this post was submitted on 08 Mar 2026
468 points (94.5% liked)

Selfhosted

57607 readers
1058 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
 

According to the release:

Adds experimental PostgreSQL support

The code was written by Cursor and Claude

14,997 added lines of code, and 10,202 lines removed

reviewed and heavily tested over 2-3 weeks

This makes me uneasy, especially as ntfy is an internet facing service. I am now looking for alternatives.

Am I overreacting or do you all share the same concern?

top 50 comments
sorted by: hot top controversial new old
[–] d15d@feddit.org 201 points 1 week ago (3 children)

They are not even trusting it themselves. This is from the release notes

I'll not instantly switch ntfy.sh over. Instead, I'm kindly asking the community to test the Postgres support and report back to me if things are working

Fuck that.

[–] MirrorGiraffe@piefed.social 112 points 1 week ago (3 children)

Classic "test in production" strategy, very solid!

[–] Railcar8095@lemmy.world 43 points 1 week ago (6 children)

Test in production is the best. We spent months warning from data bugs and nobody bat an eye (upstream bug, not our responsibility but we noticed) When it was d launched in prod we just pointed out the bug that nobody fixed was still there and immediately a war room was formed and the bug fixed within an hour.

It honestly seems more efficient to let shit hit the fan than to fight everybody to do their job.

[–] x00z@lemmy.world 38 points 1 week ago (1 children)

You're implying a shitty capitalist company that nobody cares for if it burns down. A tool like this though that is self-hosted by a lot of people (29.1k stars on GH!) and that is internet-facing is very different.

[–] Railcar8095@lemmy.world 26 points 1 week ago

Then, let's just call it "massive decentralized surprise testing"

load more comments (5 replies)
load more comments (2 replies)
load more comments (2 replies)
[–] patrick@lemmy.bestiver.se 127 points 1 week ago (8 children)

It looks like that tool is more or less built by a single developer (you already trust their judgment anyways!), and even though the code came through in a single PR it was a merge from a branch that had 79 separate commits: https://github.com/binwiederhier/ntfy/pull/1619

Also glancing through it a bit, huge portions of that are straightforward refactors or even just formatting changes caused by adding a new backend option.

I'm not going to say it's fine, but they didn't just throw Claude at a problem and let it rewrite 25k lines of code unnecessarily.

load more comments (8 replies)
[–] erikjan@fosstodon.org 119 points 1 week ago (5 children)

@ueiqkkwhuwjw just this quote at the start of the release notes

> 14,997 added lines of code, and 10,202 lines removed, all from one pull request

This is already a major red flag even without the ai stuff right? Can't believe anyone would flaunt that like this.

load more comments (5 replies)
[–] hendrik@palaver.p3x.de 107 points 1 week ago (4 children)

Uh. I'd really prefer if people experimented with new technology a bit more cautiously and not directly jump to "the biggest release [...] ever done".

load more comments (4 replies)
[–] Natanox@discuss.tchncs.de 69 points 1 week ago (20 children)

Yeah, this is now inherently untrustworthy. Better to switch to an alternative.

load more comments (20 replies)
[–] phoenixz@lemmy.ca 65 points 1 week ago (7 children)

I'm a developer

I sometimes sometimes use AI for an answer to a complicated problem because normally I'd open up 20 pages , have to go through them all to find the right answer

AI gets me the answer right away, though it likely is completely wrong or at least partially wrong. Either way, it gives me a general direction and with that I only have to search through one or two pages to confirm, so the same process is just a little faster.

I laso have used AI on a couple of occasions to ask it to write code for a complicated problem. Again, you don't copy the code, god no, it's always the worst, and it is in 80% of the cases still at least riddled with bugs, or just complete bullshit. However, it might give me an alternative idea or a direction to take to implement or fix this complicated feature problem.

That's the extent to which I've used AI and for the foreseeable future that won't change because AI still can't code. It's still wildly flailing around and it might produce something that implements a certain functionality, but it's a guarantee that that functionality will have more bugs and security holes than features

[–] s3rvant@lemmy.ml 29 points 1 week ago

I am also a developer and agree entirely.

