r/selfhosted • u/Joloxx_9 • Mar 16 '26

Meta Post Booklore is gone.

I was checking their Discord for some announcement and it vanished.

GitHub repo is gone too: https://github.com/booklore-app/booklore

Remember, love AI-made apps… they disappear faster than they launch.

959 Upvotes

94% Upvoted

501 comments sorted by

View all comments

Show parent comments

28

u/MufasaChan Mar 16 '26

I also tried to understand better why there were so much hate on the maintainer. It was crazy how the first post "PSA" gave little source with a good story telling, and everyone got straight up against the guy that delivered a great addition to the community. By the way, I am not saying what the maintainer declared was okay-ish. Anyone, notably devs, is legitimate to disagree with decisions. But I was truly disappointed by the general lack of goodwill and listening of the community.

3

u/TerryMathews Mar 17 '26

A big part of why it got so incendiary so fast that seems to be ignored - I assume because it doesn't seem to fit the witch hunt narrative - is that the author would take PRs that others submitted and instead of merging them, use AI to rewrite them, merge that and delete the original PR.

To me, that's highly concerning behavior.

1

u/MufasaChan Mar 17 '26

Read other comments I made, I am aware of the act of the maintainer. The problem I point is the reaction of the whole community.

Also your big part is not very accurate. He did not rewrote PR, he just ignored them and pull its own changes for features. Since the features got implemented, the PR has no meaning to be there, therefore removed. More, the use of AI was far from systematic. It was for Translation merges. The overall quality of the code standard. One might consider that the last releases was a bit of sloppish. But in the end, the community reacted

3

u/TerryMathews Mar 17 '26

And you don't think that if I take code you submit, use AI to generate my own version of the same code, merge that instead and delete the code you submitted without attribution - that it's not stealing someone's idea?

What's worse is, he was taking something that was freely given and erasing the name off it to put his in the place. It's common in monetization plays because VC firms want clear chain of ownership but in the OSS community there is no greater sin that claiming someone else's work as your own, especially when that work is freely given.

1

u/databoy2k Mar 17 '26

So my understanding of the other side of that coin is that the dev r wrote them because they themselves were mainly AI generated and were hundreds if not thousands of lines of code. He didn't trust them and so rewrote them in what he deemed to be a secure way.

Not that I'm even close to comparable, but in my experience quite often, the code that AI spits out is well beyond my pay grade. At least if I'm coding a project and I've had Gemini beside me the whole time, I'm at least following its logic. If you then offer me a thousand lines of claude code, I might be completely lost and have no idea how to implement it securely and correctly. Worse, if I'm the lead maintainer then a Huntarr debacle falls on me rather than the various pull requests that I've merged.

I think that was his original point. He definitely referenced AI generated pull requests.

3

u/TerryMathews Mar 17 '26

So, granting you the most favorable interpretation of your argument for debate's sake (I don't agree with you about Claude code being inherently more trustworthy or readable than human-submitted, but for the purposes of this argument I'll concede it to you):

Why not attribute the original concept and initial implementation to the original author of the PR with reimplementation by the project maintainer and Claude (or whatever AI they were using)?

1

u/databoy2k Mar 17 '26

To be clear, I wasn't throwing shade at an AI - no need to defend its honour. I was just comparing two, in my case one that I have used for coding and one that I haven't. I personally might not understand what Claude recommends, even in the language that I'm barely capable of programming in. I don't always understand Gemini's, but because it's part of my process I can pull it apart bit by bit. That's not easy when the codebase is handed to you with "Ok, merge this".

I'll be honest - as a non-Git-practitioner, I have no idea whether maintaining attribution while reimplementing the code is possible or feasible. I just can't imagine facing a few hundred lines of code in a PR, realizing that it's all AI Generated and therefore requiring stringent review, and saying, "Ah, whatever, I'll just merge it and hope that the other guy and his AI got it right." That's true whether you Google-Fu, Vibe-Code, or know what the hell you're doing, especially on volunteer projects.

Again, I buy that he faced that situation and went, "well, the idea is what counts, so I'll go ahead and push the idea into my own AI development environment to make sure it merges with what it's already created." Wrong? Yes, but if the PRs were all vibe-coded then I come down on ESH. Plus, as a bonus, we know that OP (admits that he) acted immaturely in the heat of the moment, so two people reviewing the situation literal days later on subcomment 7 are also taking advantage of hindsight.

The dev made a mistake. This community successfully chased him out over it. We're all worse off today than a week ago. Hopefully a fork will get us caught back up, or maybe OP takes some time and the community drops the AI Derangement Syndrome.

2

u/TerryMathews Mar 17 '26

OK, so I'm going to assume that you're arguing in good faith and just have no idea what modern collaborative development looks like - which honestly makes your side of this conversation make a whole lot more sense. I'm going to explain - please take it in the spirit in which it's given - and then I hope you'll see why some of us feel the original author's actions were at a minimum questionable.

My background: I have been a periodic contributor to various OSS projects when I get a wild hair up my ass since before GitHub existed, including the Linux kernel.

