Where did I say you should audit all the code you run daily?
Not sure if you're being manipulative on purpose or if you genuinely did not understand my point. I was talking about "trust", which is a whole concept in itself.
I understood your comment the same way as the guy you're replying to. Maybe it'll help if you expand on whether we can trust vibe coded software? That's really the crux of the issue, and if you're not addressing that your comment is just a truism
Code can make your computer do stuff. If you run code in an environment where it has the possibility to do harm, then it is a possibility, and therefore a risk. Whether or not you accept that risk depends on the situation, but it is important to realise that the risk exists.
> I don't really see how its provenance matters
The fact that the code was vibe coded does not change the capabilities it has. If you run random code written by a human with root access, the code can do what root can do. If you run random vibe-coded code with root access, the code can do what root can do.
When you run code, what the code is allowed to do in the environment it is running is independent from who or what wrote that code.
> you should not run code you don't trust, period.
Trust does not mean that you have to review all the source code everyday, yourself. Trust means that you accept the risk given the provenance.
When you drive you car, you trust that it won't explode. You don't review the whole car assembly every day. When you cross a bridge, you trust that it won't collapse. You don't check the whole structure everytime yourself.
When you run your laptop, you trust that the battery won't catch fire. You trust that your OS isn't a malware.
In your life, you trust many many things. Many times you don't have a choice, many times it's institutional trust ("I live in a country where bridges don't collapse", for instance).
Now when you run code you find on the internet, I'm sure you apply that. Say it comes from Google: you probably trust it (after all, if you don't trust Google you're pretty much screwed).
Now if a random username on Reddit tells you to execute some code, do you happily do it? I don't think so. At least you shouldn't unless you understand what it does.
What's the difference between random code you find on Reddit and vibe-coded code? I don't see one. I don't base my trust on the fact that it was written with AI.
The fact that it comes from AI means "it is not an author that I trust, but it doesn't mean that the code is malware". I just need to find another way to trust it (maybe someone else audits it, maybe I do, maybe I run it in an environment where it doesn't matter, etc).
Let's say you follow a link to a github project and you have to assess whether to trust that code, how do you do it?
Before AI just having a good README and superficially looking good code (we're not going to do a deep review of it) was a gauge of quality that at the very least the person that wrote it knows what it's doing.
How do you do it now? Maybe the AI was expertly guided, but maybe it was vibe-coded by someone who hasn't even heard of basic security principles and your whole data is sent in plain-text somewhere. It doesn't have to be nefarious, it could be a debug feature that was never removed, or maybe the user never asked the llm to "make it prod safe". And there's no way to know unless you read the whole thing, because superficially the README and the code will look as good as any other llm project.
That's problem number one, before you could quickly see if it's made by someone who knows what it's doing, and thus that you can trust. With vibe-coded software not so much.
The second issue is not inherent to vibe-coded software but it's caused by it: it's a sea of garbage. It's very possible that the absolute amount of good software has increased, but it's become harder to find it.
I disagree with your premise that anyone seemingly competent can be trusted.
> It's very possible that the absolute amount of good software has increased, but it's become harder to find it.
It was like that long before AI. Most software written by humans is very bad, and it was accelerating before AI. And there was too much software to review everything long before AI as well.
If anything, I find that AI writes better code than the average human-written code. Of course it makes it harder to judge the contributor (before I could clearly see that they were not good coders, now I can't). But as a maintainer, I was reviewing the code before, and I am still reviewing it now. Some people will send unreadable AI-generated PRs that I won't review, some people will send readable PRs that I will review and merge without any consideration of provenance.
A problem could be that I may receive too many PRs to review (I think it happens to Linux). And the consequence of that may be that opening a PR to big open source projects may have to become less accessible eventually.
Not sure if you're being manipulative on purpose or if you genuinely did not understand my point. I was talking about "trust", which is a whole concept in itself.