Isaac: Welcome to Never Rewrites. I'm Isaac Askew. Dustin Rea: Justin Ray. Jeffrey Sherman: And I'm Jeffrey Sherman, and today we're gonna talk about vibe coding. So woo! ⁓ we were talking ⁓ offline in the green room ⁓ about whether or not vibe coding is the new my brother's genius son ⁓ wrote me a an a web app or it used to be a website, then became an app, and then it is the long-term Isaac: Whee. Jeffrey Sherman: longstanding joke and fodder for many consultants livelihoods of fixing something that was written in the pre vibe coded days by some high school student who hacked their way through something. ⁓ and is vibe coding the new the new version of that. Does it change anything? So Dustin, have you encountered I guess you do a lot of consulting with ⁓ people who are entrepreneurs, have you encountered more entrepreneurs who are I vibe coded the first version of my app versus I got a high school kid to write the first version of my app? Dustin Rea: Yeah, it's something that I see a lot from from clients both from before and today. And I think there's even like a mix of like still it's my cousin or uncles, nephew, whatever about, you know, is the one doing the vibe coding as well. So you kinda get a combination there. ⁓ but I think it's it my experience has been probably the opposite that you would think from the like the topic or the title. ⁓ and that's that I've seen, you know, the the high school kids kind of, you know Jeffrey Sherman: Mm-hmm. Dustin Rea: app and been like, wow, that's that's not that's really not even going to work at all. And then I've also seen vibe coded apps that I was pleasantly surprised from completely non-technical people that were I was like, wow, that's pretty close. You know, that's surprisingly close to being good. You know, ⁓ so it's kind of the opposite that I think I would have anticipated. ⁓ but there's also, you know, I think there's both sides of the spectrum, you know, on both sides. Jeffrey Sherman: Mm-hmm. Hehehehehe. Mm. Isaac: Mm-hmm. Jeffrey Sherman: So y your experience is that the vibe coded stuff is better than a well meaning amateur production? Dustin Rea: Yeah, I would say that ⁓ you know, a well meaning amateur that is vibe coding has a much better chance of success than a well meaning amateur without the vibe coding tools. ⁓ that's been my experience. Jeffrey Sherman: And has it led to inflated expectations or more realistic expectations? Dustin Rea: Ooh, that's a good question. I think a little bit of both. ⁓ I think sometimes the inflated expectation is around like speed. And I think that there's that's that is very true in the honeymoon phase when you're like building your MVP or like you know, I'm sure we've all experienced that if you're just doing some POC, it's you see the I built this in a weekend thing. It's like, yeah, we're all spending out things in a weekend. But like have you ever had a software like be alive for several months? Like the process of maintaining software. Jeffrey Sherman: Mm-hmm. Isaac: Mm-hmm. Jeffrey Sherman: He Dustin Rea: is very different than the process of spinning up a POC. And I think that's the expectations gap is in the maintaining side because they're expecting to be able to have that same level of like velocity and quality that you see when it's just like one or two features. And they're expecting to build like a system out of it. And it's just not it's not going to produce that. Isaac: Yeah. Jeffrey Sherman: Mm-hmm. Isaac: I've kind of seen that that vibe ⁓ as well. Like I I think that the initial MVP, like getting it spun up so quickly, everyone's like, Look how fast this is. And the moment there actually is that bit of a slowdown of the maintenance phase, they're like, What's the issue here? I've actually seen like I feel like frustration in a few different areas where someone's like, Well, I could just get this done so fast, so and so, because now they think 'cause all they've ever done is the surface level thing. Look how fast it is to get stuff done now. Jeffrey Sherman: Mm-hmm. Isaac: Well, what do you it's going to take this longer? I could do it even better than that. And I've definitely seen that like at least four or five different cases where people are actually underestimating the level of effort of maintenance because generating it was so fast, but they don't understand the generating it and scaling it. And like if you actually have people using it, and whenever you're also like generating the code and like blindly approving it, then suddenly it removes something that was useful, but you didn't know why it did that because you're not even. Jeffrey Sherman: Mm-hmm. Mm-hmm. Isaac: viewing all the code and you have to make sure that things haven't regressed. All of that comes into play. ⁓ and I do feel like the attitude toward you know, with some people, ⁓ is changed. ⁓ it's a b I think people are getting a little more cocky with software engineering and how easy it is. Yeah. Jeffrey Sherman: I I have seen that with developers. ⁓ not so much with business people, but I've seen that with developers going back to not respecting ⁓ the actual work it it takes to keep something operational in production. Which I I feel like it was d very much ⁓ in my