Reliability-Driven Requirements And Minimal Data Model
Sources: 1 • Confidence: Medium • Updated: 2026-03-02 19:33
Key takeaways
- A prior presentation workflow was to open a browser window with one tab per web page and advance through the tabs as the deck.
- A new macOS presentation app was built using vibe coding the night before a talk, with the build time described as approximately 45 minutes.
- Present added remote control implemented as a web server listening on 0.0.0.0:9123 that serves a mobile-friendly page with controls for slide navigation and starting/stopping the presentation.
- Using GET requests for state-changing endpoints such as /next and /prev was identified as introducing CSRF vulnerabilities, and this risk was deemed acceptable for this application.
- Present can export and import presentations as a .txt file containing a newline-delimited list of URLs.
Sections
Reliability-Driven Requirements And Minimal Data Model
- A prior presentation workflow was to open a browser window with one tab per web page and advance through the tabs as the deck.
- In Present, a talk is represented as an ordered sequence of URLs editable via a sidebar that supports adding, removing, and reordering items.
- Present includes a full-screen play mode activated via a menu or Cmd+Shift+P, navigated with left/right arrow keys, supports font size adjustments and page scrolling, and exits with Escape.
- Present automatically saves the URL list on every change so that state can be restored after a crash on restart.
- Presenting from browser tabs has the failure mode that a browser crash can eliminate access to the entire deck during a talk.
Ai-Assisted Rapid Native Tool Prototyping
- A new macOS presentation app was built using vibe coding the night before a talk, with the build time described as approximately 45 minutes.
- The app is called Present, is built with Swift and SwiftUI, and is reported to be 355KB in size (76KB compressed).
- The author concluded that Swift was the right choice for building a full-screen macOS app embedding web content with network control, and found the resulting code simple and sufficient.
- The author expects to build more small personal macOS apps in the future and reports no longer being afraid of Swift after this project.
Cross-Device Control Using A Local Web Server And Overlay Network
- Present added remote control implemented as a web server listening on 0.0.0.0:9123 that serves a mobile-friendly page with controls for slide navigation and starting/stopping the presentation.
- After iterative prompting, the remote interface included a slide indicator, previous/next buttons, a large Start button, and font size adjustment controls.
- The remote interface added a touch-enabled thin scroll bar that scrolls the currently visible web page on the presentation screen, and this feature was described as clunky but sufficient for content that loads below the fold.
- Using Tailscale on both laptop and phone enabled the phone to reach the control server via a Tailscale IP without relying on venue Wi‑Fi allowing device-to-device connectivity.
Security And Maintainability Pitfalls In Vibe-Coded Implementations
- Using GET requests for state-changing endpoints such as /next and /prev was identified as introducing CSRF vulnerabilities, and this risk was deemed acceptable for this application.
- A code-auditing workflow was used in which the model was asked for a linear walkthrough of the entire codebase, and this was documented as a 'Linear walkthroughs' pattern in an Agentic Engineering Patterns guide.
- Claude Code implemented the remote-control web server using raw socket programming without an HTTP server library, including a minimal HTTP parser for routing.
- The code was pushed to GitHub with a disclaimer that it was vibe coded and only promised to work on the author's machine, and the author later decided to inspect the code.
Portability And Collaboration Via Plain-Text Interchange
- Present can export and import presentations as a .txt file containing a newline-delimited list of URLs.
Watchlist
- Present added remote control implemented as a web server listening on 0.0.0.0:9123 that serves a mobile-friendly page with controls for slide navigation and starting/stopping the presentation.
- Using GET requests for state-changing endpoints such as /next and /prev was identified as introducing CSRF vulnerabilities, and this risk was deemed acceptable for this application.
Unknowns
- Can an independent builder reproduce the build/run workflow and achieve similar results (including remote control) without prior Swift/macOS ecosystem familiarity?
- How reliable is crash recovery in practice (e.g., what specific state is persisted, and does it restore the active slide and play-mode state consistently)?
- What is the actual security exposure created by binding a control server to 0.0.0.0 and making it reachable over an overlay network, given the acknowledged CSRF vulnerability?
- What code-quality issues exist due to manual socket/HTTP parsing (correctness, input validation, concurrency, resource handling), and what mitigations were applied after inspection?
- How well does the linear-walkthrough prompting pattern work across other AI-generated repositories and other languages/frameworks (coherence, completeness, audit usefulness)?