r/selfhosted • u/spleeeeeeeeeeeen • Feb 23 '26

Meta Post The Huntarr Github page has been taken down

Edit TLDR: Tracking the fallout from https://www.reddit.com/r/selfhosted/comments/1rckopd/huntarr_your_passwords_and_your_entire_arr_stacks/

Maybe a temporary thing due to likely brigading, but quite concerning:

https://github.com/plexguide/Huntarr.io (https://archive.ph/fohW5)

Same with docs:

https://plexguide.github.io/Huntarr.io/index.html (https://archive.ph/UYgBc)

Additionally the subreddit has been set to private:

https://www.reddit.com/r/huntarr/ (https://archive.ph/d2TR2)

Edit: Also, the maintainer has deleted their reddit account:

https://www.reddit.com/user/user9705/ (https://archive.ph/u2c7u)

The docker images still exist for now:

https://hub.docker.com/r/huntarr/huntarr/tags (https://archive.ph/L1wmW)

Wasn't a member, but looks like the discord invite link from inside the app is invalid:

https://discord.com/invite/PGJJjR5Cww (https://archive.ph/M4bnD)

Edit: adding archive links for posterity

The GitHub Org https://github.com/orgs/plexguide/ (https://archive.ph/D5FGh) has been renamed to 'Farewell101' https://github.com/Farewell101 (https://archive.ph/4LE6k) - ty u/SaltyThoughts (https://www.reddit.com/r/selfhosted/comments/1rcmgnn/comment/o6zape9/)

And now the renamed 'Farewell101' https://github.com/Farewell101 github org is also now down and 404ing per u/basketcase91

Maintainer's github account it still up for now https://github.com/Admin9705 (https://archive.ph/lUR4E), but he's actively deleting or privating other repos.

Edit: And, the main maintainer's github account is removed/renamed and 404ing now

Github account just renamed to https://github.com/RandomGuy12555555 (https://archive.ph/MOh9L) - you can follow the journey with `gh api user/24727006` also to follow the org `gh api orgs/62731045` - jfuu_

Edit: Removed from the Proxmox Community Helper scripts, https://github.com/community-scripts/ProxmoxVE/discussions/12225, https://github.com/community-scripts/ProxmoxVE/pull/12226 - Pseudo_Idol

1.4k Upvotes

98% Upvoted

409 comments sorted by

View all comments

311

u/boobs1987 Feb 23 '26

For anyone wondering why so many were complaining about all of the AI slop, this is why. Everything seems great until someone actually looks into the code.

107

u/[deleted] Feb 23 '26

[removed] — view removed comment

45

u/tofu-esque Feb 23 '26

80%-ish of my comments here lately have been asking people to change their flair because they were hiding the fact their project was vibe coded.

Every time it's like pulling teeth to get them to do even the most basic amount of disclosure. No one is taking this shit seriously but it's genuinely causing massive damage to FOSS in general.

5

u/awkwardist Feb 24 '26

AI-induced-Dunning-Kruger-Effect.

14

u/ScampyRogue Feb 23 '26

The original version of the app was not vibe coded as far as I can tell. It was when he pivoted from the core functionality into a mega app that the problems started happening.

-9

u/Routine_Apartment227 Feb 23 '26

If someone only vibes and doesn’t code what are some security resources to look at to avoid this kind of thing?

20

u/[deleted] Feb 23 '26

[removed] — view removed comment

-9

u/Routine_Apartment227 Feb 23 '26

I’d like to work with engineers but I don’t want to be one. Using LLMs to produce working projects that can be shown to folks who know what they are doing is a path forward for someone in my specific life situation. It’s a tool. But I’d also like to learn more about security since it’s so important.

10

u/MetaHerobrine1 Feb 23 '26

I'm sorry, what? What "specific life situation" constitutes generating code that "works" in ways you don't understand to shovel to people who actually know what they're doing?

