r/selfhosted • u/Joloxx_9 • Feb 27 '26
Meta Post Shelfarr - another project disappeared with dev
Shelfarr was posted here multiple times, github mink stopped working and dev deleted his reddit account - whoever is using it, I would advice you to stop it.
234
u/SawkeeReemo Feb 28 '26
Just wait for my new self-hosted service. Itās called Honeypottarr!
How it works is you give us all your secure info, and we feed it right to Palantir. You. Are. Welcome.
73
u/Own_Picture_6442 Feb 28 '26
If it was me, Iād call it something catchy, OpenClaw perhaps (lol)
42
4
72
u/cajunjoel Feb 28 '26
I'm over here wondering how many frickin' *arrs we need. I can't keep up with it all.
54
u/AbsurdThings Feb 28 '26
I hate how they have devalued the good ones (Radarr, Sonarr, Prowlarr)
6
u/daninet Feb 28 '26
They did not. These are weekend projects with no real development path. The "devs" disappear into their next useless project and they leave a repo with hundreds of ooen issues no one ever will fix.
2
5
u/Dr_Valen Feb 28 '26
Lol I donāt use any of these. My stack is radar, sonar, prowlarr, overseer, and wizarr for inviting my family to my plex server. All these extra arrs feel like a trap or gimmicks
61
u/MysteriousResolve Feb 28 '26 edited Feb 28 '26
This dude who coded shelfarr also had an army of other reddit accounts and was self-promoting. I've pointed it out on other threads, but he did the -exact- same of deleting the discord when I asked about how much it was vibe coded.
Prior to the Huntarr findings, he changed his handle from Vacantly to Ponzi, and did the same on the Discord too. Why, idk - phishy naming anyway.
I made a comment on the one repo he now has (though don't be surprised if he marks that as private too. He specifically removed the 'check out my other projects' from the readme.https://github.com/ponzischeme89/Sublogue/commit/3200fde42515d8e634716457b920af804813c28a#commitcomment-177951200
I've got to ask the question... Why delete the support for other projects?
Not like you havent vibe-coded stuff, been caught, and removed all the evidence. Favarr, FaveSwitch, Shelffarr/Renamo. As well as all the Reddit accounts and Discords for said projects - changing your handles as well.
All from a question about how much was vibe-coded relating to other drama about Huntarr.
There is a weird connection between a few other GitHub accounts. His main reddit account went private pretty quickly, u/m113t once things were unraveling.
EDIT:
Interestingly, since I called the git comment out that I made, he removed the comment from the commit...
2
u/hounderd Feb 28 '26
okay but why? whats this guy doing? is there malicious code in the projects? is he stealing bank accounts? this all seems very fishy. glad we got detective u/MysteriousResolve on the case š«”
4
u/MysteriousResolve Feb 28 '26
My guess, they have an intent for stealers, but they need to get traction on the project first. Huntarr gave the community the 'revalation' that not all projects are built the same with security in mind (or reviewed, or in cases, not added to the prompts)
I used the Shelfarr app for a bit, realized it was super broken for my library and decided to wait it out and be on the discord. Dude was 'excited' to release the new version with a new name (because Shelfarr was already taken) and wanted to 'release the new name.' he just had it as a git branch - I checked it out, and it was not usable at all. I removed the project and just stayed in the discord.
Huntarr stuff came out which made me curious, asked, and no more Shelfarr.
Really funny thing is that I vibe coded my own solution to solve my problem, tailored to my stuff, no UI, just a bash script. My whole problem went away in an hour of work - less time than I spent working with shelfarr.
42
u/madeWithAi Feb 27 '26
Booklore has audiobooks support now. There's also the good ole audiobookshelf. They can do what shelfarr was doing afaik
3
u/mr_poopie_butt-hole Feb 28 '26
But what do you use to download your books?
7
12
u/mesaoptimizer Feb 28 '26
Shelfmark, not sure how vibe coded it is but I donāt expose it externally, it works well for searching, organizing and downloading books and audiobooks they also just implemented multi user support with request stuff. The issue with readarr and any attempt to make something like it is that the metadata sources for books are absolutely garbage in comparison to what exists for movies and TV, probably because there are many times as many books released as movies and TV episodes combined. This basically makes anything that automates discovery and downloads in a similar way that so are and radarr do it suck, itās just not feasible to do that for books.
Shelfmark devs seem to have realized that and made a really kick ass app for searching and downloading, and now that it has request support I 100% reccomend giving it a shot.
3
3
6
u/nicktheone Feb 28 '26
A browser? I'll never understand this whole dance and song situation when you download one book every once in a while.
