DEV Community: Ikrame Ibn Hayoun

Vibecoding met 34-year-old railway software

Ikrame Ibn Hayoun — Thu, 05 Nov 2026 15:30:00 +0000

TL;DR. After Urda, a four-hour Renfe map went viral beside 34-year-old signalling. We have reached an inflection point where a finished-looking demo can be believed as a real product, even next to safety-critical infrastructure.

What "legacy" means on a high-speed line
What Vía Libre actually did
The inflection point vibecoding just hit
What the criticism actually said
Human error or system error, through a legacy lens
What juniors should take away
Sources

On 28 October 2026, a Renfe AVE collided with a stationary Iryo train near Urda, in Toledo, Spain. Sixty-nine people lost their lives. My thoughts are with their families and with everyone affected. The investigation is still open, and nothing written here treats any cause as settled.

Two days later, a different story went viral. Álvaro Hernández published Vía Libre, a web map of Renfe trains built in about four hours from public GPS data. Colours marked delays. Screenshots travelled faster than the nuance.

Those two stories sit on the same week for a reason juniors keep hitting at work: legacy systems look slow and ugly until you learn why they are hard to change, and AI has made it so easy to ship something that looks finished that people can believe a demo can stand in for a real product.

This piece uses Urda and Vía Libre to hold both ideas at once, with Vía Libre as the heaviest example of that belief so far.

What "legacy" means on a high-speed line

The Madrid-Seville AVE corridor still runs under LZB (Linienzugbeeinflussung), a German continuous train-control system installed for the line's opening in 1992. That is 34-year-old railway software still sitting in the safety path.

In plain words, the track and the train keep talking so the system can supervise speed and brake automatically if needed. When LZB drops, traffic can fall back to BSL (bloqueo de señalización lateral: the side signals that organise blocks of track) with ASFA as onboard protection that reacts when the train passes beacons. That stack is old, layered, and certified for lives, not for demos.

Press coverage after Urda repeated the same timeline: LZB arrived because Europe's later standard, ERTMS, was not ready in 1992; Adif has been migrating Madrid-Seville to ERTMS Level 2; the physical work finished, but putting the new system into service still needs tests and authorisation from the rail safety agency.

A railway signalling engineer told La Tribuna de Ciudad Real that LZB gear is robust and near the end of a useful life of about three decades. The former head of the State Agency for Railway Safety had already called LZB obsolete in the Senate weeks before the crash. Replacement is underway. It is not a git merge.

On top of that world sits a thinner layer: Renfe's open data, including near-real-time vehicle positions in GTFS-RT, updated every 15 seconds for AVE and long distance (20 for Cercanías), under a CC BY 4.0 licence. That feed is for passengers and builders. It is not the signalling stack. Confusing the two is how vibecoding stories start.

Layer	What it is	What it is not
Signalling (`LZB` / `ERTMS` / `ASFA`)	Safety path that supervises speed, routes, and braking	A passenger map
Open data (`GTFS-RT`)	Public positions for builders and riders	A control desk or safety case

What Vía Libre actually did

Álvaro said he wondered how long a Renfe monitor would take, noticed that each train's GPS position was public, and had something working in three to four hours. Vía Libre plots Renfe services on a map of Spain with a delay semaphore and Adif incident notices on one screen.

Screenshot of Vía Libre. Source: El Español / Omicrono, 30/10/2026.

Mobile view of Vía Libre shared on X, 30/10/2026. Post: x.com status 2116271528396677542.

That is a real win for open data and for fast prototyping. Anyone can see how far a public feed plus a clear UI can go in a morning.

It is also where the new risk starts: a browser reading GTFS-RT does not supervise braking curves, does not interlock routes, and does not carry a safety case, yet it can look finished enough that people treat it as more.

Screenshot of Álvaro Hernández's original thread, reshared on X, 31/10/2026. Post: x.com status 2116679379468120546.

The inflection point vibecoding just hit

Vibecoding means asking an AI for code and shipping what comes back while it "feels" right, without owning the failure modes. Readers already know a four-hour map cannot retire LZB or finish ERTMS. That part is settled.

What is new is the inflection. AI has made it cheap enough to ship something that looks finished that a builder, or an audience watching screenshots travel, can honestly believe a demo-grade build can stand in for a real product. Not as a joke: as something that could run in a real business, or sit next to a system people already trust.

Most vibecoding stories stop at a SaaS landing page or an internal tool. Vía Libre is the heaviest case yet, because the thing it seemed to rival, in the public conversation after Urda, was safety-critical railway infrastructure.

That belief is the new risk. A map that paints delays in green, yellow, and red looks like monitoring. Screenshots travel like a product launch. The speed of the build can read as proof that the old stack was optional. None of that turns an open-data viewer into a control system, but the look of finish is strong enough that people can confuse the layers without trying.