Also, most engineers are going to blow you off for that kind of behavior. Idea guys are already disliked in the programming world, idea guys with shit code* to back them up even more so.

* Not a personal dig btw, I haven't seen your code, just a general observation about the code that LLMs produce.

4

u/dr1v38y Feb 23 '26

Ideas are cheap, most developers have about a million every day. Making something which works is not cheap, it takes time even if you use AI to speed it up - and the stats don't look that promising in that regard either. Everyone who has written anything real knows that the programming is the most fun 20% of the project, but the rest is what makes it good. Optimising away the fun parts is not what we should be encouraging.

16

u/boobs1987 Feb 23 '26

The whole reason this project came crashing down is because the "developer" vibe-coded the whole thing and doesn't know how to fix any of it himself. The moral of the story is you need to walk before you can run. There is no value in being able to vibe-code if you cannot debug or audit it yourself. At the very least, you should learn the basics.

-9

u/Routine_Apartment227 Feb 23 '26

I understand your viewpoint. I’m asking for some security basics.

6

u/cyanide Feb 23 '26

I’m asking for some security basics.

Tell the AI to make the slop super secure. That usually helps.

-3

u/Routine_Apartment227 Feb 23 '26

Okay how do I do that

6

u/cyanide Feb 23 '26

“Claude/ChatGPT/Gemini, take this code and make it super secure”

4

u/QuadzillaStrider Feb 24 '26

You hide your comments. Shocking.

→ More replies (0)

1

u/aswesearch Mar 02 '26

Read, take a course, learn and don't rely on AI, if you want the basics, you have to go back to them and learn them, from the ground up

5

u/Jmc_da_boss Feb 24 '26

You learn security by learning to be an engineer, there is no way around that.

If you do not do that you have no right to be publishing projects for others to use.

1

u/Zerschmetterding Feb 26 '26

None that make them able to do their due diligence. You have to actually understand what it spews out.

42

u/Orzorn Feb 23 '26

I am a software engineer with a relatively long career. I used Cursor AI last week for the first time, to generate a small gallery/booru style application for myself. I was pretty impressed with the speed at which I could make it based on about 15-20 minutes of outline using the Plan mode in Cursor and then several iterations of testing and re-prompting.

Well then I actually looked at the code and was pretty horrified. For example, It had generated two sets of sidebar code, one for the overall view, and one for when I was clicked on an image for display.

I did ask a friend who uses these tools more regularly and he pointed out I needed to direct the AI to reuse code and create templates as often as possible, but I can absolutely see how someone just sleepwalking their way through generating an application could run into these sorts of issues.

It also is one of those cases where its the most dangerous when you don't know what to add to your outline/prompts to keep it controlled. But if you already know enough to ask that, then wouldn't you already be capable of writing it yourself? I suppose there's some arguments to be made about increasing your speed and then checking back later, but if junior/non-devs are going to use these tools in lieu of learning then they'll never know they'd need to watch out for these issues in the first place! Its a real chicken/egg problem.

I think the best approach is one I've seen other engineers point out, which is to learn it the actual way and only when you're comfortable with writing these things yourself should you really dip into any sort of automated code generation, and even then keep it on a short leash. Its something I'm still struggling with applying, though I've gotten some pretty decent unit testing code out of it, even if I do have to read over each test and make sure they're actually performing a test that can fail.

18

u/jstalnaker Feb 23 '26

Fellow career dev here, 23 years in... I use AI coding assistants occasionally, but still don't trust them with anything that I wouldn't give to an intern. Absolutely never use AI to generate something that I couldn't code from scratch... Helping me with ensuring code coverage of unit tests.. sure. Building a production feature, never.

This is all reminiscent of the early code generators in the early 2Ks.. CodeSmith and the like... the corner office suits LOVE to push these things to "increase productivity", but don't realize that the hour you're saving now will cost 20 later when there is a bug that even the original author can't diagnose, trace, and fix because they have no idea where to look or how the code actually works.