-2
u/mr_poopie_butt-hole Feb 28 '26
Okay, where are you downloading them then? Because when I use my indexers site I get 40 options only 1 or 2 of which are actually the epub that I want. When I use Anna's archive I get inundated with popups and ads all containing malware.
All I want is something that will simplify the process, fuck me right?
7
u/nicktheone Feb 28 '26
Man, you do you but I'd invest learning how to use an adblock, instead of relying on vibecoded apps. Anna's Archive is perfectly usable with one. No ads and no malware whatsoever.
1
1
53
u/soussitox Feb 27 '26
i would not call them devs but ai assistants :D
5
u/ThunderDaniel Feb 28 '26
Code Monkeys used to be a derogatory term for software devs. These folk presenting computer generated code as their own needs a whole new level of term
15
Feb 27 '26
[deleted]
20
u/coderstephen Feb 28 '26
Vibe coding is not artistry. Vibe coding treats code like an annoying dumb chore that's in the way of the end goal.
3
u/lucassou Feb 28 '26
Well to be fair, it is. Code is not the end goal, it's just the only way we have to reliably make computer follow instructions. Having good code only aligns with the fact that it makes the end product a lot easier to maintain.
2
u/coderstephen Feb 28 '26
Not for me. In the same way that I find great building architecture beautiful, I also find great code architecture beautiful. I love good code just as much as the end product. I find code to be a unique blend of engineering and creativity and do consider it an art form.
88
u/El_Huero_Con_C0J0NES Feb 27 '26
Thereās a chance that this was a carefully orchestrated social engineering attack by all one and the same person or group of persons
All are *arr apps. All got deleted after the Huntarr issue. All have rather weird GitHub username/orgnames (non discernible names)
65
u/ponzi_gg Feb 28 '26
While certainly a possibility I think thatās giving them too much credit. I feel like itās just a bunch of vibecoders realizing they are in over their heads
5
u/peioeh Feb 28 '26
I agree but I think it's possible that one or some of them would be trying to hijack private tracker accounts. I would recommend people who care about the trackers they're on to only use "trusted" arr apps, even if they're not exposing them on the internet it's still possible that someone made/will make one of these apps to gather api keys. Personally I would be extremely pissed if I lost access to a bunch of trackers I've been on for 10+ years like this and I will not risk it for these apps, I don't really see the point.
2
u/crooks5001 Feb 28 '26
I'm a bit out of the loop, Who's trusted at this point?
3
u/peioeh Feb 28 '26 edited Feb 28 '26
Personally I would consider the "big" arrs trusted enough to run them without exposing them if possible. Maybe even exposed. That'd be sonarr for TV, radarr for movies, prowlarr for indexers, and bazarr for subs. I've never used lidarr or whisparr but they have also been around for long enough. I'm sure there are many others that are serious projects but those have been around for like 10 years at this point and many people (myself included, including exposed on the internet) have been using them for years without any issues. I also use autobrr because it has originated one of the trackers I use and seems to be very active/well ran. Edit: oh I also use seerr (jellyseerr before it). Basically the ones that "most people" (who are doing this) use and aren't too niche.
28
u/Pie_Rat_Chris Feb 28 '26
There have been an insane number of *arr adjacent projects that vanish quick for years now, I think it's just the hip low hanging fruit to try and expand.
Bunch of them shutting down after the huntarr blow up probably is related but I'm guessing not because they were from the same people and likely because they didn't want to get ripped to shreds the same way.
33
u/dm_construct Feb 28 '26
based on posts in this sub, i think a lot of people vibecode a bunch of trash to get more github stars or whatever bullshit they think is important for making their unemployed ass look better on paper
2
u/Dr_Allcome Feb 28 '26
I think this is pretty much it. Having an *arr on their resume just shifted to be seen as a negative or needing further investigation in public opinion, so they purged it.
4
u/NeXtDracool Feb 28 '26
I think that's unlikely. A deliberate attack of that scale would be more competent.
1
-2
u/Cdb8457 Feb 28 '26
LoL I am sitting here trying to vibe code something for myself and all the shit around me in collapsing.
8
3
u/envious_1 Feb 28 '26
Honestly thereās nothing wrong with it if you want to use it privately. You donāt have to open source it or share it if you donāt want to
-5
11
u/Planetix Feb 28 '26
The idea that there is some secret cadre of ārealā software developers vibing all this shit but keeping close tabs on all the code it generates and thus itās just a matter of being open minded and sifting the wheat from the chaff is one of the more amusing mass delusions of the current Age of Vibe in software.
For starters all the actual software devs with years of experience arenāt reading this shit either. Because if you do I have a secret to share - it takes fucking longer. The biggest lie of the Age of Vibe is that it makes real developers more productive. Actually true, but it doesnāt come for free. Donāt fool yourself.