Why legacy stays slow

Legacy railway systems stay slow to change for boring, expensive reasons:

Safety certification. Every real change has to be re-tested and signed off before passengers ride on it. Think of a release process where "ship" means an outside auditor stamps the build, not a green CI job.
Interlocking. Trackside logic that stops two trains from claiming the same block of track at once. Like a lock or mutex on a shared resource, except the resource is a stretch of rail and the failure mode is a collision.
Layers added after earlier incidents. Extra checks and fallbacks piled on over decades. Like patches nobody wants to delete, because nobody is sure which one still holds a crash path shut.
Ageing kit and scarce spares. Gear from the early 1990s eventually leaves the vendor catalogue. Replacing a board is not npm update; it can mean hunting a part that is no longer made.
Testing on a live corridor. A lot of the real proving has to happen on the actual line, often at night when passenger trains are not running. You cannot spin up a full high-speed clone in staging.
AESF authorisation. Spain's State Agency for Railway Safety (AESF) has to authorise bringing a new or changed structural subsystem, including signalling, into service. Until that file is approved, the new stack does not carry passengers, no matter how ready it looks on paper.

That cost does not disappear because a morning build looks polished.

Álvaro drew the line himself. As quoted by El Español and La Razón, he did not want Spanish trains controlled by a "Paco-APP" built in a morning. His point was about political will to use what already exists for safety, not about swapping signalling for a weekend build.

Fair enough. The case still matters as evidence of the inflection: if even a careful builder's demo can travel as if it answered a railway, then the bar for "looks ready" has moved.

A four-hour map like this can still prove the feed is readable, shame bad UX, and start a useful argument about transparency. Keep those. What changed is the gap: "looks finished" and "is a product" used to be obviously far apart. Vibecoding shrank that gap enough that the belief is now part of what you have to manage.

What the criticism actually said

The pushback around Vía Libre clustered into a few themes. No need to pile onto individuals.

I do not question Álvaro's good faith in trying to help or put another solution on the table. Most of the criticism came from the sense that he had underestimated the infrastructure. My own take is milder: I think he simply had not informed himself well enough before framing it that way.

Already existed. People said the map was not new: Renfe already had an official real-time viewer, and other private trackers existed. Putting open data on a map is not inventing the railway.
Front end, not signalling. Others said it was mostly a nicer front end on a feed Renfe already publishes: useful to look at, not a monitoring or signalling product. A passenger map is not a control desk.
Read the numbers. A third theme was about reading the numbers. Public feeds can lag or fail. Some trains are estimated from the timetable. Press pieces noted that "real time" on the site animates between updates, that operators such as Iryo and Ouigo are missing from that feed, and that the famous 93-of-119 delay count was one snapshot on a drivers' strike day, not an official punctuality score for the whole network.

There was praise too. People shared the site as a clear way to see delays, and some welcomed an independent view while still saying it should not replace the operators.

Official Renfe viewer (tiempo-real.largorecorrido.renfe.com). Source: Railway Gazette, 12/03/2026, Renfe screenshot.

Human error or system error, through a legacy lens

After Urda, public debate often split into "human error" versus "system error." Through a legacy lens, that split is too thin.

What official sources and the press have established so far:

Around 08:30 the LZB failed on that stretch.
The control centre authorised the AVE to run under "marcha normal" instead of "marcha a la vista", which caps speed at 40 km/h when you are running with degraded protection.
The preliminary report from AITAT, the body that investigates accidents, talks about a "chain of failures, instructions and actions" without the needed safety barriers kicking in.
The technical and judicial investigations are still open. Every hypothesis still is.

There is a human decision in that chain. That it is the cause is not proven. Investigators also look at maintenance, protocols, and why backup layers did not stop the train.

That is how you read a decades-old stack: a person acts inside procedures, fallbacks, and machines that age. Naming one person without the chain is the same mistake as celebrating one map without the stack.

In software we call the careful version a blameless postmortem: after an incident, ask which layer was missing, not only who typed the command. People fail. Good systems assume that and put nets underneath.

Legacy railways already try to do that with continuous supervision, side-signal fallback, and automatic braking. When those nets tear, the lesson is to repair and replace the nets with the same seriousness that certified them, not to pretend a dashboard could have held them.

What juniors should take away

If you are early in your career, this week is easy to misread. Either "one app exposed the state" or "one person's mistake caused the crash." Neither is enough.

Treat open data as a gift with limits. Credit the licence. Show how old each value is. Decide what the UI does when the feed dies.
Respect legacy before you rewrite it. Ask what certification, interlocking, or incident history made it look "ugly."
Use AI to learn and prototype. Notice when a finished-looking demo starts to feel like a product, to you or to your audience.
When something breaks, look for the chain: inputs, fallbacks, monitoring, human procedures, and the layer that should have caught the mistake.
Say out loud what your weekend build does not do. That sentence is part of the product, especially when the screenshots travel faster than the caveat.