career, it was when we started off ⁓ and there were servers and there were entirely different teams who maintained the servers and you literally hand it over, here's the binaries. And Isaac: Yeah. Jeffrey Sherman: There was very little concern about what it took to actually keep this stuff running in production and then DevOps ⁓ you know, everything changed and now we're I feel like we're developers are backsliding too. Well, what do you mean it takes effort to keep this thing in running in production? What do you mean the virtual server ran out of disk space and the logs? It's like yeah they Isaac: Been spoiled. Yeah. I could do it. Dustin Rea: Yeah, I think yeah, I I'm almost seeing like a new ⁓ like vector of of like production incidents as well. So it's like if you have ⁓ kind of an AI that's ⁓ you know, it's it's working but it misses something like that that you're not expecting, or let's say you give it production keys, ⁓ maybe you don't even mean to. Like let's say you just have those stored somewhere and it finds them and starts digging through logs and it's like, ⁓ Jeffrey Sherman: Mm. Isaac: This has happened to me. Dustin Rea: I found I found it. Look, it's this piece of data. It's bad data. I'll just simply delete it. Problem solved, right? Error gone. Clearly, pass it, you know, tests are passing. Jeffrey Sherman: Yeah. Isaac: I've I've had I've had it literally go, ⁓ there's a Vercel ⁓ connector in your client. Let me pull in any environment variables I could use for this, then run a migration that broke my my my vibe coded product because it found the keys because it couldn't find them locally because I just cloned them on a fresh computer and I'm like, whoa, whoa, whoa You know, I had to learn pretty that was a really good first lesson for me playing around with it, especially with a side project that wasn't live at the time. Or live to customers, it was live and yeah. Dustin Rea: Right. And so you imagine like if you have different, you know, hosts that you're having locally, whether you whether that's at your job or whether you work with different clients like I do, right? It's like it could very easily start to bleed data between these like tenant boundaries, which I think all of us here understand, you know, multi-tenant data, people watching at home, depending on technical, may may or not. But, you know, the idea is that if you're building software, we don't want ⁓ a tenant from another part of the system like getting data, like your data. Isaac: Mm-hmm. Dustin Rea: Like you should only be able to access your own data that that you own. And I don't think that like vibe coders necessarily have the like the terminology or the vocabulary to really give that to the prompt and say, Hey, make sure you're adhering to multi tenant data practices. You know, it's like it's just vibed. Right. So Isaac: Yeah. Yeah. Sandboxing in particular, yeah, is it super important. I feel like people are just like, ⁓ just let it run. And that's gonna bite them. Jeffrey Sherman: Yeah. It's like a Hollywood just to type in admin and ⁓ there boom, you've got admin. Isaac: Or or that what was the famous show where they had two people like trying to counter a hacker so like they both used the same keyboard? It was I forget which one that was, but yeah, two hands on a two different hands on a keyboard. Dustin Rea: ⁓ yeah. Jeffrey Sherman: ⁓ Yeah, I I mean it goes ⁓ Facebook, no it Instagram had a ha security breach like two weeks ago where they the hack it it was entirely a ⁓ social engineering of the AI help bot where they asked the help bot to change the email ⁓ that the account was associated with and then they asked it to send a password reset link and then they had access to the account. And Dustin Rea: Yeah. We're seeing that on NPM too. So like, you know, if you're a if you're a non technical person and right, the whole vibe coding thing is built on top of open source. So like they're pulling in all of these open source packages. So like if you're an attacker, that is an excellent vector to just get a compromise but ⁓ you know, Jeffrey Sherman: Mm-hmm. Isaac: Yeah. Dustin Rea: vetted release out that now unsuspecting people who don't even like follow security trends, they're not watching for these alerts to pop up, like they could be infected. That that spreads. Again, if that breaks tenant isolation in the environment that they're in, it's like how many what's the risk that you're taking by just being a tenant in these environments? Like they're very hostile environments because you have people, you know, pulling in whatever on top of people who are probably also trying to maliciously and intentionally attack you. Isaac: I just feel like this could imagine a ⁓ like not just a contractor in the sense of like ⁓ tech world, but imagine like you hire a plumber and someone shows up and they've never plumbed before, but they have chat GPT. That's kind of that's kind of like the level of trust you have at this point, right? Like they don't really they have no really have any experience doing it, but they're like, I can figure it out. I have this great amazing tool that shows me what to do, and it does a pretty good job at telling me what to do. And so they vibe