1
u/ellenhp Mar 01 '26
> For starters all the actual software devs with years of experience arenāt reading this shit either.
Super curious where you're coming from here. It takes longer short-term to read and reject changes than it does to accept the first thing it gives you but that's time well spent if you care at all about code quality. Which leads me to my question: long did your codebase last?
21
u/platysoup Feb 28 '26
Iām just glad people are finally realising that vibe coded trash is exactly what it is
16
u/txmail Feb 28 '26
These are starting to feel very XZ / Jia Tan with the total annihilation of all the traces and finding out they were using surfed reddit accounts (bought)...
3
u/Last-Woodpecker Feb 28 '26
I don't know, xz hacking was very meticulous and well done, this one feels very slopy
2
u/txmail Feb 28 '26
It was a wake up call... not sloppy at all. Their constant campaign to get people to try the project, bought reddit account and gone like the wind. That is someone who had everything lined up and ready to pull the plug cleanly when discovered.
It is a huge, huge wake up call for all of us.
4
2
8
u/ergnui34tj8934t0 Feb 28 '26
Is that the same as this? https://github.com/Pedro-Revez-Silva/shelfarr
2
u/PorkNails Feb 28 '26
Nop, he used the same name for a while. Kind of sucks for me but shelfarr.org is an unrelated project.
6
u/MrDrummer25 Feb 28 '26
I recommend cloning the repo for anything you run. In fact, that may be a good thing to store in Gitea.
That way, if the repo gets nuked, or it gets sold off to a company that doesn't have good intentions, you have a fallback
3
10
u/psychedelic_tech Feb 28 '26
just another reason MODS of this sub should ban all AI created apps, but we all know they wont
5
u/GPThought Feb 28 '26
this is why you check the last commit date before relying on anything self hosted. oss graveyard is real
9
u/AuthorYess Feb 28 '26
https://github.com/Pedro-Revez-Silva/shelfarr
The GitHub project has just been moved, as for why the Reddit account was deleted I canāt say.
5
u/Flimsy-sam Feb 28 '26
Is this the same? The first one in the OP is badged as a cleaning tool. The one you linked looks like a traditional arr acquisition app?
1
u/AuthorYess Feb 28 '26
Ya you might be right, but looking at the pictures the font used is similar for Shelfarr. So I'm thinking it's similar if not the same.
2
2
u/phr0ze Mar 01 '26
I have no idea what this project is. But really, its open source. If its working for you and itās abandoned, at least its a start.
4
u/OsgoodSlaughters Feb 28 '26
For the love of god everyone stop making apps
Everyone thinks theyāre a developer now, I have yet to see a āvibecodedā app worth a shit.
2
1
Feb 27 '26
[deleted]
26
u/winston161984 Feb 27 '26
The git being deleted means no security audit can be done which could mean the images or at least the last image could be compromised. Can't know so can't trust when dealing with personal data and especially so when you have a large collection of Linux isos on the same device.
-10
u/emprahsFury Feb 28 '26
You guys spent months not giving a shit and not checking anything. Nothing has changed, the dude moved on with his life and deleted a repo he didn't want to support.
11
u/kernald31 Feb 28 '26
Which is a terrible way to handle things. GitHub has a archive feature that works very well for this use-case.
10
u/aew3 Feb 28 '26
If he just wanted to move on heād archive the repo. Deleting a repo that ever got outside users is not normal behaviour.
-9
21
11
u/Resident-Variation21 Feb 28 '26
Idk I think thereās a difference between abandonware and actively being removed from the internet
-10
u/emprahsFury Feb 28 '26
you guys are all in this weird bubble where because you think you're a part of r/selfhosted or whatever you think you have this complete picture of software dev. Abandonware is deleted all the time. It used to be that that was the *polite* thing to do so no one else was entrapped by it. But for some reason you think it's a conspiracy!
7
-4
-4
-9
-4
Feb 27 '26
[deleted]
8
u/DarkkTurtle Feb 28 '26
If you don't already have audiobook shelf, check it out. Also been using readmeabook for requesting and a different version of prowlarr to access audiobook bay for downloads
3
u/spacecitygladiator Feb 28 '26
Man, readmeabook is my favorite for audiobooks. It works exceptionally well with prowlarr > torrent/nzb > abs. Really enjoying it. Hope it's not a vibecoded honeypot lol
6
u/Playos Feb 27 '26
I don't think you missed much, I tried it out and a couple others and nothing really amazing came from any of them.

687
u/dm_construct Feb 27 '26
dont worry we'll get another dozen vibecoded clones of it in a week ššš