I spent a good part of my career at Salesforce working on the platform security features.
When I see the vibe coding trend and move towards AI generated code, I can’t help but think we’re up for big trouble -unless customers don’t care anymore.
"So the move that actually lowered our exposure came from the other direction. Less to find beats a better finder. We have been cutting dependencies hard, front and back. Snyk flagged Axios every single week, so we removed Axios entirely, and the alert stopped because the thing it alerted on was gone. Every dependency you delete is a stream of findings you never have to validate again. The cheapest finding to triage is the one that never enters your tree."
It occurs to me that one solid use for AI coding is to write your own instead of using 3rd party libraries/packages. This is actually an almost ideal case for AI coding as you already have a clearly documented spec and way to test by checking that it does the same as the 3rd party library/package. Plus you don't need to implement the entire library, just the functions you need so you don't have to worry about a library that may have vulnerabilities in areas you don't care about.
Yeah, agree, especially for a wrapper or a date formatter or some small utility. For ten years we solved everything by pulling in a dependency and never once looked at what was inside it. People do the same thing now with AI code, they read it about as much as they read the library source, which is never. The abstraction got further than the thinking, and AI just made it cheaper to not understand what you shipped.
I spent a good part of my career at Salesforce working on the platform security features.
When I see the vibe coding trend and move towards AI generated code, I can’t help but think we’re up for big trouble -unless customers don’t care anymore.
We’ll see.
Similar to biology - easy to produce things to try (eg binder prediction) but you still have to run experiments to see what actually works.
There is no domain where the LLM output is trustworthy without someone qualified checking it first.
💯
"So the move that actually lowered our exposure came from the other direction. Less to find beats a better finder. We have been cutting dependencies hard, front and back. Snyk flagged Axios every single week, so we removed Axios entirely, and the alert stopped because the thing it alerted on was gone. Every dependency you delete is a stream of findings you never have to validate again. The cheapest finding to triage is the one that never enters your tree."
It occurs to me that one solid use for AI coding is to write your own instead of using 3rd party libraries/packages. This is actually an almost ideal case for AI coding as you already have a clearly documented spec and way to test by checking that it does the same as the 3rd party library/package. Plus you don't need to implement the entire library, just the functions you need so you don't have to worry about a library that may have vulnerabilities in areas you don't care about.
Yeah, agree, especially for a wrapper or a date formatter or some small utility. For ten years we solved everything by pulling in a dependency and never once looked at what was inside it. People do the same thing now with AI code, they read it about as much as they read the library source, which is never. The abstraction got further than the thinking, and AI just made it cheaper to not understand what you shipped.