Yet another Hacker News

Lovable apps expose passport details and more than 200K private messages

116 points armcat 1 hour ago 32 comments

rvz 44 minutes ago | parent

Nothing to see here and working as intended.

Imagine frontier abliterated models running at 2,400 TPS finding all these issues rapidly on web apps like this.

You are not ready security-wise when these models get faster. ("Formal verification" won't save you either)

swatcoder 35 minutes ago | parent

Or just the natural consequence of adopting "move fast and break things" from top to bottom for 20 years, a house-of-cards methodology that was destined to fall in on itself whether or not such models ever arrived.

Formal verification doesn't solve all the problems, but alongside concerns like correctness, restrained surface area, supply chain awareness, treating PII as toxic waste to avoid rathee than treasure to collect can leave projects/orgs in a much better place than they let themselves get too.

Long way to go from here though.

hnav 20 minutes ago | parent

This is one of the reasons anthropic nerfs their models. They want you to have an enterprise contract with some spend before they’ll allow you a couple of seats on cyber models, which you need since attackers are much more nimble with ablated open weights models.

tehjoker 18 minutes ago | parent

The ultimate capitalist model, create a never before experienced problem and sell the solution on a never ending subscription. Progress!

nicce 7 minutes ago | parent

Nothing saves if human is completely out of the loop

birdsongs 35 minutes ago | parent

I can't state my disdain enough for the rabid, careless advancement of AI, and all the bros that keep telling me to catch up or fall behind, while they are actively causing harm to the hundreds of thousands, or millions of users they have, without care or consideration.

Nearly two decades of experience learning how to build safe, performant software, to be replaced by this shit.

We don't care about people, our customers anymore. We actively harm them for profit. This is such a garbage industry now.

fph 31 minutes ago | parent

It's surprising how different the standards are between software engineering and all other kinds of engineering, for instance civil or mechanic.

The old joke was "If builders built buildings the way programmers wrote programs, then the first woodpecker that came along would destroy civilization", but in the AI era it feels like a butterfly would be enough.

anonym29 11 minutes ago | parent

Counterpoint: if programmers wrote programs the way structural engineers designed buildings, ecommerce apps would take half a decade to build and the software industry would have just gotten around to inventing Windows Vista and jQuery in the last year or so.

swatcoder 4 minutes ago | parent

If you're saying e-commerce would simply be consistent and secure product catalogs with fewer promotional and tracking dark patterns, web scripting would rely on a and extensible and functional library for manipulating markup documents, and a stable OS kernel with few dark patterns and no cloud accounts, many of us would be sold in a heartbeat.

I don't think you're making the counterpoint you mean to be.

andrew_lettuce 29 minutes ago | parent

I am interviewing with a small company that has adopted agentic development in a big way and is looking for a vp of engineering to guide things. I tried to present a balanced view of excitement for the possibilities built on first solving governance, guardrails and mitigating the lethal trifecta. Senior executives are not interested and my position likely disqualified me, even after I talked about needing to speak to your client data governance teams and CISOs. Crickets. They actually said we're looking for someone who's a big AI booster. Bullet dodged.

barrenko 22 minutes ago | parent

When the Republic gains in strength, the Jedi go hiding in the desert.

Rendello 24 minutes ago | parent

These past few years, it feels as though the brake pedal has been replaced with another gas pedal.

tortasaur 21 minutes ago | parent

The idea that companies invested in "safe, performant software" before AI is laughable. Tech companies have never cared about the customers beyond their effect on KPIs.

uvdn7 11 minutes ago | parent

But people care. A self respecting engineer cares.

hk__2 6 minutes ago | parent

Self respecting engineers care also in the age of AI.

birdsongs 2 minutes ago | parent

Exactly. I cared, and the amazing engineers that taught me cared. We didn't have KPIs in 2008, we had code reviews and mean senior engineers (that were secretly kind) that would tear your code apart and send you back until you got it right.

And we were allowed to? I raised so many tickets over time that had no real business impact beyond "this is a security risk" and nearly all of them I was allowed to adress.

Maybe that makes me some kind of tech-boomer, like people responding to me are implying, but I don't really give a shit.

anonym29 17 minutes ago | parent

>I can't state my disdain enough for the rabid, careless advancement of AI, and all the bros that keep telling me to catch up or fall behind, while they are actively causing harm to the hundreds of thousands, or millions of users they have, without care or consideration.

Have you ever considered that the people who are pro-AI are not a monolith, and that it can be simultaneously true that you should absolutely be learning how to effectively and safely use LLMs in engineering workflows, while it is also true that there are people who are using them very unsafely?

Beig opposed to learning how to use AI correctly because some people use it recklessly is like being opposed to learning AWS in 2015 because some people left sensitive data in open S3 buckets.

Do not confuse negligent misuse of the tool for the value proposition of the tool itself.

birdsongs 6 minutes ago | parent

Re-read my post before quoting it and getting defensive. I'm not anti-AI, I use Claude daily, partly because that's all the industry is now, partly because it can be an amazing tool.

I'm furious about slop-shovelling profit-driven development that actively causes harm to people. And the lack of care for, or outright disdain of customers, specifically fuelled by a misuse of AI, and the people telling me to get used to this, the people telling me to stop reading my own PRs, the people telling me this is just how it is now. When we all know that isn't true.

Betelbuddy 17 minutes ago | parent

You won’t lose your job to AI...but to someone using AI...and they will lose everything...to someone who knows cybersecurity.

kpil 11 minutes ago | parent

I think this more or less sums it up.

Interesting times.

Regarding losing jobs - what I hope will keep me employed: opiniated creativity and common sense. Not sure if I'm right.

r_lee 6 minutes ago | parent

if those are the reasons... I'd feel very uneasy

guestlistplus10 30 minutes ago | parent

Railway got hit by pretty much this a few days ago. Attacker likely used abliterated models, stolen keys, ~$740k in AI charges. If it happens to them, random Lovable apps are easy targets.

Oras 8 minutes ago | parent

One might argue that data breaches been there way before AI, the difference with these AI generated apps is:

- They are an easy target, they don’t need any sophisticated hacking knowledge (article mentions inspecting network calls in browsers).

- There tons of those, and more created everyday. For the average user, they don’t know what they are using, or how risky it can be.

neathack 6 minutes ago | parent

Hi, I’m the author of this blog post. I submitted it to HN two weeks ago, but it didn’t gain much traction, so I’m glad to see it resubmitted. Happy to answer any questions, though I think the situation is fairly self-explanatory.

lysace 4 minutes ago | parent

How many of the 159k analyzed sites leaked private data?

lysace 5 minutes ago | parent

So they analyzed 159k sites created using Loveable.

Some of these leaked private data - how many? That is not specified as far as I can tell.