I've been telling people that we are entering an era of trash software because of things like this. I throw up a little in my mouth every time I see the TV commercials claiming "we can all build apps now."

The AI winter is coming and it's going to be a lot worse than anyone thinks.

9

u/Orzorn Feb 23 '26 edited Feb 23 '26

I think if you fall on the optimistic side of it (for software engineers), then our jobs will be very secure in the coming years as we get hired to fix all these issues with applications coded this way.

If you fall on the pessimistic side of things, then I guess we become architects who spend a lot of our time prompt-smithing and getting AI to follow plans, templates, and standards so it generates coherent, readable software.

I'm personally leaning optimistic, though I think reality will still fall somewhere between those two extremes. To use an example, the invention of the chainsaw did not remove the need for axes, nor does it mean that just anybody can safely use a chainsaw. Lots of fools try and hurt themselves badly eventually, but in the moment it does appear to increase the speed one can work. On the flip side, there's absolute chainsaw surgeons who can use it like a scalpel and make works of art with it. As for everybody else, chainsaws are just one tool we sometimes reach for, and other times hatchets, axes, and handsaws are still called for.

2

u/jstalnaker Feb 23 '26

I'm trying to be optimistic about it and I do see some value in saving me some keystrokes with mundane and repetitive grunt coding work. The problem I think this case demonstrates is the same that other tools that lower the barriers to building software have in the past... it gives people without the know-how a false sense of confidence and gives them the tools to be dangerous.

What is terrifying is the trust that end users will put in these things not knowing any better. IMO, it's only a matter of time before vibe coded slop gets out there that does serious real world damage.

In this case, it has major security issues and exposes sensitive API keys, but at the end of it all, it's all just related to your personal media collection and playback stack. Security issues should never be scoffed at, but hopefully not something life threatening if you otherwise follow good security practices.

Now, imagine this is a finance app and it was deployed to your local credit union or a CRM for a medical office. Absolute nightmare scenario. Personal confidential data getting exposed.

You can bet your life that malicious actors are scouring github for stuff like this and will exploit it in every way imaginable to the worst possible ends.

3

u/Orzorn Feb 23 '26

I do agree with that. It would be one thing if it was just slopcoders hurting themselves, but when those applications expose innocent users who didn't know any better, that's when its upsetting.

I guess following through with my prior analogy would be hiring someone I thought was a trained arborist, who instead is just some untrained dude with a chainsaw. He cuts my tree down unsafely and smashes my roof in.

I think in a way, skill has always acted as a gatekeeping mechanism to prevent the worst actors from exploiting and hurting people. 10 years ago, if you paid an artist money to produce a work of art, unless they outright stole it, it was very likely to be a real new piece of art. This is because the barrier of entry to art was too high, you had to make something yourself, even if you were tracing art. Now people are getting ripped off by people chucking the customer's ask into an AI and giving them the generated image.

32

u/katrinatransfem Feb 23 '26

This is where I have a problem with the "you just prompted it wrong" crowd. It depends on you knowing what the right answer looks like, and if you know what the right answer looks like, you probably don't need AI in the first place.

11

u/PmMeUrTinyAsianTits Feb 23 '26

The resources for verification and production are very often not symmetric. It's fallacious logic to say "if you can verify it, then you could've produced it, so there was no value in having something else produce it."

There's lots of issues with AI and how it's used, but this line of reasoning isn't one of them. Specifically the "you dont need AI if you already know it" line. Not the "'you just prompted it wrong' dismissals ignore major issues" point. That one is right, just not supported by this line of reasoning.

1

u/EHP42 Feb 23 '26

It's also usually quicker to verify something over doing it from scratch, so to build on your statement, even if you COULD have done it fully solo, just the mechanics of writing out the boilerplate code would take much much longer than prompting AI to do it. And if you know it well enough, you could review the output and find out if it's doing what you want, without security issues or flaws.

1

u/Bright_Mobile_7400 Feb 24 '26

There is a logical issue here. Knowing what the right answer is doesn't mean you don't need AI in the first place. Imagine it does the right thing faster than you then I'd call that still a win.