code the fix of your plumbing, and maybe they get it right, and maybe they don't. Jeffrey Sherman: Well see, that's a that that's an interesting ⁓ and very good analogy with the, you know, kid's genius brother, where a a plumber is a licensed professional. Like they a plumber has a license, they've they've got insurance and they've been certified and all of this stuff, but for most plumbing issues, most people hire a handyman who is just a general handy person who knows plumbing and can probably do nearly as good of a job on any Isaac: Mm-hmm. Dustin Rea: Mm-hmm. Jeffrey Sherman: standard plumbing issue as a real plumber. But they won't have the right insurance if everything goes wrong. And Isaac: And they won't have some other kind of like historical knowledge of like, like I I had somebody come in my home and they were like, So if that water manes here, that means and you could just see them doing the calculation in their head, like like seeing the invisible piping in my home because they're so used to how piping is done in homes. And that context, which is super key in that term, it's very key in AI, that context is super important for understanding like Jeffrey Sherman: Mm-hmm. Isaac: Sure, maybe you fixed a leak, but is that going to cause some other issue because of pressure or some other kind of thing that wasn't considered for this because you're not used to doing that? Dustin Rea: Yeah, and I think data is an excellent analogy for water in this case, right? I mean it's like literally if you understand anything about what you're building, you are just plumbing data through systems to get a result for people. You know, that's the exact idea. Jeffrey Sherman: Yes. Isaac: Yeah. Jeffrey Sherman: Yes. Isaac: And people get excited. Wow, there's water coming through. I'm a developer. Wait, we have to maintain this? Yeah. Jeffrey Sherman: Well, to extend the analogy. To extend the analogy, my previous home was a new home, and we were the first owners. It was a foreclosed the builder built it, it foreclosed, and we bought it. So we were the first people who really lived there. And the show one of the showers, the pitch of the pipe wasn't right, and the person who did the plumbing on that specific one. Dustin Rea: You're right. Jeffrey Sherman: didn't put enough straps, whatever ⁓ pipe straps. And so what happened over time is because the weight caused the join to sag. And then I had water in my kitchen because over time the data leaked. ⁓ just like data if you vive code it and you don't unprofessional. So like, you know, I had a professional plumber come out and he looked at it, he's like, Well, this is pitched wrong. It's like I don't know that I can actually fix that because like the it's here, it's there, it's it Isaac: Yeah. Jeffrey Sherman: it's wrong and I don't know that I can fix it. But also they didn't put the straps around the pipe like every however often you're supposed to. And this is exactly why you're supposed to do that because now the pipe is sagged and it's leaking. And the is the join was no longer tight. Dustin Rea: Mm-hmm. Isaac: Mm-hmm. Dustin Rea: And you may have the argument of like, well, it looks like it's working to me. Right now, it looks like it's working to you. Just give it twelve months. Yeah. Yeah. Jeffrey Sherman: Right. Can you push the pipe back together and put some tape around it and now it's good again? Isaac: Yeah. Or people just shoving in the integrations. Exactly. Exactly. Like I fixed the problem. And you're like, ⁓ okay. And that's kind of like the vibe thing today where if you're vibe coding guided by someone who's been engineering for a long time, then you're probably gonna get a little bit better results than somebody who's just like this cocky person or sharing like like the image lately of like you guys are cooked and it's somebody like trying to share a local host link with you, like copy and paste the local host. Dustin Rea: Yeah. Right. Right. Jeffrey Sherman: Mm-hmm. Isaac: Like this kind of means. But they just don't get like, sure, you've done something that seems to be impressive, but like all of the work is beyond that facade. Like the MVP, once you scale it, that's where the work and maintenance comes into play. And that's where that knowledge of, ⁓ I understand why this is failing and what will fail in the future, get ahead of it so it doesn't cause downtime, it requires a bit more effort. But or I think we're still in that honeymoon phase, like we mentioned of like Jeffrey Sherman: Mm-hmm. Isaac: seeing the power of AI and so everyone's like, ⁓ I can do anything and w w is it but it really is kinda like the contracting thing where someone's like, How much are you charging for that plumbing job? Are you kidding me? I could just do it myself for that much money and they just don't understand it. Jeffrey Sherman: Mm-hmm. I get a handyman that'll do it for twenty bucks an hour. Yeah. Dustin Rea: And if you've ever tried to do it yourself Right, if you've ever tried to ⁓ do this with coding or with ChatGPT to like do a plumbing fix or an electrical fix, which I've tried both, both times it gave me incorrect instructions and I, you know that's to say everything's okay, but you know, could have been bad. Isaac: Mm-hmm. Ooh, vibe coding electrical work in your home? ⁓ shit. Jeffrey Sherman: Yeah, it's they told you to l to turn the circuit breaker on, right? 