[Editor’s Note: This is the fourth in a series by Oren Etzioni about AI usage and best practices.]
I’ve been writing code since before most of today’s vibe coding founders were born. So when I sat down to try the latest vibe coding tools — Lovable, Claude code, and the like — I expected a frictionless ride. What I got was a rough detour through systems administration 101.
I want to reassure non-coders: it’s not you, it’s the tools. Vibe coding has a useability problem and a safety challenge — and the first should not be solved without the second.
Andrej Karpathy coined “vibe coding” in a now-famous tweet on Feb. 2, 2025: “There’s a new kind of coding I call ‘vibe coding,’ where you fully give in to the vibes, embrace exponentials, and forget that the code even exists.” That’s the promise; the reality is downright annoying.
Claude code wouldn’t run on my machine until I sorted out PATH variables. (If you don’t know what a PATH variable is, that’s exactly the point of this essay.) When I moved to Lovable to spin up a website, it asked me, almost immediately, about secrets and keys. I knew what it meant — and I knew what to do with them, which is its own kind of safety net. But what about a small business owner who wants to build an inventory tool for their shop? What about my mother-in-law?
What vibe coding needs is its Windows moment — the point at which a powerful but arcane technology gets a user interface so good that the machinery underneath disappears. Before Windows (and the Macintosh before it), using a personal computer meant typing obscure commands at a DOS prompt. Of course, Windows also opened the door to a flood of viruses. Vibe coding needs to get the on-ramp and the seat belts right at the same time.
Today, first-time vibe coders encounter The Great Wall of Jargon. In the first 10 minutes of trying to vibe-code a simple website, I encountered the terms: secret, key, API key, token, environment variable, .env file, shell, terminal, command line, CLI, PATH, localhost, port, 127.0.0.1, repo, clone, commit, push, Node, npm, dependency, runtime, build, IDE, deploy, deployment, production. Each is a tiny door I had to find the key to. None is about what I wanted to build. Novices are being asked to learn a foreign language before they get to say “Hello World.”
Justine Moore, a partner at Andreessen Horowitz who wrote the go-to piece on this usability barrier to vibe coding earlier this year, admits her own success rate on vibe coding projects is roughly 50-50.
“I spend a lot of time dragging screenshots and copying error messages into Cursor and asking for help,” Moore writes. If the people whose job it is to invest in this category are squinting at the screen, the audience that vibe coding was supposed to liberate is also struggling.
The data backs this up. Stack Overflow’s 2025 Developer Survey of more than 49,000 developers found that, when asked about vibe coding, 77% said it is not part of their professional work. These are the professionals — the people for whom this should be easiest.
And among the audience that should benefit most, the picture is no better. Bubble, a visual-development platform with an obvious competitive interest in the answer, surveyed 793 builders who had tried both visual development and vibe coding tools and found that 90.6% stuck with visual development while only 25.6% stuck with vibe coding.
As Moore put it: “Right now, vibe coding is a spectator sport for most of America.”
The vibe coding companies know this and are working on it. Replit’s one-click deploy is the closest thing in the current generation to that Windows moment — you hit “publish” and your app exists at a URL, no shell, no configuration, no Node install. But this is the exception, not the rule. Cybersecurity, too, is still up to you — a gap that the next generation of vibe coding platforms will need to close.
What the on-ramp needs to look like is clear enough. Zero setup. Nothing to install. No keys to manage; the platform handles credentials behind the scenes. No separate deployment step; when you’re done, the thing exists at a URL, full stop. Sensible security defaults baked in, not opt-in — because an on-ramp without guardrails is worse than no on-ramp at all.
None of this is easy. Hiding the machinery requires solving real problems — credential management, sandboxed execution, automatic deployment — that are genuinely hard. But hard problems are exactly where startups are born.
Moore ends her piece with a powerful observation: every Unix command, as Matt Rickard noted years ago in a much-quoted essay, eventually becomes a startup. Squarespace did it for websites. Canva did it for design. The company that does it for vibe coding will do something at least as big. The on-ramp is missing. Whoever builds it will turn a craft that today requires patience and perseverance into something that millions of people can do in their spare time. But getting there will require more than the on-ramp.
An on-ramp gets you on the road. It doesn’t teach you how to drive. As non-coders ship more home-grown apps, we can expect some accidents — even dangerous ones. The Tea App, an app meant to help women stay safe on dates, was reportedly built largely with vibe coding; its creators stored 72,000 driver’s-license photos in a wide-open database. They were not bad people, but they didn’t understand cybersecurity.
The next generation of vibe coding platforms should refuse to ship an app with a wide-open database the way a modern car refuses to shift into drive when your foot isn’t on the brake — automatically. For lesser sins, like the software equivalent of an unfastened seatbelt, the platforms should chime until you fix the problem.
The Windows moment we need isn’t only an on-ramp. It is an on-ramp with best practices baked in.
Read more of Oren Etzioni’s views on AI:
[Editor’s note: GeekWire publishes guest opinion pieces representing a range of perspectives. The views expressed are those of the author.]
Read the full article here