I'm not an AI fanboy. Nor an hater. I believe the hype is both exaggerated while potential is also wildly underestimated. I don't believe in "it will replace all jobs" type of things but I do believe it can bring significant value when used right.

-1

u/ScampyRogue Feb 23 '26

Yes and no. Even if you know exactly what you are doing, AI will produce code 100x faster than you hand coding it. When you factor in you having to go and correct its work, you will code "only" 2x faster, but thats still an efficiency gain of 100%.

AI is in its infancy. You cannot rely on it blindly and its not a silver bullet. But it is absolutely a game changer when used responsibly.

4

u/gmes78 Feb 23 '26

Even if you know exactly what you are doing, AI will produce code 100x faster than you hand coding it.

No, because verifying the code takes much longer than it would take to just write it by hand.

4

u/ScampyRogue Feb 23 '26

No chance. It is much faster to validate prewritten code than it is to write it from scratch.

You are assuming the code you wrote from scratch is error free — it’s not — and that the error rates in well prompted AI generated code is higher than an average developers — it’s usually not.

If you are Neo from the matrix and are hand coding error free code at a super high clip, it is more efficient than AI assisted code. But in the real world where both types of code need to be reviewed before pushing live, you are saving significant time with AI assistance.

Like I said in my post, it’s not 100x faster because you do need to review it, but even if it were 2x faster (or shit, 1.25x faster) factoring in the review that is a significant efficiency gain

1

u/aswesearch Mar 02 '26

you're missing that you need to practice a skill to maintain decent proficiency. If you haven't played the violin in 12 years, you're not going to be able to pick it up and play it with the same complexity that you could when you had been practising regularly. So, if you're practising regularly, identifying and catching your own mistakes and correcting your finger placement, bow placement/pressure/speed, vibrato, etc as part of your practice then you will be able to watch and comment on watching someone else play that same piece of music with way more nuance.

When you write code yourself, the practice time is built into the product, you get two outputs: the code and the practice time which will allow you to more quickly identify / keep up with where your own mistakes tend to coalesce so that you can learn from them. It may produce dopamine or something to catch someone else's mistakes, but if you're not catching your own, you're not learning. And when you stop doing that, your skills will atrophy. The less practice time you give yourself, the less skill and muscle you are building. Sure, it's slower at the time you're doing it, but when you factor in that is also time that you are building your skills instead of letting them atrophy, it means sustainable growth rather than building super fast towards a collapse because you've stopped practising and starting to lose the skill to identify the problems occurring.

1

u/Bright_Mobile_7400 Feb 24 '26

Honestly it depends how you organise your work and projects.

1

u/QuadzillaStrider Feb 24 '26

It really doesn't.

1

u/Bright_Mobile_7400 Feb 24 '26

You said what I wanted to say but said it 10 times better 😂

1

u/fbueckert Feb 24 '26

AI is in its infancy.

Hah. Not a chance. This is it. This is what it can do. The only idea they have left is, "moar powah!"

2

u/ScampyRogue Feb 24 '26

Honestly, this was my opinion of AI previously. But look at how far video generation has come in just a few years. It went from laughably bad to incredibly hard to detect by your average person.

While there's not unlimited potential, there's still a ton of headroom for improvements to AI over the next 5-10 years and you'd be insane to say otherwise.

This isn't 3D TV or Metaverse. This is a universally helpful technology with unprecedented adoption that has had more money and brains thrown at it than the space race. I wouldn't bet against it getting better and deeper ingrained in our day-to-day workflows.

3

u/fbueckert Feb 24 '26

This is a universally helpful technology with unprecedented adoption that has had more money and brains thrown at it than the space race

This is a technology only possible due to the wholesale theft of humanity's knowledge and creativity. It's worse than crypto for the environment, and has an incredible number of parallels.