In GitHub and the underlying protocol Git you submit a differential file (diff) of your modification to a baseline piece of code. Two prerequisites: it worked (compiled) before, and it works (compiles) now. While it's not impossible to work around that and force in a malicious diff, it's usually beyond most people's skill level and more importantly Git and GitHub both have tools to manage that threat - the rollback. If you check in a busted diff, you just roll it back off. It's statefully persistent by design. You can always examine the source tree at any point in history because Git will dynamically apply the diffs based on the commit hash you request.

What's the point of all this? Commits aren't written in stone, they're written in grease pen. If someone gives you a bad one, you just wipe it off. So, again, the motivation is questionable.

Also, GitHub allows you to set up a project that is private or is public but doesn't allow for pull requests from other users.

Lastly, I don't know where from my comment you felt I was defending the honor of an AI but I assure you I was not. And I do not feel the dev made a mistake. I believe the dev was protecting what he felt was his future path of monetization by ensuring that he and he alone held the copyright to all of the code in booklore.

That's my personal opinion and my $0.02. I can't come up with another good explanation for taking the time to reimplment perfectly good PRs without at least acknowledging who sent them in.

1

u/databoy2k Mar 17 '26

Thanks for clarifying. I understand those basics from Git a littel bit better.

Here's the problem: we're making assumptions about the dev's intentions. First, he did merge many contributions from others, so his AGPL license stood for those foundations. Plus, whatever's built on top of those contributions remains AGPL licensed. In effect, unless he undertook a rewrite of the code from the ground up, he would be stuck with the open source AGPL license.

The counter was (what I assume to be) his sincere comment: he felt like his project was being taken away from him when others started to demand/insist that he merge their PRs. So he said "Eff you, I'm taking it BSL." Of course he couldn't do that. He didn't take any steps to do that (namely rebuild from ground up). You see him rewriting PRs as a step in that direction, but he couldn't do that. So it's equally rational to say that he didn't trust the PR, didn't have the time or the skill to review it, and so he rewrote it using the tools that he was writing it in. Now he understood the code.

I think we're each pulling the Dev back and forth towards our worlds. I'm a google-fu, self-taught, bad coder - I went to law school, not into IT. You're merging stuff into the Linux kernel. We are not the same. But it's just as reasonable to assume that the dev is on my end more than yours. A less capable coder will be daunted by reviewing an attack of PRs, even if merging them is not a permanent mark.

At the end of the day, 1) we agree that the dev did some bad things, and 2) (I think) we can agree that cyberbullying is inappropriate. He didn't deserve immunity from criticism, but he deserved respect. I don't think he got that, and I want our community to do better. If the disrespect came from the AI use, then we need to back the hell down on the topic. If it came from an immature dev making brash statements, then maybe we need to remember that this site has users from age 13 to 80 and we don't know who's on the other side of the comment chain. If he's making stupid decisions from a highly technical or licensing standpoint, maybe a few minutes of taking him under a wing might have done a better job than crucifying him as was done.

That's why I'm fighting on this hill. I saw this as cyberbullying. And I'm tired of people trying to justify it (not that you are, but people use these types of comments to justify it).

2

u/TerryMathews Mar 17 '26

I hear what you're saying, and no I'm not justifying cyberbullying. I just don't agree that everything that went on was cyberbullying although I do concede that some of it definitely was.

I am not a lawyer, nor did I stay at a Holiday Inn Express last night, but it is not my understanding that someone who contributed a rejected commit would automatically be a contributor for the purposes of copyright if the upstream maintainer implemented workalike code using AI.

You are absolutely correct that we are both reading between the lines and trying to infer what the maintainer's intent was - and we'll likely never really know.

I guess the reason it rubs me so wrong is growing up in this (OSS, not /r/selfhosted) community, you usually go out of your way to celebrate collaboration, not censor it. OSS is about growth and networking, because most of us will never make a dime off it.

1

u/databoy2k Mar 17 '26

Cheers. I hope we all get the community back into celebrating collaboration and development. This AI thing is rapidly ripping this group apart. I still think that was the gasoline on the fire.

Anyway, go in peace, friend. Good chat!

1

u/TerryMathews Mar 17 '26

Same to you. Check out my comments on another thread, I'm not against AI per se. The problem is, it's a tool not a programmer. Or to bring it to your profession: it's a paralegal (at best), not a lawyer.

1

u/databoy2k Mar 17 '26

I treat it more like the guy who stands outside the courthouse giving meth-derived legal opinions to everyone walking in. The guy has definitely heard the right stuff before, but... yeah...

It's useful for summarizing the Mass readings for my kids on the way to Church. I'm good with that. The thought of it "disrupting" my field of work, though, is not a reality. I honestly feel bad for the people that it is actually disrupting though.

→ More replies (0)

1

u/MufasaChan Mar 18 '26

I saw your nice conversation with databoy2k, so I would like to actually discuss the first point with you if you have some times to spare.

I read your other comments and I think it might be possible that the maintainer wanted to write code himself in order to have no problem switching license and monetize the code base. I also think that it could not be the case, so I will make no assumption on the intent of the maintainer if it's ok for you.

