Latest / DevQuestions with Tim Corey / 256. Does Vibe Coding Have A Place In Software Development?

Transcript

256. Does Vibe Coding Have A Place In Software Development? · DevQuestions with Tim Corey

• 0:00
  SPEAKER_01: Does vibe coding have a place in software development?
• 0:03
  SPEAKER_01: Yep, but probably not the place you were thinking of.
• 0:06
  SPEAKER_01: Vibecoding is the concept of using an AI to build an application or parts of an application for you.
• 0:14
  SPEAKER_01: Now it does that instead of you writing most of the code.
• 0:17
  SPEAKER_01: So instead of you writing most of the code, you let the LM write the code and you just tell it what you want.
• 0:23
  SPEAKER_01: But is that a wise decision?
• 0:25
  SPEAKER_01: Let's talk about it in today's episode of Dev Questions.
• 0:36
  SPEAKER_00: Welcome to the Dev Questions Podcast with Tim Corey.
• 0:40
  SPEAKER_01: Software development is more than just writing code.
• 0:43
  SPEAKER_01: So let's talk about the rest of it.
• 0:44
  SPEAKER_01: Specifically, let's talk today about letting an LLM write the code for you.
• 0:50
  SPEAKER_01: You've probably seen some really cool examples online or on social media of systems, applications, websites, and games that have been built using vibe coding.
• 1:00
  SPEAKER_01: Some look really amazing.
• 1:02
  SPEAKER_01: But what does this mean for developers?
• 1:04
  SPEAKER_01: Should we all be doing this?
• 1:06
  SPEAKER_01: Vivecoding has a place in development, but let's talk first about the dangers of vibe coding and when to avoid it.
• 1:13
  SPEAKER_01: Then we'll get into when to use vibe coding.
• 1:17
  SPEAKER_01: So the number one danger, and this is not an ordered list, it's just one of the dangers, is it's inconsistent with the rest of your code.
• 1:26
  SPEAKER_01: When an LLM writes code for you, it might not match the rest of your styles.
• 1:31
  SPEAKER_01: Now you might say, well, I'm vibe coding, I'm building an entire application.
• 1:34
  SPEAKER_01: That's great, but how does it match with the other applications you've built?
• 1:39
  SPEAKER_01: You may have walked in on organizations where they do things differently than you do.
• 1:44
  SPEAKER_01: And it's kind of a culture shock at first.
• 1:46
  SPEAKER_01: And sometimes you might say, Well, I want to write the way I have done it before.
• 1:51
  SPEAKER_01: But that creates a mess because now some things are in the old way and some things are in the new way, and you have to kind of shift gears or you're rewriting code that's just changing how things are laid out or what the naming conventions are or things of that nature.
• 2:06
  SPEAKER_01: So that gets messy.
• 2:08
  SPEAKER_01: Well, with AI, it's not going to match necessarily your coding styles.
• 2:14
  SPEAKER_01: Now, eventually in the future, they may start reading style guides to match your style, but it'd probably be a little bit.
• 2:21
  SPEAKER_01: So for right now, they're in your that code will be inconsistent with the rest of your code base, whether it's in that application or other applications you've written.
• 2:31
  SPEAKER_01: Number two, sometimes it writes code you don't understand.
• 2:36
  SPEAKER_01: Now, why is this a big deal?
• 2:38
  SPEAKER_01: Because if it runs, it's great, right?
• 2:40
  SPEAKER_01: So you know, so if if it fits, it ships, kind of like that old motto.
• 2:43
  SPEAKER_01: Well, if it if it runs, it goes to production, right?
• 2:46
  SPEAKER_01: Please don't.
• 2:47
  SPEAKER_01: Please don't do that.
• 2:48
  SPEAKER_01: If you don't understand why it runs, well, you might have a major problem.
• 2:53
  SPEAKER_01: Because if you don't understand why it runs, well, then how do you know it's running correctly?
• 2:59
  SPEAKER_01: How do you know it's running the right way?
• 3:01
  SPEAKER_01: How do you know it's not doing things you don't want it to do, or being less efficient than you want it to be, or the fact that it might not be taking into account certain variables or ways of doing things.
