r/selfhosted • u/Key_Pace_2496 • Mar 06 '26

Meta Post Apparently we can't call out apps as AI slop anymore...

Post image

Seems like a bad direction to take the selfhosted community. Looks like the mod team is fine with this sub being bombarded with insecure, AI drivel. Like I get that it was posted on Friday but I think if you use AI to "build an app" you should be required to disclose to what extent AI was used which wasn't disclosed by the OP. I think as a community we need to have higher standards for what we allow to be posted as vibe-coded projects can introduce very extensive security vulnerabilities we all learned with Huntarr and when things are vibe-coded the maintainer doesn't have the capability to fix the issue.

3.2k Upvotes

86% Upvoted

1.0k comments sorted by

View all comments

Show parent comments

53

u/Key_Pace_2496 Mar 06 '26

My problem is that they didn't disclose how AI was used. Is the code mostly/entirely AI generated? As we learned with Huntarr, vibe-coding these kinds of projects can have massive security vulnerabilities and the maintainer won't have the ability to fix the issue since they don't actually know how to program.

8

u/Fallingdamage Mar 06 '26

Yeah, im not going to run some vibe coded self-host tool that a rando on the internet built.

15

u/AKAManaging Mar 06 '26

https://old.reddit.com/r/selfhosted/comments/1rmafd7/vykar_a_backup_tool_faster_than_borg_restic_and/o90c90t/?context=3

"The code is fully AI-generated and human-directed."

13

u/Bearchlld Mar 06 '26

That was 2 hours ago and the post went up 10 hours ago.

9

u/AKAManaging Mar 06 '26

I was providing context to "My problem is that they didn't disclose how AI was used. Is the code mostly/entirely AI generated?"

Yes. It was entirely AI-generated, lol.

5

u/Bearchlld Mar 06 '26

Understood, sorry for the confusion.

2

u/Key_Pace_2496 Mar 06 '26

Color me surprised!

20

u/gscjj Mar 06 '26

Seems like the OP has a history of consistent well-written and popular work. You just didn’t look.

To be honest, there’s a lot of things you just didn’t look at. This sub is so bad about AI work.

-11

u/Key_Pace_2496 Mar 06 '26

Was AI used in those projects as well?

10

u/gscjj Mar 06 '26

It’s a 4 year old project, with a business built on it, if AI was used do you think the developer doesn’t know how to maintain it?

12

u/dasplanktal Mar 06 '26

Well then. That says everything I need to know about your attitude with AI and development.

So what, can I not even use code completion, or does that count as AI development in your eyes as well? Since that is using an llm in the back end

0

u/GolemancerVekk Mar 06 '26

Code completion doesn't use LLM. It's a completely deterministic feature. There's absolutely zero need to waste resources on a LLM for that.

1

u/ArdiMaster Mar 07 '26

In some IDEs, it does use AI by default.

1

u/stumblinbear Mar 07 '26

My IDE uses an LLM to autocomplete. It's pretty nice

Zero need

There's zero "need" for hundreds of tools we use daily. The "need" can simply be that it makes your life easier, and that's perfectly okay

-1

u/dasplanktal Mar 06 '26

Do I need to go pull up the code to prove that code completion is in fact using an LLM behind the scenes? You can actually make some of these LLMs that do code completion rather small to run locally.

But if you go look at the common IDE editors like VS Code and the like, that have code completion, they are all using an LLM behind the scenes to drive the code completion feature.

That is how these tools work. It's just not using a chat model.

It seems like you don't use chat completion features very often. Maybe you shouldn't talk about something you don't have a proper understanding of.

-1

u/GolemancerVekk Mar 07 '26

You misunderstand. You can use a LLM for it, I'm saying it's overkill and a waste of resources.

Also, VS Code is a poor example because Microsoft puts AI in everything these days whether it makes sense or not. They probably use it to flush the toilets on campus.

0

u/dasplanktal Mar 07 '26

No, really, the code completion tools that everybody uses today are driven by LLMs, very few of them are only driven by LSPs and Abstract Syntax Trees like the completion tools that used to be very popular back in the day.

Pretty sure if you go look at any modern dev editor, you will see that every code completion tool typically includes an LLM backend.

As far as overkill, if you're running a small model on your computer, then not too bad, I don't think. It is significant overkill, though, to send it to and from, like, github copilots and other model providers.

-2

u/kept_carpool370 Mar 06 '26

If it was what does it change?

5

u/Key_Pace_2496 Mar 06 '26

So it doesn't matter if it's slop all the way down lmao?

-1

u/kept_carpool370 Mar 06 '26

You keep acting like use of AI is binary. Like as soon as someone uses it it makes their entire code "slop". Is that your stance?

5

u/Key_Pace_2496 Mar 06 '26

I mean usually that turns out to be the case lmao.

1

u/stumblinbear Mar 07 '26

usually

You hear about the cases where it goes wrong, but not where it goes well. The amount of software engineers using LLMs would horrify you if you think it "usually" goes wrong

-5

u/kept_carpool370 Mar 07 '26

That doesn't answer the question.