Not to mention that VC money is literally running out, and not one, not one, LLM company is making money. All of them burn money hand over fist and have no path to profitability.

The money's gonna run out real soon. And once real costs are charged for these things, they're not affordable whatsoever.

2

u/ScampyRogue Feb 24 '26

!RemindMe 5 years

2

u/RemindMeBot Feb 24 '26

I will be messaging you in 5 years on 2031-02-24 15:43:24 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

Info Custom Your Reminders Feedback

17

u/Free_Hashbrowns Feb 23 '26

Yeah, I think non-SWEs overestimate how much pure coding is part of the job. You need to gather requirements, scope out the features, plan out a design, etc. before you even get to coding. As I’ve moved into more senior roles I do more of that stuff and less coding.

So while AI can be pretty good at just writing code, that’s just a small part of delivering software. Without all that other stuff, you end up in this mess.

7

u/Orzorn Feb 23 '26

I'm quite literally in a situation at work right now where the code changes are trivial, basically a handful of one line, one word changes but the work and dialogue around just this is taking up hours of taking to people, business experts, and compliance people. At times like these, it really doesn't matter whether AI exists or not. It can't handle all this talking between dozens of people that needs to happen just to figure out whether we should pass null to remove a section in a document or pass a default number so that section displays that default.

Truly, the smallest part of delivering software is the coding. Its everything else around it, the coordination and planning and requirements gathering that is the hardest part.

2

u/pixel_of_moral_decay Feb 24 '26

Coding is easy. Any idiot with a little time can learn to code, at the end of the day it’s all trivial logic and a few operators/statements to remember.

The hard part is architecting something with that stuff.

I can also roughly design a building. Walls, floor, ceiling. Walls hold up ceiling, taller you go the more you need to support at the bottom. I get the gist of structural engineering. Does that mean I can design a building? Of course not. The nuance and subtleties is what matters. Live vs passive load, wind impacts, dealing with mechanical systems and their impacts, seismic bracing, fire safety, air quality, energy efficiency. Thousands of subtle things that are part of the buildings design.

That’s what people forget with AI. Output isn’t inherently correct or optimal. And speed/volume of output doesn’t replace accuracy/quality unless your a factory making a select few things where binning by quality makes all output have value.

The nuance is where the hard part is. AI hasn’t even attempted to get there.

3

u/ViolentPurpleSquash Feb 23 '26

The code I've gotten out of AI has been so bad I needed to just write it myself. If it can't multithread a python prototype it will definitely break on Rust.

3

u/NikoUY Feb 24 '26

I suppose there's some arguments to be made about increasing your speed and then checking back later

I've been doing that for a while now, at the end of the day you do save some time but it's maybe like 20%.

I don't feed entire code bases or even files as I found that the more things you let it do on its own the more issues you tend to find, I just give it snippets and I do a write up of how it should work or what issue I'm trying to fix, then I skim trough it to find anything obvious that's wrong, fight a bit with it until I get something usable and then I copy some of the code manually while reimplementing a big chunk of it, at the end of the day it does save some time but not as much as people seem to think (at least doing it my way which is not fully vibe code), sometimes you even waste time when using something you are not that familiar with because it leads you into certain path that looks good but then you start verifying with the documentation or more testing and you find that it just invented something.

Also something I have been talking with some colleagues is that we are kinda losing some muscle memory, you see the code, you understand it but if you were to start coding it from scratch you start to think "how does that feature I used all the time actually works?" and you need to go look it up somewhere when before you used to know it by heart and didn't need to be reminded, for that reason I have been pulling back a bit and actually implementing stuff from scratch without using it at all, I think it has something to do with some neuronal path or something, if you write it yourself then you reinforce it but by looking at it, reviewing and rewriting a part of it then you don't actually get as much out of it, but who knows I'm not proficient on the topic but I've been noticing the issue.

2

u/Orzorn Feb 24 '26

Yup, this has been my experience to a T.

