Comment on This Looks kinda cool, but does anyone have any experience at vetting a project like this?
i_stole_ur_taco@lemmy.ca 3 days ago
I think the author literally released it like 2 days ago which is why there’s no issues or prs yet.
I installed it yesterday and have only fiddled around a little bit. I like that it pointed out a bunch of health issues with my Lidarr library and have been stuck on a side quest dealing with those.
If you want to explore it and see if anything seems malicious to you, I’d focus on code making requests, and review the sub-dependencies to see if any look sus. It should live entirely in your network and shouldn’t be making any external requests outside your server apart from the connections you set up (like last.fm).
fleem@piefed.zeromedia.vip 3 days ago
the reason i pumped the brakes, was an issue filed yesterday by a brand new user and closed by the owner. asking why it was sending a bunch of network requests somewhere random. then it was edited for content and the name of the issue was changed by the owner and closed.
my spidey sense pricked up? but I’m just an old stoned n00b so i wanted to hear what the old stoned wizards thought
i_stole_ur_taco@lemmy.ca 3 days ago
Ohh that’s suspicious. I’m going to kill mine for now and take a look later tonight. I’ll report back if I find anything interesting!
i_stole_ur_taco@lemmy.ca 3 days ago
Ok, so I ran the repo through an LLM to look for any suspicious requests, and it came back clean.
But it’s hella suspicious that the repo owner edited away the issue and closed it without a response.
It’s also hella suspicious that the user that reported that issue created their account yesterday.
I think I need to go the nuclear option: pop a gummy and monitor the network traffic of the container and see what it’s doing.
fleem@piefed.zeromedia.vip 3 days ago
o7 godspeed! i appreciate you your effort. the spirit of this project does sound so cool so i was a little heartbroken.
enjoy the edible!
lena@gregtech.eu 3 days ago
Issue in question: github.com/aquantumofdonuts/mixarr/issues/7
fleem@piefed.zeromedia.vip 2 days ago
Welp, that issue has “officially” been deleted, as well as a followup issue asked by another person asking about that first issue feeling fishy.
hoppolito@mander.xyz 2 days ago
While a full ‘deletion’ of such an issue is certainly unfortunate, I can kind of see how it gets to such a decision point.
You’re creating some software in the open, decide to ping some communities on reddit/lemmy and all of a sudden it seems like a disgruntled brigade is breaking down your door while you just wanted to show them the garden.
What for us looks like earnest sleuthing can feel like abuse/harassment from the other side simply due to the asymmetrical nature of the internet.
Would have probably still preferred a closed issue instead, but having a couple ‘niche-successful’ repos on github myself - I can at least certainly empathise.