• 3:13
  SPEAKER_01: It might be the wrong way, but it still kind of works.
• 3:17
  SPEAKER_01: So understanding your code is important.
• 3:20
  SPEAKER_01: And if it writes code you don't understand, well, then that's gonna be a problem for making sure that you can maintain that.
• 3:28
  SPEAKER_01: Which leads us right into number three, which is an LLM does not necessarily write easily maintained code.
• 3:36
  SPEAKER_01: Remember that code is meant to be read by humans.
• 3:40
  SPEAKER_01: When we write code, we're writing codes for others to read.
• 3:44
  SPEAKER_01: Because when you write code, you might write it once, but then it might be read dozens, if not hundreds of times by other developers.
• 3:52
  SPEAKER_01: You might say, well, Tim, why would you ever do that?
• 3:55
  SPEAKER_01: Well, what are you doing when you're debugging?
• 3:57
  SPEAKER_01: You're reading the code.
• 3:58
  SPEAKER_01: You're trying to figure out what that code is doing and where the error is in the code.
• 4:03
  SPEAKER_01: You read through big blocks of code, trying to figure out what's going on.
• 4:08
  SPEAKER_01: That happens over and over and over again.
• 4:10
  SPEAKER_01: So you want to make sure that your code is easy to read for other developers.
• 4:16
  SPEAKER_01: But that's just one part of easily maintained.
• 4:20
  SPEAKER_01: You know, well-written code, that's great.
• 4:23
  SPEAKER_01: But there are another other parts to that as well.
• 4:26
  SPEAKER_01: For example, when you're writing easily maintained code, you're writing code that is modular, that can be easily swapped out with a different version, that is written in a way that matches, for example, you're using an object-oriented programming language that's written in an object-oriented way to best work with the rest of the components in the system.
• 4:47
  SPEAKER_01: It's dry, it's solid, it's all these other things that we talk about, but an AI doesn't necessarily do that.
• 4:55
  SPEAKER_01: So it makes it potentially harder to maintain as well.
• 5:00
  SPEAKER_01: Now you may say at this point, well, Tim, you know, these are overcomable things.
• 5:05
  SPEAKER_01: We'll get there.
• 5:05
  SPEAKER_01: Okay.
• 5:06
  SPEAKER_01: And none of these are like on their own, kill it, don't do it necessarily.
• 5:11
  SPEAKER_01: But I want you to keep thinking about these dangers as we go along.
• 5:15
  SPEAKER_01: We'll get to why you can overcome how to overcome these and also if it matters.
• 5:20
  SPEAKER_01: Okay, so number four in the danger list is it does not typically handle edge cases.
• 5:28
  SPEAKER_01: So this is what I call the happy path, right?
• 5:31
  SPEAKER_01: So when you build an application, it's going to be a form that a user fills out and it gets put into the database.
• 5:36
  SPEAKER_01: The happy path is the user fills out all the fields correctly, and then the application sends that data over to the database.
• 5:45
  SPEAKER_01: That's great.
• 5:46
  SPEAKER_01: But what happens when the user doesn't fill out all the fields?
• 5:49
  SPEAKER_01: Did the AI take that into account?
• 5:52
  SPEAKER_01: What if when you ask for a numeric field?
• 5:55
  SPEAKER_01: Maybe you say, how many years old are you?
• 5:57
  SPEAKER_01: And you expect one, two, three, four, five, six kind of thing, and they give you O N E or TWO.
• 6:04
  SPEAKER_01: Like that's spelled out.
• 6:06
  SPEAKER_01: That's that's that's an age, but that's not what you're expecting.
• 6:09
  SPEAKER_01: You're expecting a number.
• 6:10
  SPEAKER_01: Did it take that into account?
• 6:12
  SPEAKER_01: Users will always give you something you don't expect.
• 6:16
  SPEAKER_01: So are you handling that properly?
• 6:18
  SPEAKER_01: Are they giving you a SQL injection attack in one of the fields?
• 6:23
  SPEAKER_01: Did the LLM take that into account, or did it just try to put that directly in the database and forget about making sure it cleaned up that data and made sure there was no uh potential danger in that data being sent to the database?