Vía Libre shows how fast a readable view can appear when the data is public, and how easy it is now for that view to travel as if it answered more than it does. Urda shows why the systems underneath move on a different clock.

The useful junior skill is not dismissing legacy, and not treating vibecoding as a shortcut past it. It is learning to read both, and to name the gap between a finished-looking demo and a product that can carry real trust.

Sources

Full source list

El Español / Omicrono, 30/10/2026: Álvaro, creator of an app that monitors Renfe trains
La Razón, 30/10/2026: A young developer builds a train-monitoring app in one morning
Pulso Diario, 30/10/2026: What Vía Libre shows, and how to read the delays
Diario de Alicante, 30/10/2026: New site to check Renfe delays
Renfe Data: AV, LD and MD vehicle positions and Cercanías vehicle locations
Renfe, March 2026: Renfe launches a real-time train location site
Railway Gazette, 12/03/2026: Renfe displays Spanish trains in real-time map
Maldita.es, 28/10/2026: Q&A on the Urda accident
laSexta, 29/10/2026: AITAT preliminary report
RTVE, 31/10/2026: Open questions on the Urda accident
Ministry of Transport: Case 146/2026
elDiario.es, 29/10/2026: How the safety systems that failed at Urda work
The Conversation, 30/10/2026: How railway safety systems work in Spain
El Economista, 30/10/2026: LZB, ERTMS and ASFA after Urda
El Correo, 29/10/2026: Former AESF president on LZB as obsolete
La Tribuna de Ciudad Real, 4/11/2026: LZB robust but near end of useful life
El Periodico, 2/11/2026: ERTMS replacement delayed into 2027, AESF authorisation still required
AESF: Entry into service of subsystems
RTVE, 29/10/2026: Why LZB on Madrid-Seville had not been renewed yet
X discussion examples (already existed / frontend not safety / data limits / praise), late Oct to early Nov 2026: 2116074935634346370, 2116463739444531578, 2116489069060632896, 2116178060282146857, 2116227374568165831, 2116505621814001743, 2116499955829338210
Forum summary, 30/10/2026: Burbuja.info, Vía Libre thread

[Boost]

Ikrame Ibn Hayoun — Wed, 07 Oct 2026 00:46:14 +0000

Relates social burnout to API rate limits

Ikrame Ibn Hayoun

Sep 23

An introverted dev in an extroverted world

#watercooler #career #networking #discuss

2 min read

An introverted dev in an extroverted world

Ikrame Ibn Hayoun — Wed, 23 Sep 2026 12:02:12 +0000

"Explain it to me in dev terms."

My social battery has a rate limit.

The world isn't made for introverts: it's configured with extrovert defaults. I realized that as a teenager, and it completely changed the way I saw everything and interacted with people.

As strange as it sounds, realizing it made me more awkward, not less. Before, I simply talked, stayed quiet, left when I got tired. Then I started analyzing myself in every conversation, and analyzing everyone else too. Maybe that's where my overthinker side began: the constant monitoring consumes more resources than the interaction itself.

Being aware that I'm an introvert has also helped me manage myself much better: I know my rate limit, I know I recharge alone, and I no longer see it as a bug. I came without documentation, so writing my own manual has taken me years.

Every time I walk out my front door, I carry the reminder with me: this world was built for a group of people that I don't belong to.

But wait, this isn't sad or a bad thing. Keep reading, will you?

Even my interactions on social media feel more controlled. Social media is literally the place where you can be the freest version of yourself, and yet I still don't really post, speak up, or join in that much. I behave almost exactly as I do in real life.

And you might be wondering: what does any of this have to do with being a developer? The truth is, the point I wanted to get to is networking. Especially in tech, I keep coming across people who are incredibly talented and just genuinely cool and kind. But I never get much further than the impulse to reply to one of their tweets or add a comment, let alone talk to them directly. And don't even get me started on events like hackathons.

And honestly, I'm not shy. In fact, once I feel comfortable, I might just yappear non-stop about the interests i'm disgustingly well versed in

Don't get me wrong: this isn't a complaint, and I'm not saying I'm uncomfortable being an introvert. Quite the opposite. I've always been someone who prefers to listen and observe, and not step in more than necessary. But I don't know, sometimes introverts get these sudden urges too. Sometimes we want a little while to role-play as extroverts.

I don't know whether finding out was a gift or a burden; I suppose that, like almost everything, it was both at once.

In Spain, informal plural is vosotros. In Latin America it simply doesn't exist - they use ustedes instead. An agent that mixes both in the same interface instantly reads as machine-translated to millions of native speakers.

The vocabulary minefield

In Spain you use an ordenador and a móvil. In Latin America it's a computadora and a celular. Neither is wrong - but picking the wrong one for your market makes your product feel foreign.

