dry?
Or make a fork with only the minimim set of parts that your agent cherry picks.
I guess my question is, why would you trust it when it is not vibe coded?
My suggestion is, have an AI review the code for you.
Or don't. It's up to you. You're as free to walk away as you are to embrace what's been made here.
“Is math” and “Either works or not” is only true with formal specifications and formal verification, which dwarfs the cost of producing said software.
It also matters how it works.