• 6:38
  SPEAKER_01: Because if not, you might have just dropped the database or might have dropped your tables or sent all of your data to the attacker.
• 6:46
  SPEAKER_01: These are big things that are off the happy path, that are not on the normal how things work.
• 6:52
  SPEAKER_01: They're edge cases.
• 6:54
  SPEAKER_01: And with an LLM, or especially with vibe coding, you don't always get those things.
• 7:00
  SPEAKER_01: You don't get the handling of edge cases necessarily.
• 7:04
  SPEAKER_01: That leads us to number five, which is that vibe coding does not typically have error checking, logging, and other things in place to handle the way your application should work.
• 7:17
  SPEAKER_01: So when your application has an exception, do you know about it?
• 7:21
  SPEAKER_01: How do you know about it?
• 7:22
  SPEAKER_01: Where when were you told?
• 7:24
  SPEAKER_01: How are you told?
• 7:25
  SPEAKER_01: Well, if you're not logging and if you're not sending those logs in the correct place, you don't know.
• 7:30
  SPEAKER_01: It's a black box.
• 7:31
  SPEAKER_01: You just know that your application probably crashed because the user said it doesn't work anymore, but you don't know why.
• 7:38
  SPEAKER_01: This is where error checking, logging, and all the rest is a good thing.
• 7:41
  SPEAKER_01: But also let's go one step further.
• 7:44
  SPEAKER_01: Let's say you told the LLM, hey, I want to talk to this API, it needs an API key.
• 7:49
  SPEAKER_01: And here's the key, okay?
• 7:51
  SPEAKER_01: Which don't give your LLM a key.
• 7:53
  SPEAKER_01: That's no whole other thing.
• 7:55
  SPEAKER_01: But let's just say it did, or maybe it said, hey, put the key here.
• 8:00
  SPEAKER_01: Where did it tell you to put the key?
• 8:02
  SPEAKER_01: So even if you didn't give it to the LLM, don't, it probably said, hey, if you need a key, then put it here.
• 8:09
  SPEAKER_01: Where did it say to put that key?
• 8:10
  SPEAKER_01: It probably said to put it right in the code, which is going to get checked in a source control.
• 8:16
  SPEAKER_01: Hopefully, you're doing that right.
• 8:17
  SPEAKER_01: But it gets checked in a source control, which means that now your key has been exposed to everyone who's has access to your repository.
• 8:26
  SPEAKER_01: That's a security breach.
• 8:28
  SPEAKER_01: So the LLM told you what to do.
• 8:31
  SPEAKER_01: It was the wrong move.
• 8:33
  SPEAKER_01: What should it have told you to do?
• 8:34
  SPEAKER_01: It probably should have told you what I would have told you to do.
• 8:37
  SPEAKER_01: Hey, put a place in app settings.json for this key.
• 8:41
  SPEAKER_01: But don't put the key there.
• 8:43
  SPEAKER_01: Just put an empty spot there, okay?
• 8:45
  SPEAKER_01: And now access that value using the uh i configuration and say, hey, iconfiguration.value string and location, right?
• 8:54
  SPEAKER_01: And then take that key and put it in secrets.json.
• 8:58
  SPEAKER_01: And that will come through locally to your application, allow you to test.
• 9:03
  SPEAKER_01: But then I want you to either put it in your dependency injection system or key vault or in your Azure app configure environment variables, you know, wherever it's going to be, put it there as well for production.
• 9:18
  SPEAKER_01: Those are things that I would tell you to do, but that your LLM typically will not tell you to do.
• 9:24
  SPEAKER_01: It will say, hey, put your key here in the code, and it will work.
• 9:30
  SPEAKER_01: Just because it works doesn't mean it's right.
• 9:33
  SPEAKER_01: Again, going back to if you don't understand the code, you might not understand how big of a problem that is.
• 9:39
  SPEAKER_01: So, number six, the last of my my big ones, and there's more, but number six is the LM is not always gonna write the most efficient code.
• 9:51
  SPEAKER_01: There are ways to get data in and out of your SQL database.
