When you run a self-hosted application, do you first go through and read all the code? I don’t, I’ll tell you that. I’m going to assert that most folks don’t, and unless I hear otherwise I’ll assume you don’t read all the code for every self-hosted application you use.
No one is complaining about Docker, they’re complaining about AI Correct. Saying you “vibe-coded” something up suggests that you didn’t do it yourself, or at least was only loosely invested in it. If you didn’t put much time into it, then it’s not as vetted for folks. Running your code on someones homelab is then akin to pushing the new grads vibe-coded refactor into prod, which I think we all know is a bad idea. The mitigation for that is for the user to vet the code themselves, which we already asserted earlier doesn’t really happen in practice. So we have two options, either push the vibe-coded refactor into prod, or acknowledge that we’ve introduced an additional requirement onto the users to vet the code themselves. The docker issue was just brought up as an example of what could go bad by running poorly vetted code on a machine.
Also idk where you heard Docker is like giving root
If I’m not looking through all the code, then as a user I’ll just be following your included instructions, of which the recommended method is to fire up docker-compose. If docker-compose bind mounted mounted /, my understanding is that the container now has default write-access to the entire host - am I mistaken?
DoPeopleLookHere@sh.itjust.works 1 day ago
Hokay. So docker does run as root. Podman can run rootless, but docker does run as root.
So if you have any vulnerabilities in your code, like say remote code execution, than your app already has access to root.
Also, don’t pretend like your shit don’t stink. My code has bugs. And I’ve been at this a a decade. Your vibe coded thing isnt going to be secure because you probably don’t even know how to make it secure if you don’t know docker runs as root.
Here’s where I interject my opnion
Its fine to do this for yourself. If you wanted to hear how great your AI produced slop go to LinkedIn.
When you share things to be used by others, you have a responsibility yourself. How will you monitor and package up security updates? What kind of depenecinies do you have? Are they up to date? Do they have any CVEs?
There’s so much more to publishing than good intentions. Its fine to do something like this for yourself. But to publish and then absolve yourself of any responsibility is not a way to get taken seriously.
TechSquidTV@lemmy.world 1 day ago
No to be clear, open source code owes you absolutely nothing at all and has zero responsibilities. It’s important that you know that.
papertowels@mander.xyz 1 day ago
Personally, whether or not this will be maintained in the future is the biggest reason why I’m unlikely to try this. If the main developer vibe-coded it up, then in my book there’s a lower chance that the codebase will be maintained in the future.
If your response to “How will you maintain this?” is “nothing is owed”, it really cements the idea that this will not be maintained.
If an application is unlikely to be maintained in the future, then the risk-reward ratio will rarely justify me incorporating it into my workflow.
deleted@lemmy.world 22 hours ago
He did add “make it secure and maintain it” to the prompt so He’s good.
DoPeopleLookHere@sh.itjust.works 1 day ago
And it’s important to know, if that’s your attitude, your gonna get laughed out of every open source circle.
cheesemoo@lemmy.world 1 day ago
Sure, you’re providing some code for free. Obviously you don’t owe anyone anything. But conversely, nobody owes you their time or attention just because you wrote something.
If you want people to actually use your code, you probably need to take some responsibility. And listen to the criticisms others have shared here.
TechSquidTV@lemmy.world 19 hours ago
I never asked for anything