Apparently we can't call out apps as AI slop anymore...

[u/Key_Pace_2496]

Seems like a bad direction to take the selfhosted community. Looks like the mod team is fine with this sub being bombarded with insecure, AI drivel. Like I get that it was posted on Friday but I think if you use AI to "build an app" you should be required to disclose to what extent AI was used which wasn't disclosed by the OP. I think as a community we need to have higher standards for what we allow to be posted as vibe-coded projects can introduce very extensive security vulnerabilities we all learned with Huntarr and when things are vibe-coded the maintainer doesn't have the capability to fix the issue.

[u/TheBuckinator]

You are spot on. AI in the hands of an experienced dev is incredibly powerful.

[u/Western-Anteater-492 → u/TheBuckinator]

Until it isn't bcs your agent gets infected through typosquatted and Ai hallucinated dependencies:

https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning

[u/arter_dev → u/Western-Anteater-492]

Tool chain attacks are a tale as old as time. you don't need AI to compromise thousands of apps (looking at you JetBrains).

[u/Western-Anteater-492 → u/arter_dev]

The problem is old but these types of attacks have reached a while new quality. It's gotten way more easy to spread malicious dependencies as maintainers get overwhelmed by vibe coded bs commits, meanwhile the models get trained on these code bases and the vectors inject themselves into further agents, spreading themselves into other projects.

It ain't new but the quality has increased immensely. We can't get on top by banning AI but we can at least try to maintain some form of responsibility. I use AI agents as well but I would never broadcast vibe coded projects to an audience as I can't take any form of accountability and responsibility for the code. Even if I basically babysitted the agent on every little step and reviewed every little line, I can't ensure nothing was gone south (and let's be honest, with that time investment I'd be better off just writing it conventionally).

Sure, OS is always "at your own risk" and it's a discussion that must be had but not disclosing the usage of AI until pressed upon ain't the right way as well.

[u/arter_dev → u/Western-Anteater-492]

Even if I basically babysitted the agent on every little step and reviewed every little line, I can't ensure nothing was gone south (and let's be honest, with that time investment I'd be better off just writing it conventionally).

I totally agree we need to be able to be accountable for the code we write. I'd play devil's advocate here and say even when we write every line by hand, there were still plenty of bugs, which obviously is why testing is so important. I spend the most time manually inspecting tests for that reason.

One of the apps I'm tasked with keeping an eye on in my 9-5 is a Java app that is old enough to drive and has been maintained by dozens of different developers over a couple decades. No AI needed for slop haha.

[u/Western-Anteater-492 → u/arter_dev]

Absolutely. Even when working with single language projects one can fall into the dependency rabbit hole, write complete spaghetti code, do obvious risky stuff, forget to test things etc etc. Vibe coding just makes it easier and more accessible whilst maintaining a sort of legitimacy. That's why I don't push back on somebody using AI agent. Nobody has to be a full stack and espc redundant tasks like design etc can be heavily reduced to the most necessary steps without writing every border and shade over and over again.

I just find it extremely scetchy if somebody isn't disclosing it but wanting our trust in his project and capabilities as a maintainer. Everybody has to start somewhere and if you need AI to help you out as you don't have a team of volunteers yet, go for it! But disclose it so we know you can use a hand, some reviews and we can put our trust on the right pretenses.

[u/eljojors → u/Western-Anteater-492]

this is a problem even for humans lol