• 9:55
  SPEAKER_01: There's ways to show data to the user that work that are terribly inefficient.
• 10:01
  SPEAKER_01: And I've got a demo coming up in a, I think, a couple weeks now, um, where I'll have a demo on a Monday where I'll show off some of the ways that you can accidentally abuse your SQL Server, either using bad SQL calls or bad entity framework calls, where you can actually get the data and it will work in development.
• 10:22
  SPEAKER_01: But as soon as you put any size to your database, it's going to start crashing your application, it's going to start taking up too much memory, it's going to take up your entire SQL Server processing power and more because you wrote a bad query or because you wrote things in an incorrect way.
• 10:39
  SPEAKER_01: So just because it works doesn't mean it's the most efficient code.
• 10:44
  SPEAKER_01: And that's problematic.
• 10:46
  SPEAKER_01: So that's something else.
• 10:47
  SPEAKER_01: Again, you need to understand your code to understand is this the right way?
• 10:52
  SPEAKER_01: Okay, so those are the kind of the six that I see are dangers, right?
• 10:57
  SPEAKER_01: And there's more, but those are the major dangers of code written by an LA, especially an AI, especially a vibe code application.
• 11:08
  SPEAKER_01: Now, these issues are all magnified when you vibe code an application because of the fact that you're not writing most of it and telling the LLM, hey, I want you to do this piece of it.
• 11:19
  SPEAKER_01: You're saying write everything.
• 11:21
  SPEAKER_01: So those issues get magnified because you're not constraining it or giving it the things like the boundaries to work inside and so on.
• 11:30
  SPEAKER_01: Now, you can mitigate a lot of these issues with enough prompting.
• 11:35
  SPEAKER_01: If you get really good at prompting, and if you're specific enough, and if you have the AI try again when it doesn't get it right, you can avoid most of these issues.
• 11:45
  SPEAKER_01: But at that point, what you've done is invented a less efficient means of coding.
• 11:50
  SPEAKER_01: You give it the exact logic you want, you re-ask for the solution multiple times, you wait for it to process over and over, you break it apart into steps, and then you check every step.
• 12:00
  SPEAKER_01: That's just inefficient coding.
• 12:02
  SPEAKER_01: So that seems problematic too.
• 12:05
  SPEAKER_01: Um, so why would you ever vibe code?
• 12:08
  SPEAKER_01: Well, the answer is for prototyping.
• 12:11
  SPEAKER_01: If you want to try something out, a vibe code app can be a good option.
• 12:16
  SPEAKER_01: You can test a theory, sketch out a concept, try out a workflow, and more using vibe coding.
• 12:23
  SPEAKER_01: But here's the kicker.
• 12:25
  SPEAKER_01: We've been doing this for basically decades now.
• 12:29
  SPEAKER_01: Sure, we haven't used an AI to write code, but again, we aren't really spelling out, we're really spilling out everything for the AI to do.
• 12:36
  SPEAKER_01: What we're describing here is just regular prototyping.
• 12:40
  SPEAKER_01: For every app I have ever built, pretty much, I have created one or multiple test projects where I try out various concepts.
• 12:49
  SPEAKER_01: My hard drive is full of console app 35 and Blazor App 23 and other similarly named projects.
• 12:55
  SPEAKER_01: Those projects are there just for me to test various bits, to prototype something.
• 13:01
  SPEAKER_01: And the difference is that now we can make these concepts even faster.
• 13:06
  SPEAKER_01: It doesn't matter if the prototypes aren't written well or if they don't follow best practices or have error checking.
• 13:12
  SPEAKER_01: You aren't testing for those things.
• 13:14
  SPEAKER_01: You're testing a concept.
• 13:16
  SPEAKER_01: That means that roughing in a bit of testing code to see if something is working the way you expect is a great option.
• 13:23
  SPEAKER_01: And that's a great place for vibe coding.
• 13:27
  SPEAKER_01: Now, just a word of warning.
• 13:29
  SPEAKER_01: Just like with prototypes, be very careful how you show them off or who you show them to or what you do with them.
• 13:38
  SPEAKER_01: Prototypes have a way of accidentally being put into production.