English has the same problem

colour vs color is the obvious one, but it goes deeper: in British English licence is the noun and license is the verb; American English uses license for both. A Brit writes a CV and lives in a flat on the ground floor; an American writes a resume and lives in an apartment on the first floor - which is a different floor entirely.

Dates silently lie

04/05/2026 is April 5th in the US and May 4th almost everywhere else. All-numeric dates are a bug factory when content crosses markets.

The "aterrizar" incident

A website for foreigners moving to Málaga got "landing in Málaga" translated as "aterrizando en Málaga". And here's the thing: it's not exactly wrong - "aterrizar" does mean "to land". The problem is that no Spaniard would ever say it like that. Someone from Spain would say "mudarse a Málaga" or "trasladarse a Málaga", because that's how people actually talk about moving to a city. "Aterrizar" is what planes do 🛬.

That's the gap in a nutshell: the model produced a dictionary-correct translation that sounds robotic to every native speaker it was meant for. It had full context and still went word-by-word.

Why does this happen to AI agents?

Because translation is a word-level task and localization is a context-level one. Agents default to the statistical center of "Spanish", which is really a blend of twenty countries. They merge conventions from different locales, translate placeholders and ICU messages that should stay untouched, and guess when they should ask.

So I built an agent skill that forces the right behavior:

A dedicated reference guide per locale (en-GB, en-US, es-ES, es-419). Never borrow conventions from a neighboring locale - that's exactly how the vosotros/ustedes mixing happens.
Context before words: the agent reads the page, the component and the user journey before resolving anything ambiguous. That's how "landing" becomes "tu nueva vida" instead of "aterrizando".
Structural safety: keys, placeholders, ICU messages, HTML tags and links stay untranslated. A Python guard diffs JSON catalogs and catches missing keys, type drift, broken placeholders and mojibake:

python scripts/locale_guard.py en.json es.json

npx skills add ikrame-ih/english-spanish-web-localization

ikrame-ih / english-spanish-web-localization

Context-aware EN↔ES web localization (en-GB/en-US/es-ES/es-419). Offline locale_guard; benchmarks pending.

English–Spanish Web Localization

English · Español

English

A reusable agent skill for context-aware, bidirectional localization of websites and digital products across four deliberately separate locales:

Locale	Target variety
`en-GB`	British English
`en-US`	US English
`es-ES`	Spanish for Spain
`es-419`	Broad Latin American Spanish

Offline package checks pass (VALIDATION.md). Instant mini-proof: benchmarks/results/instant-mini-2026-09-10/. I checked these myself; the full 30-case blind review is still ahead. Portfolio and external paired scores are still pending. Not for certified/sworn, legal, medical, or financial translation. Does not promise universal ATS compatibility.

This is not a word-replacement prompt. It treats copy as part of a product journey and evaluates meaning, audience, market, interface function, terminology, accessibility, SEO, layout constraints, and technical integrity before selecting a target formulation.

It also applies that standard outside a webpage: portfolios, CVs, Markdown, documentation, emails, forms, CMS exports, and locale catalogues. The format changes the checks, not the required…

View on GitHub

Built for my own workflow, published in case it saves someone else a few "aterrizar" moments. What's the funniest literal translation you've caught an LLM producing?

[Boost]

Ikrame Ibn Hayoun — Sun, 06 Sep 2026 10:47:24 +0000

Ikrame Ibn Hayoun

Aug 5

I kept seeing the same Git complaint on Reddit, so I wrote a small CLI for it

#python #git #opensource #development

2 min read

[Boost]

Ikrame Ibn Hayoun — Sun, 06 Sep 2026 10:40:52 +0000

Ikrame Ibn Hayoun

Aug 8

The blurry line between junior and mid-level, from an AI-era developer

#discuss #ai #programming #webdev

2 min read

DEV Community: Ikrame Ibn Hayoun

Vibecoding met 34-year-old railway software

Contents

What "legacy" means on a high-speed line

What Vía Libre actually did

The inflection point vibecoding just hit

Why legacy stays slow

What the criticism actually said

Human error or system error, through a legacy lens

What juniors should take away

Sources

[Boost]

An introverted dev in an extroverted world

[Boost]

[Boost]

[Boost]

[Boost]

[Boost]

[Boost]

Translating vs Localizing: what LLM agents get wrong about Spanish (and how I fixed it with a skill)

The plural you

The vocabulary minefield

English has the same problem

Dates silently lie

The "aterrizar" incident

Why does this happen to AI agents?

ikrame-ih / english-spanish-web-localization

Context-aware EN↔ES web localization (en-GB/en-US/es-ES/es-419). Offline locale_guard; benchmarks pending.

English–Spanish Web Localization

English

[Boost]

[Boost]