[object Object]

This is censorship manifest!

I think most people would have been fine with like a ublock style collection blocklists they could enable or disable and subscribe to, the problem was hiding it and doing it unilaterally.

Putting in a DDOS tool is just another signal this person isn’t mature enough to be trusted with your computer.

This is why they restrict Mythos and similar.

They want the vulnerability machine, and they don’t want you to have it.

Hurray! Compressing and not using it, so you have a massive increase in disk use for no fucking reason.

Oh, and every container that uses PyTorch needs to download the full 7 gigabytes instead of sharing.

Man, why did they buy Tenor just to kill it?

What the fuck.

I love that Claude.md file, fucking awesome.

AI is great, I use it to get started quickly, and then I delete a bunch of it and replace it with human approved and purposeful code.

The other day I used it to write a slugify method. I didn’t think I needed a full library imported for that, and with AI that was a 30 second task, including tests. Great.

Then later that day the AI wrote an API for me. The AI design hid potentially async code in a synchronous block and it butchered the control flow, so I rewrote it to give the caller control over how the code was executed. The result is exactly what I needed, and easy to use plus maintain. Also great.

The difference between that and slop where I never even review the file is massive! I like your power tool analogy. Yeah, I could use the spokeshave… or I could just use a router. But if you’re building a jig to turn your table saw into a jointer you might wanna take a step back and ask what you’re really doing here.

For posterity because I didn’t explain why/how it’s sketchy:

• they just found a hardcoded key that skips all security that was in the wild for like two years
• significant vibe coding means nobody actually understands the codebase. Hence not finding the backdoor key
• some of the documentation is only in Chinese, which isn’t sketchy in itself, but given the backdoor key does seem fucking sketchy.
• they have an X link you cannot remove from the admin console
• the admin console has minor but stupid bugs: you can’t go from a bucket to the list of buckets, auth is janky, etc.

Just because it’s good a good name doesn’t make it good pedigree (which is a bone I have with rustXYZ named projects). The fact nobody caught serious backdoors for years is damning.

If you’re running this offline, it might be fine for you. I still run it inside my vpn behind auth but I’m looking to move off.

Rustfs is sketchy as fuck though.

Where they lose comparability they have a good explanation too

Yes, it’s helpful

That’s fair, I won’t pretend pypi/pip and running uvx is much safer than npx.

But why hasn’t JavaScript established a defacto stdlib to replace ask the left pads and is even type packages?

I’ve taken a near zero dependency policy on my personal projects regardless, and now I run most code in containers to sandbox it.

I think npm allows installation scripts which do make this worse, as a package can run arbitrary command at install time.

Can we stop using npm now?

I swear to god the number of attacks like this or spawned from other attacks like this is fucking stupid. I’ve gender seen anything like it.

That home server thing is very expensive. I know it’s ECC, but that’s a lot for 16gb ram and no GPU.

I am looking for a NAS I can drop some existing WD Red drives into but that’s a lot. They came in a WD MyCloud but that’s thing is a privacy risk and is dog slow despite being hooked directly into a gigabit port.

I have compose and a justfile, that’s enough documentation for any project, right??

Wasn’t the vim maintainer similar dismissive of the community for like a decade before neovim forked and rewrite the entire plugin layer and async layer?

Even with problems things could have improved.

Probably not a lot.

My system idles at 3gb.

But then I do AI stuff and it needs 15-80gb. And I do data analyses that can use a lot.

Good code has always been about simplicity, taste, and understanding.

If a human provides understanding and taste, they can elevate AI code to be good.

Likewise if an AI isn’t well guided it won’t understand, has no taste, and will generate overly complex code. AKA Slop.

It feels like there’s a meta-discussion to be had about AI disclosure and AI use in a lot of these projects and it’s starting to boil over.

I would suggest that maintainers should:

• Add an AI disclosure in their readme, which is what I do on my projects. If you don’t like AI then it’s on the tin and you can avoid it – explicit is always better than implicit.
• Provide guidelines on AI contributions to their project. Every project needs an AI contribution policy now because we live in a world where most devs do use AI code gen. If you accept a patch from a community user it’s probably been touched by AI.
• Detail their AI workflow, but specifically how they review this code. I can only really work and review at a file-at-a-time pace so that 100% of AI code is reviewed by me, in detail, and it’s up to my standards.

When it comes to existing projects that start adding AI contributions it’s always going to be difficult. It’s not something projects started with even the option of, there’s no way to get consent from your users (nor consensus on whether you should you get their consent), and there have been varying levels of AI code gen for years now from simple completions to now agentic vibe coding.

I’ll be honest, most of my own projects use AI generated code, and I use it for work. It’s never code I couldn’t have written myself – because if it were how could I review it? But the fact is, in the year 2026 AI code generation is both fast, usable, and it’s near ubiquitous. There are tasks I could work on for weeks that I can build plus review in a couple of hours with AI. It’s very hard to argue with that, and I’m a very picky coder+reviewer with a full time job.

And lastly, for the community we all need to be mindful of open source maintainers.

They work hard, for free, and get treated like shit by users, the law, and big corporations. There’s a new generation of people who sign up for code hosting services just to request features or complain in your git issues, they’re opening up slop PRs and emailing you. Plus, internet users love to pile on and harass people.

Please remember there’s (usually) a human made of meat at the end of the intertubes, and when 100s of people write mean/abrasive things it adds up. Nobody is perfect, open source devs are just trying to share and help.

PS for mods: I saw there was another thread on another app using AI that was locked as off topic, I am trying to be constructive in this comment, but if it’s off topic/too divisive I understand.

Don’t let perfect stop you from achieving good.

It’s not radioactive waste, it’s code. You can read it, write it, change it. Just like any legacy codebase it’s full of shit, and maintaining means addressing the specific issues.

I gotta spruce mine up, this is excellent.