• 13:43
  SPEAKER_01: How do I know?
• 13:44
  SPEAKER_01: Been there, done that.
• 13:46
  SPEAKER_01: Okay, where I write something and say, hey, this is a little bit of code, I think this works, and I try it out, and like, yep.
• 13:50
  SPEAKER_01: And my boss is like, we need to get this now.
• 13:52
  SPEAKER_01: And I've got something working, and he's like, cool, send it.
• 13:56
  SPEAKER_01: And before I know it, that's in production, and it's poorly written code, and it's it's not optimized, and it's not error-checked, and it's doesn't have all the things around to make it a good production code, and yet it's in production.
• 14:09
  SPEAKER_01: And that happens a lot.
• 14:11
  SPEAKER_01: So be very careful of that.
• 14:13
  SPEAKER_01: But then also be careful that you don't set the wrong expectations for management.
• 14:18
  SPEAKER_01: I work with a designer who is excellent.
• 14:21
  SPEAKER_01: Not that long ago, she showed me a prototype for our new website in Figma.
• 14:25
  SPEAKER_01: Using their prototype mode, I could see the entire design as an actual functioning website.
• 14:30
  SPEAKER_01: It was amazing, but also kind of freaked me out.
• 14:33
  SPEAKER_01: And we actually had talk about it.
• 14:35
  SPEAKER_01: I said, hey, before you go any further, I just want to talk this through with you.
• 14:40
  SPEAKER_01: Because I want to make sure that I set you up for success should you ever go somewhere else and work for somebody else.
• 14:47
  SPEAKER_01: I said, you know, this is awesome.
• 14:49
  SPEAKER_01: This website looks amazing, but be careful who you show it to and how you communicate what it is.
• 14:56
  SPEAKER_01: Because if a prototype looks too much like a functioning product, a manager might expect that it can be implemented quickly because it appears done already.
• 15:06
  SPEAKER_01: Okay.
• 15:06
  SPEAKER_01: And really things like Figma start to blur that line because they can output HTML code, right?
• 15:12
  SPEAKER_01: So why wouldn't you just toss that into production?
• 15:14
  SPEAKER_01: It doesn't matter that it's not really optimized, it's not really the best code, it's it's not human readable or not as human readable as it should be, all those other things, because it works.
• 15:26
  SPEAKER_01: So be careful of that.
• 15:28
  SPEAKER_01: Be careful that you make sure it's a prototype.
• 15:30
  SPEAKER_01: There's actually studies that have worked through the idea of how do you show off prototypes?
• 15:36
  SPEAKER_01: Well, and one of the ways that you do that is by showing things that are obviously sketches.
• 15:42
  SPEAKER_01: So that even if you have app designers, and I worked with different app designers, where you could prototype something and it would look like it's a sketch drawing, but kind of quote unquote work.
• 15:54
  SPEAKER_01: So you can kind of show off the process while at the same time making sure it's clear that this is a prototype, not the real thing.
• 16:04
  SPEAKER_01: Okay.
• 16:05
  SPEAKER_01: So you gotta make sure you set expectations carefully when you build a Vibecode app, that you don't have your boss see that and they go, cool, send that to production.
• 16:16
  SPEAKER_01: Don't do that.
• 16:17
  SPEAKER_01: Okay, don't let your Vibecode project set the wrong expectation for yourself or for management.
• 16:24
  SPEAKER_01: So use vibe coding for prototyping, but rebuild it entirely for production, just like I do with my Blazor app 23 or my console app 35.
• 16:35
  SPEAKER_01: All right.
• 16:36
  SPEAKER_01: So vibe coding absolutely has a place in development.
• 16:40
  SPEAKER_01: It absolutely can help us be better and faster as developers, but it's not going to, it should not replace you actually building an application.
• 16:51
  SPEAKER_01: Okay, so thanks for listening.
• 16:52
  SPEAKER_01: And as always, I am Tim Corey.
• 16:55
  SPEAKER_00: Thank you for joining us for this episode of Dev Questions.
• 16:58
  SPEAKER_00: When you're ready to learn to think and code like a professional developer, head over to Iamtimcorey.com and enroll in a course.