Can someone there please just click the rollback button now and we can all forget this ever happened. I don't think that new site can be saved. The old site was fine. Just leave it like it was. I bought a bundle as recently as last month. Three bundles I think.
If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.
After they repeatedly reinstated, without consent, recurring payment for their subscription plan Humble Choice, which I repeatedly chose to pause (yes, they offered it as a first-party option), I had to cancel the plan entirely, as an early subscriber back when it's called Monthly.
It showed me that they just don't care anymore.
But it still baffles me as to how an LLM could make it this worse, when they already had decent security measures. No top-of-the-line model should've done this. I guess it can only be concluded that they didn't even care to spend some money on SOTA models, even DeepSeek 4.1 Flash, instead turning to the cheaper but also much less capable models to save a few pennies.
I don't know about illegalness, I pressed "Get your games" button accidentally and it immediately deducted 12,99€ from my Paypal account without confirmation. What the hell.
Definitely illegal in Germany at least as any payment button needs to be clearly labeled as buying/paying for something. Probably illegal in more places as that button description doesn't really indicate that you are agreeing to a purchase.
If they don't have any presence in and don't actively target your region, your local laws and regulations might not be the ones that govern the transaction, though. Not sure if Humble Bundle has crossed that threshold yet for most of their non-US markets.
Perfect. I closed my account and then unlinked my connected accounts but this seems like a much better option. I don't want my data to be involved in yet another hack.
Thx. Was trying to delete my account. I couldn’t find the option in the settings of the page. A quick search told me to go via the sepetate Support Page, but alas the Login Button there only leads to a 404. What a mess! Using your link and confirming Ziff Davis is the parent company of Humble Bundle before entering my data, worked. They should now hopefully close my account.
I recently wanted to download a game I bought a long time ago through them (Machinarium, new macOS builds). Unfortunately the file on their CDN is corrupted. Their reply, after a week's worth of back and forth: sucks for you, it was sold too long ago so we won't bother fixing the issue.
My order history is gone. The "new" look is bad, it seems another hallucinated neon brain fuck. Wasn't perfect before but why the need to change just for the sake of it? Why? What was improved? This is what pisses me off the most, using LLMs for doing things just for the sake of it
As if anyone holds management accountable either. Big companies are full of VPs and Directors who make a mess and transfer orgs just before it comes back to bite them.
> The only party truly above accountability is the shareholder (a questionable decision itself)
This is decidedly not a "questionable" decision. I really, really shouldn't be held accountable for the conduct of any company in my ETF portfolio, as I have zero influence on their operations and zero insight into them (beyond what any member of the public has).
I disagree. I think you should be held responsible for all the stock that you own. If that means that ETFs are too dangerous for you that's good. Otherwise, it's rather foolish to expect shareholders make rational decisions beyond profit maximization.
It's not really an apples-to-apples: you can ask an "AI" to build software to do a particular thing, and it will happily oblige and spend some of your money on it and produce something that actually runs.
You cannot just turn the saw on (if electric), point it at some wood and expect anything resembling furniture.
None of the issues raised in the post/article here even require any particular knowledge of how to build software. Anybody with a basic attention to detail would have noticed them. It's just somebody who simply DGAF shipping to live.
Wow, that's an impressive downgrade. Not only is the site uglier (gradients, gradients everywhere!), but I could log in without needing my 2FA at all. Shame too, since I found the old Humble site pretty charming.
The article doesn’t seem to provide any direct proof the new site was vibecoded? I mean, probably it was, but people were writing insecure software long before AI came along.
Without evidence, accusations like this are, ironically, just vibes-based.
What other reason would there be for a complete rewrite without any sort of security? They had a fully functional and secure backend, why would it require replacing just to redesign the site?
I expect marketing types are freaking out even more about the jobpocalypse than devs. While it takes some skill to determine whether resultant code is working, marketing goes by vibes all the way up the chain.