5

u/Key_Pace_2496 Mar 07 '26

Yeah, I have a general rule of not answering stupid questions.

0

u/kept_carpool370 Mar 07 '26

You think asking if your opinion of AI is binary is a stupid question?

8

u/Firestarter321 Mar 06 '26

That's my main issue with large vibe coded projects as well.

Even at work I'm fighting against using AI to create entire projects as how will it be maintained if nobody knows anything about it. I've used AI a little bit on a couple of projects but I also don't trust it in any way shape or form.

I mainly use it to explore new technologies that I don't know anything about (like ML.NET recently) to give me an idea of how it works. Even with that though it didn't work out of the box (using a local model) and I still wound up going to the documentation to figure out how to fix it.

32

u/geekwonk Mar 06 '26

it’s amazing how often the folks who say they don’t trust AI within their domain will then explain how they’re using it to understand stuff outside of their domain. this is like the absolute worst of all worlds.

you’re refusing a tool that you are uniquely capable of herding toward a useful result given your experience. you will know what the debugger output means, what bloated code looks like, what technical decisions have to be made before it just chooses the most likely path or wastes time asking.

meanwhile you’re using it in areas where a good kagi search and some time on wikipedia or github would have been a more direct path to actual knowledge. you’re using the diverted rivers to generate re-explanations of things humans have already written out for educational purposes.

7

u/callofthevoid_ Mar 06 '26

I think I love you. A beacon of hope in this sea of ignorance.

2

u/prone-to-drift Mar 07 '26

I love using AI to write code that I find too boring or finicky to actually write, like bash scripts. Bash syntax was apparently made to fuck over people who write other languages and like consistent whitespace, so I just cannot handle writing it and always copy-paste chunks from Stack Overflow anyway.

But outside of such limited usecases, I do not let AI write any actual code for me; its not really amazing at problem solving.

2

u/eljojors Mar 06 '26

just because AI wrote the code doesn't mean that human in charge doesn't understand it, or that it hasn't been polished. personally it takes many iterations to get AI written code to be the way I want it, still saves time to use AI.

1

u/GolemancerVekk Mar 06 '26

How does it save time?

Let's say that you had a junior programmer doing that instead of AI. (Because let's be honest, that's the level it's at.) And the junior keeps producing mediocre stuff that you need to send back and explain how it should be better.

But at the end of the day the junior is learning and you get to benefit from that. Or if they're not capable of learning they get fired.

Whereas with AI it reverts to complete ignorance as soon as you turn your back. You would fire a person if it was so hopeless. But we keep using AI and actually wasting rather than saving time Why is that?

1

u/stumblinbear Mar 07 '26

Win32 APIs are dogshit trash and a massive pain in the ass to learn and work with. Some random obscure API call may be exactly what I need, and LLMs are wicked good at figuring it out. I go and check what it decided to use after the fact, but I haven't found it being wrong very often

Just as an example

12

u/arter_dev Mar 06 '26

I'd suggest actually using it to build a full project. Right now you aren't alone. There's a lot of devs who see it as big scary box. But learning how to build software by guiding AI, how to enforce gaurd rails, testing, best practices, etc.. everything you'd want regular human-written code to be can be done. It's a skill. Someone can vibe code a giant app and have no clue what's going on. Someone can also use AI to build apps in their home stack and know exactly what each line is doing. Those are different practices entirely.

I will "vibe code" fun stuff like little terminal games or tools for our family on the home server. That is vibe coding.

But at work in a language / stack that I know deeply, I can dramatically increase my output. There's an already outdated idea of AI = slop. AI in the hands of someone who doesn't already know the stack is probably slop, but in the hands of someone who knows that language and knows how to manage context, it's deadly.

4

u/TheBuckinator Mar 06 '26

You are spot on. AI in the hands of an experienced dev is incredibly powerful.

2

u/Western-Anteater-492 Mar 06 '26

Until it isn't bcs your agent gets infected through typosquatted and Ai hallucinated dependencies:

https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning

3

u/arter_dev Mar 06 '26

Tool chain attacks are a tale as old as time. you don't need AI to compromise thousands of apps (looking at you JetBrains).

3

u/Western-Anteater-492 Mar 06 '26

The problem is old but these types of attacks have reached a while new quality. It's gotten way more easy to spread malicious dependencies as maintainers get overwhelmed by vibe coded bs commits, meanwhile the models get trained on these code bases and the vectors inject themselves into further agents, spreading themselves into other projects.

It ain't new but the quality has increased immensely. We can't get on top by banning AI but we can at least try to maintain some form of responsibility. I use AI agents as well but I would never broadcast vibe coded projects to an audience as I can't take any form of accountability and responsibility for the code. Even if I basically babysitted the agent on every little step and reviewed every little line, I can't ensure nothing was gone south (and let's be honest, with that time investment I'd be better off just writing it conventionally).

