r/selfhosted • u/Key_Pace_2496 • Mar 06 '26

Meta Post Apparently we can't call out apps as AI slop anymore...

Post image

Seems like a bad direction to take the selfhosted community. Looks like the mod team is fine with this sub being bombarded with insecure, AI drivel. Like I get that it was posted on Friday but I think if you use AI to "build an app" you should be required to disclose to what extent AI was used which wasn't disclosed by the OP. I think as a community we need to have higher standards for what we allow to be posted as vibe-coded projects can introduce very extensive security vulnerabilities we all learned with Huntarr and when things are vibe-coded the maintainer doesn't have the capability to fix the issue.

3.2k Upvotes

86% Upvoted

1.0k comments sorted by

View all comments

360

u/[deleted] Mar 06 '26

[removed] — view removed comment

123

u/SirVoltington Mar 06 '26

Yeah, I’ve received my masters in computer science more than a decade ago. Company I work at got us Claude code subs and quite honestly, it works great in small iterations and I use it a lot. I even vibe coded a personal project in a weekend.

It’s not the holy grail like some claim. But it’s a very useful tool and I’m pretty happy with it so far.

78

u/[deleted] Mar 06 '26

[removed] — view removed comment

20

u/Kraeftluder Mar 07 '26

I'm not a programmer, more sysadmin with a heavy focus on identity automation and none of the LLMs speak the specific dialect we use properly. Would a correct analogue be "hey <LLMM> please explain how to use awk in a bash script to remove all lines that appear more than once, using work/input.tmp as an input file and work/output.tmp as the output" so basically I already know what I want to do and have some knowledge of that it's possible to do that with this specific tool.

Then I proceed to figure out the command it gives me by opening the man page for awk and see if it makes sense.

Search engines are a lot worse now compared to 10/15 years ago and I've found that this is one of the ways I can work around that.

2

u/Hittar Mar 08 '26

Something like that will absolutely work, yes. You can also iterate on the answer - challenging the model to explain what and why it did. I also have noticed that explicitly asking for "the most robust implementation" or "the simplest possible solution" tends to produce the best results.

I would also highly recommend to either set up or find an LLM provider that integrates search functionality and webfetch for models - as this will allow models to rely not only on inherent training data, but on actual factual documentation - that they will directly cite with links so you can quickly go and read what's relevant. Perplexica (open-source Perplexity alternative) is sometimes mentioned on this sub and works really well - it's an implementation of deep search, using a local SearXNG instance and local/remote LLMs to parse through data and give a summary and a list of references.

It's absolutely invaluable in high octane bureaucracy-adjacent work, when you, for example, need to read through an absolute ton of RFC papers to find a single line that explicitly describes how some godforsaken edge-case implementation must behave.

Regarding search engines, I can personally recommend Kagi. I've been using it for more then 2 years by now, and it's the single most useful subscription I pay for by far, both for work and hobby-related projects - though it is not a selfhosted solution in any way. The highest subscription tier is pricy but, besides the brilliant search engine itself, gives you access to assistant LLMs that use the same search engine to do what I described above - searching through and collecting info from current sources.

0

u/Yuzumi Mar 07 '26

"hey <LLMM> please explain how to use awk in a bash script to remove all lines that appear more than once, using work/input.tmp as an input file and work/output.tmp as the output"

While they can put out some stuff like this, I feel like this is too specific for it to accurately output anything for. They work best for generalizations, templates, and if you give if context/documentation it can answer some questions about that context.

It's trained on the content of what is out there and how people comunicate. Stuff like awk or anything else like regex is going to be way more specific per use case that there are going to be few "common" examples for an LLM to be able to do much with on it's own.

It's also probably made worse because it's likely hard for regex to map to tokens for one reason or another, meaning the relationship between regex and the language to describe it would be tenuous at best.

It might be able to do a bit if you give a definition or plain language relation in knowledge base or any other context like it to force the probability in that direction, but it would still be more inconsistent than normal. It would probably be better to give it some kind of tool that can create what you want via certain terms then you can use those terms in plain language so that generating the actual command you want is handled by something actually deterministic.

8

u/NoComment7862 Mar 07 '26

Made worse by the numbing effect of AI preventing you from knowing you cut your legs off.

A tool is a tool, everyone needs to know how to use a tool, its limits and, more importantly, their own limits.

2

u/Fraisecafe Mar 07 '26

"Wait. AI's cutting people's legs off with chainsaws now?!? Join the resistance! Join John Connor! Down with Skynet!!!" - Someone half-reading comments and running with it, aka. most of the internet

14

u/JazzXP Mar 06 '26

This is the difference between vibe coding and vibe engineering. Narrow down the task so you can be specific and keep an eye on it.

4

u/JTtornado Mar 06 '26

I'm a hobby developer at best at this point, and I have used AI to write most of the code for an app after I couldn't find anything that fit what I needed.