This perspective on vibe coding is both funny and contradictory. The core issue with vibe coding is that people ship things they don’t understand. To flip it around and blame it on the humans involved only after something goes wrong as if the issue is them vibe-coding “wrong” is foolish. The issue is the vibe coding.
Vibe coding is just a really big hammer, what you do with it and what you do with results is still up to humans. Even if this was result of it, fuckup is ultimately fully in hands of somebody responsible (for product, website, clients etc).
If not, company is not viable and will crash badly soon. Market forces and all that.
For the vast majority of these issues, certainly including those mentioned here, simply testing before going live would make them beyond clear. So it's simply a bad developer likely working under bad management and, shockingly enough, producing a bad outcome.
LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart" cousin and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.
So as I understand it, vibecoding means (meant?) that you don't look at the code it produces, you case only about the end results, e.g. website through a browser.
But in this case, they seem to have skipped that as well.
If I had a dollar for every RoR coder who didn't understand the internals of the interpreter I would still not be richer than Musk because there are not that many coders.
No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.
git pull [email protected]:allofit/allthethings.git engineering patterns is what created this mess to begin with
Software is hard. But especially, evolving software over many years is hard.
I've seen people build great software but fail to evolve it.
All the lessons from agile, clean code, TDD and testable architectures, CI/CD, DevOps are really about building software that can evolve, yet most of those get ignored from time to time due to cost (frequently called time) pressures.
GenAI stresses this loop even more, and no human can effectively deal with the level of output you need to fit in to continue effectively shipping. This can only mean more bugs rather than fewer bugs.
Yes, in a well executed project, LLM agents can bring immediate value and find and fix bugs: because the system has the good feedback loop built in. As soon as you lose that (over shorter time with LLMs than with humans), it starts getting exponentially worse.
And this is all even before you stop and think if you are even building the right thing.
Because it allows you to produce so much code that it's not viable to carefully review each line/module, and get the benefits of the fast output.
Writing code yourself forces your brain to start creating pathways in your brain and you can verify the correctness of those pathways in your mind (e.g. am I actually doing this right, if I have seen such API would I be happy to use it,...)
Not saying we should write code manually, just showing the differences.
And even if you don't carefully review each line of code (or if you do), it helps a lot if you understand the basic principles of what you're trying to build. In this case, the vibe coder clearly had no idea about account security standards.
Programmers don't just write code. They also understand why they're writing the code and what it's supposed to do.
Was going to say the same. In fact we're seeing a huge wave of hacks caused by old human coded systems getting owned by "vibe" attackers.
Vibe coding is such an overused term now. Stats say what, 80% of programmers use AI to generate code? 90%? So everything is vibe coded. If you do well, no, it's still engineering. Someone makes a mistake? Cuts a corner somewhere? Vibe coded.
Because if a human was to program it, they might have stopped for a second and thought "Is this really a good idea?" whereas the LLM just goes "You're absolutely right! Here's some updates to the security code:"
I don't think it does, I doubt SOTA models are going to sign off on this.
On the other hand, people incompetent enough to ship this couldn't have produced a working website if they had to handwrite the code, so in that sense LLMs are at fault.
how many forced "tokenmaxxing" initatives do I need to bring up before we stop blaming developers for this reckless adoption of AI? These decisions come from the top, often from people who do not understand the software.
I'm a subscriber to Humble Bundle Choice (their monthly offering), and it has been a pain to receive a code via email at every login.
I doubt you have to fight anything to get there.
If they just focus on finding more fun bundles to sell and don't touch the site code again, ever, it will be fine. I have been happily buying things I usually do not need from them since Humble Indie Bundle 1.
I wondered why I did not get email code from them for login. Then it arrive one hour later... Seems like pretty big oversight...
It showed me that they just don't care anymore.