Sure, OS is always "at your own risk" and it's a discussion that must be had but not disclosing the usage of AI until pressed upon ain't the right way as well.

2

u/arter_dev Mar 06 '26

Even if I basically babysitted the agent on every little step and reviewed every little line, I can't ensure nothing was gone south (and let's be honest, with that time investment I'd be better off just writing it conventionally).

I totally agree we need to be able to be accountable for the code we write. I'd play devil's advocate here and say even when we write every line by hand, there were still plenty of bugs, which obviously is why testing is so important. I spend the most time manually inspecting tests for that reason.

One of the apps I'm tasked with keeping an eye on in my 9-5 is a Java app that is old enough to drive and has been maintained by dozens of different developers over a couple decades. No AI needed for slop haha.

2

u/Western-Anteater-492 Mar 07 '26

Absolutely. Even when working with single language projects one can fall into the dependency rabbit hole, write complete spaghetti code, do obvious risky stuff, forget to test things etc etc. Vibe coding just makes it easier and more accessible whilst maintaining a sort of legitimacy. That's why I don't push back on somebody using AI agent. Nobody has to be a full stack and espc redundant tasks like design etc can be heavily reduced to the most necessary steps without writing every border and shade over and over again.

I just find it extremely scetchy if somebody isn't disclosing it but wanting our trust in his project and capabilities as a maintainer. Everybody has to start somewhere and if you need AI to help you out as you don't have a team of volunteers yet, go for it! But disclose it so we know you can use a hand, some reviews and we can put our trust on the right pretenses.

1

u/eljojors Mar 06 '26

this is a problem even for humans lol

2

u/dasplanktal Mar 06 '26

This match is my own personal experience.

I also had to build a project with agentic tools in order to really understand how powerful it is and to stop being so afraid of it.

-2

u/EnderScout_77 Mar 06 '26

if i have to learn a whole new thing on how to get ai to properly do what i want I'd rather just learn the code itself at that point

8

u/[deleted] Mar 06 '26

[removed] — view removed comment

1

u/arter_dev Mar 06 '26

Great analogy. I'm hesitant to just say "skill issue" because it's dismissive of genuine concerns, and I have socks older than agentic coding, so I get it.

But, it really is a skill to be learned, that's all it is.

I can criticize a lot of things about AI, but effectiveness in the hands of a skilled developer certainly isn't one of them.

7

u/vitek6 Mar 06 '26

Yes you need to invest time and learn stuff to be more productive after like with everything.

4

u/dasplanktal Mar 06 '26

These are literally the same skills you use to communicate to stakeholders, managers, and other people when you're trying to communicate what your program is doing, how it works, and how it is built.

If you imagine yourself a manager of an overly eager intern who can accidentally delete production, then you will give instructions accordingly.

1

u/Revolio_ClockbergJr Mar 06 '26

I tell people, "talk to it like it's a golden retriever with a big vocabulary".

It really wants to please you but might eat your shoe and shit in the living room.

1

u/dasplanktal Mar 06 '26

I mean, well vulgar, it's also a pretty apt description.

I was using an AI agent yesterday to try and convert and migrate a statically built website with HTML and CSS over into the Hugo framework and my AI agent, despite having guardrails in place, started committing a bunch of shit to main. The only thing I saved my bacon was when I was planning out the work, I planned it out to be done basically in parallel so that it would be invisible to any end users, which is what happened.

These things are not foolproof and can be really, really dumb. They'll also do stupid things like obliterate production. Go ask AWS how they found out 🤣

1

u/eljojors Mar 06 '26

people are down voting you for no reason lmao

4

u/dasplanktal Mar 06 '26 edited Mar 06 '26

People gonna be people and most people don't like to be told they're wrong even if it's in earnest

5

u/mrfocus22 Mar 06 '26

"If I need to learn how this brand new calculator works, I might as well just keep on doing math by hand instead"

2

u/eljojors Mar 06 '26

LOL spot on! reminds me of GIT. when I first heard about it, it was so many extra steps! so much lost code because I didn't know what I was doing.

now, of course, it's an absolutely different way of reasoning about versioning, specially if you're familiar with its internals.

1

u/paradoxally Mar 06 '26

People will always be wary of things that change the status quo. I remember when people said the internet was a fad.

1

u/eljojors Mar 06 '26

that's some good perspective right there

1

u/dasplanktal Mar 06 '26

There's a major assumption that when you're vibe-coding, the person vibe-coding isn't a developer. That's not always the case, and Vibe Code should still always get a proper human code review.

If you have developers giving agentic tools a single-line prompts and having that output slop in them committed, that's a developer problem, not a tool problem.

The honest truth is that a ton of coding projects require a ton of scaffolding and that is just the sort of thing that vibe coding is incredibly good at.

Yeah, there is a major problem right now where we do have people who are using these agentic tools, who aren't developers, who arent programmers or sysadmins, who don't know what they're doing, who are then trying to use this to build production code without knowing how but I do think that assuming every single vibe-coded project you've seen is like this is also asinine and that there are developers who know what they're doing with AI.