'Cause that's I turn it off, but that's my first step always, but ⁓ I hear some people just I I I saw a handyman. I I I saw a handyman do it and I was like, dear god, how are you not dead? Dustin Rea: Ha ha ha. Isaac: Yep. Dustin Rea: ⁓ it's not necessary. It's optional. It's not required for the fix. Isaac: You're right to push back. That's what it says to you. Wait, what does shock me? ⁓ you're I was mistaken. Thank you for correcting me. Dustin Rea: Yeah. Exactly. Jeffrey Sherman: ⁓ so I I it kind of goes back to what Isaac and I were talking about a couple episodes ago where AI is going to collapse the parts some parts of it, but it's not gonna remove any steps. And so getting a viable MVP might be faster and easier now. But it still doesn't make running ⁓ a production company any easier. Well ⁓ but like that's such a small part of actually having a pr a piece of software running in production. And I I feel like that Isaac: Mm-hmm. Jeffrey Sherman: maybe is the thing that hasn't changed. It's it's still there. Like it it AI can't run software in production yet. And it Isaac: I wonder how it'll scale out people's personalities. Because I've noticed that, you know, you've you've got the safe people, you've got the aggressive people, the risk very risk tolerant people, the people in between. And then giving them a tool where they can accelerate, where someone can like ⁓ the safe people are wanting to more cautious with how it's rolled out, but the salesy people, the engineer that's more like they can do a good job selling it to leadership, cowboys. Jeffrey Sherman: Cowboys. Isaac: If they can sell something, ⁓ why don't we just move faster? What's the deal here? AI can solve everything. You know, I can see there being an even crazier split between that the social dynamic of the developer that's like, well, wait a minute, I've been, I'm an experienced maintenance person, and we're, you know, we're we're convincing leadership that, you know, AI solves everything and we can, you know, run a lot faster than we can, and I have concerns. You know, I think we'll probably I think right now we're in the phase of the aggressive sales pitch viber. Dustin Rea: Yeah. Isaac: And then once we start seeing all the issues that will come from that, they're gonna go to the ⁓ let's get the AI what do you call it? Like the AI ⁓ not guardrails, but let's find the engineers that are like the the the safety ⁓ engineers that are the you know Yeah, but then and they're using AI as like just bolstering the the safety kind of yeah. Dustin Rea: Like guardrails? Mm. The safety taste. Jeffrey Sherman: Yeah. Well, it's like cowboy programmers, ⁓ for those who don't know, cowboy programmers are the kinds of people who will change stuff in production or tweak, you know, ⁓ not commit code and then release it just to see what happens, or not test before they release. Those kinds of people tend to hang out in startups where the blast radius is smaller and then they get squeezed out as the company becomes bigger and more professional. Right like Isaac: Yeah. Mm. Yep. Jeffrey Sherman: I if if you have the ability to drop the production database, sooner or later you will drop the production database and you know, i it those people are just inherently too risky to keep on as the company grows. Isaac: They serve a purpose though, like at the the very beginning. Like a like a like a aggressively getting stuff done and like not caring if there's like fallout because you're just trying to, you know, get something in front of somebody as soon as possible or land a client or whatnot. Sure. But then there's like that sweet spot, you know, where like aggression and then like, ⁓ okay, w this could be profitable. Now let's add some guardrails and security concerns and whatnot to protect the the the moneymaker. Jeffrey Sherman: ⁓ at the very beginning. Yeah, yeah. Mm-hmm. Right, well that's the scale up phase, right? You you start up you have cowboys and then they get start getting squeezed out in the scale up phase and then when you're in the steady state, anybody who's a cowboy is gonna have left. 'Cause it just it's too slow and the the risks are too high. Isaac: And there's Jones in for those risks. Jeffrey Sherman: They they do, right? You know, a cowboy, if you can't get on your horse and ride, then what are you even doing here? Dustin Rea: The adrenaline. Isaac: Main character syndrome. Anyway. Okay. Jeffrey Sherman: Yeah. You know, get out there with a gun and just shoot the thing and Dustin Rea: It's real. Jeffrey Sherman: Don't want to hear somebody say, No, but let's build a fence. Isaac: Mm. All right, any other ideas on vibe coding? Jeffrey Sherman: All right. No, I I think we've landed at you can vibe co ⁓ getting that MVP is faster, but it doesn't really change the long tail of running software. Dustin Rea: Right. Not yet. Isaac: Agree. Not yet. Jeffrey Sherman: Awesome. Not yet anyway. Anyway, thank you all for listening. I'm Jeffrey Sherman. Dustin Rea: I'm Dustin Ray. Isaac: And I'm Isaac Askew, and this is Never Rewrite.