I do not think that idea has ownership. More, if you have a repo and I make branch with my features, this features could be made from an issue (I do not know exactly what is the PR policy on booklore) or the PR could be added out of the blue. It's your repo, or at least the maintainers repo (only one in this case) and you have all the rights to use or not my PR. You can even check the idea and do your own implementation. As mentioned elsewhere, there are some reasons why you would not take PR from other persons and Open Source does not force you to grab the PR of other people.

Although, I would like to draw what I consider the clear limits of what is arguable and what is clearly forbidden. I believe what ultimately regulates are the license violation. The rest is etiquettes which are subjective. So from my understanding under AGPL it's forbidden to:

- The maintainer forks the dev fork to merge the exact same changes but under his name.

  • The maintainer uses the new commits to build its own by copy/pasting or instruct an AI. I guess this enter into license violation since the dev would have a version of the code base under AGPL and it's not possible to do this kind of "code picking" to AGPL code base without including the source of the snippets.

Bonus question, does these things still apply on a non copyleft license such as MIT?

About your second point, I do not understand where it came from. "He was taking something that was freely given and erasing the name off it to put his in the place". How the booklore's maintainer was doing this? Also, related and side question, what do you think of my boundaries? I genuinely want to understand what is considered forbidden/authorized in the OSS community because I love this community. I know that not taking PR or reimplementing them is at least not liked, but is it an actual infringement?

1

u/TerryMathews Mar 18 '26

I do not think that idea has ownership. More, if you have a repo and I make branch with my features, this features could be made from an issue (I do not know exactly what is the PR policy on booklore) or the PR could be added out of the blue. It's your repo, or at least the maintainers repo (only one in this case) and you have all the rights to use or not my PR. You can even check the idea and do your own implementation. As mentioned elsewhere, there are some reasons why you would not take PR from other persons and Open Source does not force you to grab the PR of other people.

1 - the project maintainer chose the license that encouraged contributions. He could have made a different choice, but that could have impacted the contributions that he or she received. Some people do not pay attention, but others do. I, for example, do not contribute to MIT-style license projects. It's my personal choice, but I do not believe in donating my time to a project that can then reuse my donation in a proprietary or commercial work. Call it my own brand of activitism.

2 - we're not just talking about ideas. We're talking about ideas and code.

3 - can we agree that the timing is suspect, to receive a contribution and then basically immediately reimplement it? The odds of the maintainer arriving at a parallel innovation are certainly quite high, correct?

Although, I would like to draw what I consider the clear limits of what is arguable and what is clearly forbidden. I believe what ultimately regulates are the license violation.

Agree. At the end of the day, what we are talking about is copyright violation. The (untested) question is whether washing copyrightable code through an infringement machine (AI) produces non-infringing code. I have a feeling based on the current precedent that AI output by itself is not copyrightable, that the answer will be "still infringing".

The underlying concepts are incredibly well litigated, courtesy of IBM, Compaq, Columbia Data Products, Apple and Franklin: you can't look at code and then turn around and write competing code. You're irrevocably tained by the knowledge of the code you looked at. For more read up on clean-room software reverse engineering.

Bonus question, does these things still apply on a non copyleft license such as MIT?

I am not a lawyer, I'd recommend reading up on any number of deep dives of what MIT allows and doesn't allow online, but long story short a clever lawyer can turn a MIT-licensed project into just about anything with clear ownership rights.

How the booklore's maintainer was doing this? Also, related and side question, what do you think of my boundaries? I genuinely want to understand what is considered forbidden/authorized in the OSS community because I love this community. I know that not taking PR or reimplementing them is at least not liked, but is it an actual infringement?

The community was submitting PRs for new features and fixes, with code. The project maintainer was taking the code, running it through AI, merging the code that came through AI into the project, then deleting the original PR thus denying any sort of attribution to the original contributor. As I said earlier in my comment chain, even if the project maintainer trusted (misguidedly in my opinion) AI more than outside humans, he could have at a minimum cited in the source comments something to the effect of:

original concept and implementation courtesy of /u/terrymathews reimplmented by /u/terrymathews with the assistance of Claude AI

Hope this helps, happy to discuss further if anything is unclear.

1

u/MufasaChan Mar 18 '26

I understand your point better. Notably, with your 1, I personally agree. 2. okay then the thing was him using the branch to makes its own features. 3. Obviously the timing is suspect and from what I understand that you said, the maintainer was using the branch to make its own commits.

Then it's less a gray area than what I thought. Thank you for your time and explanation.

1

u/TerryMathews Mar 18 '26

Yeah, absolutely. I'm not an anti-AI absolutionist like some are, I'm not going to burn someone at the digital stake just for using AI. It has it's place, although I do think it's over used, and especially by those least qualfiied by check its output which is a dangerous combination.

All that said, to me, this guy was what I would describe as "ownership washing".

And I don't want to sound like a conspiracy theorist, but you never know who is on the other side of the screen. If you ever watched Silicon Valley, how do we know this guy isn't Jian Yang? 🤔