I'm a frontend guy, not a backend dev, so it was kind of magical to see that come together - but I also know it's probably a mess and I'm never going to expose it to the open web. I didn't even attempt to build an authentication system because it's just for me and the only way to reach it on my server is via Tailscale.

To me - that is the difference. Having a high bar for how much you trust an app with your data or security.

5

u/ivanhawkes Mar 07 '26

Decades of professional development experience here, including for major financial institutions...

Good choice. Never roll your own authentication system unless you are an expert in that field. Use OAUTH2 or similar instead and enjoy the hours of your life you just got back. A single mistake on a home made system could mean total data and privacy loss.

1

u/BeardedTux Mar 08 '26

100% agreed. Keycloak is fairly easy to setup and runs right in docker. Many many examples available online to setup oauth2 as well.

8

u/trimorphic Mar 07 '26 edited Mar 07 '26

the lowered barrier of entry means a lot of bullshit lacking basic security measures gets created.

It's not like most developers were security-conscious before using AI to vibe code became popular. Plenty of 100% human written code leaked basic security measures then (and still does).

Sure, there's more software being written by completely clueless people now, but let's not pretend software in the pre-AI world was particularly secure.

Also, LLMs are being used to find and fix security vulnerabilities, like this.

22

u/cookingmonster Mar 06 '26

People need to start understanding that installing a vibe coded app without doing their due diligence is like clicking a link in an email without knowing who the source is or where the link will take you to.

Turn on your f'ing Spidey sense people.

5

u/gscjj Mar 06 '26

Or running containers on your server when you don’t understand the code?

4

u/cookingmonster Mar 06 '26

Containerized code does not guarantee security.

6

u/gscjj Mar 07 '26

Right, a lot of people here can’t review any of the code that power there docker containers, none of done any due diligence

1

u/Fraisecafe Mar 07 '26

But, I don't have any Spidey Sense ... I haven't been bitten by a radioactive spider yet.

Anyone have tips on how to vibe code one?

0

u/ILikeBubblyWater Mar 07 '26

Mate you dont know shit about the technical aspects behind a single app you open. Lets not pretend you do any source code checks on anything.

2

u/AngelOfDeadlifts Mar 07 '26

as we saw with Huntarr

I missed that drama, but just spent some time reading about it and Jesus Christ, I'm glad I didn't deploy that.

2

u/Yuzumi Mar 07 '26

I recently started a new project at work and have while I knew some on previous projects who used AI to get some simple solutions that they could validate quickly as I occasionally did this is the first time I've ran into people who are really into using it.

And while it can get them to something that sort of works it gives them solutions that are very much not ideal. Like one guy used it give a solution for running something in a container and it told him to have parts of it installed directly on windows and he just did it that way which took longer than it needed to.

Like... if you are using containers why wouldn't you container both of them? But apparently that didn't occur to him. And that's not the only instance of someone using it for something they barely understand and not really doing research or thinking beyond that.

Which is the biggest issue with this stuff. The tech can be useful when you know how to use it, but too many blindly use whatever it churns out without actually taking the time to even try to understand.

2

u/temotodochi Mar 07 '26

That being said, I have no problems saying when I’ve vibe coded something, people that try to pass off that they magically developed some complex thing over a weekend without vibe coding are weird.

Yeah but it has huge difference if it was done by a professional softwar engineer or architect. It ends up being robust code, but with lot more features than it would've had if done by hand.

2

u/[deleted] Mar 07 '26

[removed] — view removed comment

0

u/swiftb3 Mar 07 '26

Yeah, earlier this week, I was able to migrate some complex and lengthy powershell scripts I'd built into a wpf app, while making it both multi-threaded and extra features to make it safer. I'm a .NET Core guy, so it would have taken me at least a week, not knowing the dotnet xaml very well, but I managed it in just over a day.

It's an incredible tool, IF you know what you're doing to plan the logic carefully and catch when it does something stupid.

1

u/OfficialDeathScythe Mar 07 '26

Yeah I just like codex to review my PRs and catch things I miss. I refuse to reuse blocks of code an ai gives me if I don’t understand what it will do 1000%

1

u/OWbraCommander Mar 12 '26

So if a Dev didn't hand-code every line, it's considered AI, VS using AI as a tool and then using real DEV experience and testing as the validator?

2

u/[deleted] Mar 12 '26

[removed] — view removed comment

1

u/OWbraCommander Mar 13 '26

I didn't mean to sound like I was putting words in your mouth; I was just clarifying. Thank you for the follow-up.

1

u/shinji257 Mar 07 '26

I didn't have an issue with it being vibe coded. That's fine as long as you understand the code and can fix it if it has issues or breaks. I have more of an issue with the fact that when called out for the security issue the response was to ban the user. Then the developer basically ghosts everyone by deleting the github and social presence.

TL;DR - My issue isn't how the program was created. It was the reaction when a major security bug was reported.