But it still baffles me as to how an LLM could make it this worse, when they already had decent security measures. No top-of-the-line model should've done this. I guess it can only be concluded that they didn't even care to spend some money on SOTA models, even DeepSeek 4.1 Flash, instead turning to the cheaper but also much less capable models to save a few pennies.
You have to click through multiple primary cancel buttons, but the final one cancels the cancellation.
Is this actually illegal in a jurisdiction or against ToS of payment providers and they can get permanently banned from using card payments?
This last month has set my expectation that next month + next month is too many CVE's and I'm plugging the dam hole with my finger.
It was pretty frustrating not being able to download the things I'd paid for.
> THEREFORE A COMPUTER MUST NEVER MAKE AN ARTISTIC DECISION
This is decidedly not a "questionable" decision. I really, really shouldn't be held accountable for the conduct of any company in my ETF portfolio, as I have zero influence on their operations and zero insight into them (beyond what any member of the public has).
You want to do a crime, subtly hint your AI about it.
AI doesn't produce bad software, people do.
It's up to the people involved in the process, to gatekeep AI to not *ship* bad software.
Does your IDE of choice produce bad software?
You cannot just turn the saw on (if electric), point it at some wood and expect anything resembling furniture.
AI makes producing bad software easier.
Without evidence, accusations like this are, ironically, just vibes-based.
Maybe they should finally change name to Edgy Bundle.
I removed the automatic payment process from paypal so at least that's safe, I'd recommend others to do the same at this point.
Cannot wait for some insider to tell us the story of how this came to be
Let me do 2fa when i have to pay not to just login to services i care very little.
And yes blizzard my wow account is not worth anything either.
i thought i'd be hearing about downsides?.. elaborate plz
It's always up to the skill of the human.
If not, company is not viable and will crash badly soon. Market forces and all that.
LLMs will be an interesting test of the current broken systems at most large companies. You can literally fire your entire engineering team and replace them with your "really smart" cousin and Claude. And that's going to be mighty tempting when the MBA mantra seems to be that cost reductions this quarter are infinitely more important than any potential costs in the future. But of course they're not.
But in this case, they seem to have skipped that as well.
No one at any company has ever understood every bit of the stack they ship; see all the bugs AI is finding in all the frameworks and libs we been shipping this whole time; oh yeah we sure knew what we were shipping.
git pull [email protected]:allofit/allthethings.git engineering patterns is what created this mess to begin with
I've seen people build great software but fail to evolve it.
All the lessons from agile, clean code, TDD and testable architectures, CI/CD, DevOps are really about building software that can evolve, yet most of those get ignored from time to time due to cost (frequently called time) pressures.
GenAI stresses this loop even more, and no human can effectively deal with the level of output you need to fit in to continue effectively shipping. This can only mean more bugs rather than fewer bugs.
Yes, in a well executed project, LLM agents can bring immediate value and find and fix bugs: because the system has the good feedback loop built in. As soon as you lose that (over shorter time with LLMs than with humans), it starts getting exponentially worse.
And this is all even before you stop and think if you are even building the right thing.
Because it allows you to produce so much code that it's not viable to carefully review each line/module, and get the benefits of the fast output.
Writing code yourself forces your brain to start creating pathways in your brain and you can verify the correctness of those pathways in your mind (e.g. am I actually doing this right, if I have seen such API would I be happy to use it,...)
Not saying we should write code manually, just showing the differences.
Programmers don't just write code. They also understand why they're writing the code and what it's supposed to do.
Or more possibly the person incompetent one.
Vibe coding is such an overused term now. Stats say what, 80% of programmers use AI to generate code? 90%? So everything is vibe coded. If you do well, no, it's still engineering. Someone makes a mistake? Cuts a corner somewhere? Vibe coded.
I am extremely skeptical that those numbers are even close to accurate.
Given the sentiment that software is getting worse, buggier, and overall less stable, that isn't a comforting statement.
On the other hand, people incompetent enough to ship this couldn't have produced a working website if they had to handwrite the code, so in that sense LLMs are at fault.