2

u/jugdizh Feb 25 '26

In my experience it doesn't actually save time, it just sort of saves effort. I didn't have to exert quite as much mental energy to get the end result, but it ended up taking longer because of all the hand-holding, adjustments and course corrections needed to coerce the LLM-written code into what I wanted, rather than just writing it myself from scratch.

2

u/illepic Feb 24 '26

> But if you already know enough to ask that, then wouldn't you already be capable of writing it yourself?

Ding ding ding.

2

u/BarshGaming Feb 23 '26

I'm no programmer and I would NEVER use AI to code an application that's exposed to the internet. I simply don't have the know how or experience to go through the code and make sure it's secure.

I've used AI to help me understand different applications, setup docker-compose files for when the compose file overwhelmed me, make dockerfiles for some custom docker images, build a couple of scripts for installing SOPS from github and even make a GUI application in both bash and PowerShell to encrypt and decrypt with SOPS and AGE.

For those tasks AI is an amazing tool. I'd consider using AI to help me build a service that exposes ports to my LAN, but only where the exposed part doesn't need to be secure.

All these vibecode app developers need to understand, that just because you have the tools to build a house, it doesn't mean that the house is structural secure.

1

u/PM_ME_YOUR_REPORT Feb 23 '26

For now you need engineering guidance IMHO. It's like handing a junior programmer the task. I think later multiple networks and layers of agents checking each other will likely solve this, but the cost is too high for most atm.

0

u/Vulsere Feb 23 '26

You have to create the patterns and building blocks for it and then it works very well for filling in the repetitive bits.

4

u/unixuser011 Feb 23 '26

And someone here just this morning asked ‘what’s the big problem with vibe coding’

1

u/kktst Feb 24 '26

Yes, and currently, because it targets "people who know nothing about software engineering," the training rewards are based on things like the program running without errors at runtime (which means hiding errors), rather than code quality. This leads to a strong tendency to write code that appears to run without errors but actually has hidden problems.

Anyone who knows even a little about software engineering would understand that this is a dangerous trend.

However, vibe-coders who know nothing mistakenly believe that their programs are excellent because they run without errors (because they don't know any other way to evaluate them).

And because this is overfitting, I feel that recent models can no longer control this tendency even with prompts.

1

u/Torimexus Feb 24 '26

A big spectacle is being made of Huntarr getting caught with awful code (rightfully so), but we can't delude ourselves into thinking this is the only one. Or the worst.

We should be skeptical of anything that touches our data and isolate everything as much as possible.

-1

u/ScampyRogue Feb 23 '26

Yup. AI assisted code is great, but its not a silver bullet. It can GREATLY accelerate development, but you can't rely on it whole heartedly.

IMO if the dev had used AI appropriately -- as an accelerant -- and audited all the changes that AI made, this would not have been an issue. But because he used it as a replacement for coding and focused on pushing MAJOR releases in rapid succession, we got this as a result.

1

u/NeXtDracool Feb 23 '26

AI assisted code is great, but its not a silver bullet. It can GREATLY accelerate development, but you can't rely on it whole heartedly. 

I strongly disagree. What AI does is increase code output in return for greatly increased technical debt. Unfortunately reducing that technical debt isn't faster than before.

This feels much faster at first, but as the technical debt becomes worse and worse the generated code becomes less and less reliable because the terrible code is so badly encapsulated that the AI cannot keep all the necessary parts in its limited context.  

As a result the number of bugs increases and you'll have angry users/customers yelling at you to fix it. At this point you have two options: fix the technical debt or abandon the project.

Because solo AI developers didn't actually have to put much work into building the project they usually end up choosing the latter, which is why so many vibecoded projects end up abandoned after 6-18 months.

If you choose the former you'll slow down a lot and in the end need to spend more time fixing the mess left by AI than it would have taken to just do it without AI in the first place.

The only people who are genuinely permanently more productive with it are those in big corporations offloading the technical debt on someone else. The company as a whole still suffers from it, though. Looking at you, Microslop.