Asking for advice, examples or the occasional boilerplate is at most how I use AI and certainly not integrated directly into my IDE.

load more comments (6 replies)
[–] notabot@piefed.social 62 points 1 week ago (1 children)

I'm assuming this is some sort of canary message to indicate that the code base has been compromised, the author can't talk about it, and everyone should immediately stop using the service. Surely no-one would be unwise enough to commit this otherwise?

Even ignoring the huge red LLM flag, a 25kLOC delta in a single PR should be cause for instant rejection as there's no way to fully understand or test it, let alone in 2-3 weeks.

[–] ExFed@programming.dev 22 points 1 week ago (2 children)

25kLOC delta in a single PR should be cause for instant rejection

Not to pick at nits, but it would be VERY different if it was 1k lines added and 24k lines removed. There's something extremely satisfying about removing 10k+ lines of unnecessary code.

load more comments (2 replies)
[–] henfredemars@infosec.pub 54 points 1 week ago* (last edited 1 week ago) (2 children)

Definitely share your initial concern. Without strong review processes to ensure that every line of code follows the intent of the human developer, there’s no way of knowing what exactly is in there and the implications for the human users. And I’m not just talking about bugs.

They say it’s reviewed, but the temptation to blindly trust is there. In this case, developer appears to have taken some care.

The code was written by Cursor and Claude, but reviewed and heavily tested over 2-3 weeks by me. I created comparison documents, went through all queries multiple times and reviewed the logic over and over again. I also did load tests and manual regression tests, which took lots of evenings.

Let us hope so. Handle with care to ensure responsibility is not offloaded to a machine instead of a person.

[–] Slotos@feddit.nl 66 points 1 week ago (2 children)

The size of that changeset means that it’s inherently unreviewable.

The commit history is something I’ve seen only in the PRs that even the most dysfunctional companies would demand a rewrite for.

Also, 2-3 weeks review? PostgreSQL support could be added in that time without the need for a damn „vibe check”. Hell, it would probably take less time than that.

load more comments (2 replies)
load more comments (1 replies)
[–] nfreak@lemmy.ml 45 points 1 week ago

Definitely time to find an alternative. What the actual fuck is this

[–] LiveLM@lemmy.zip 43 points 1 week ago* (last edited 1 week ago)

Look, if he wanted to introduce AI code, whatever, but doing it all at once in a 14k line change is crazy.

Surely it would be better to introduce AI by letting it handle misc changes here and there instead of starting with the "biggest release ever done" (his words), no?

[–] rozlav@lemmy.blahaj.zone 38 points 1 week ago (7 children)

there is this repo that lists some slopware : https://codeberg.org/small-hack/open-slopware maybe someone can add it

[–] cecilkorik@piefed.ca 28 points 1 week ago (4 children)

I think there's room for a little bit of nuance that page doesn't do a great job of describing. In my opinion there's a huge difference between volunteer maintainers using AI PR checks as a screening measure to ease their review burden and focusing their actual reviews on PRs that pass the AI checks, and AI-deranged lone developers flooding the code with "AI features" and slopping out 10kloc PRs for no obvious reason.

Just because a project is using AI code reviews or has an AGENTS.md is not necessarily a red flag. A yellow flag, maybe, but the evidence that the Linux Kernel itself is on that list should serve as an example of why you can't just kneejerk anti-AI here. If you know anything about Linus Torvalds you know he has zero tolerance for bad code, and the use of AI is not going to change that despite everyone's fears. If it doesn't work out, Linus will be the first one to throw it under the bus.

load more comments (4 replies)
load more comments (6 replies)
[–] not_IO@lemmy.blahaj.zone 32 points 1 week ago

we're all so fucked

[–] Nalivai@lemmy.world 32 points 1 week ago (5 children)

This doesn't make me uneasy. It makes me resentful, a little angry, and a lot tired. Thanks for bringing it to attention, I will make sure that nothing of that project or from that author will ever cross my ecosystem again.

load more comments (5 replies)
[–] kevinwells@lemmy.world 30 points 1 week ago (2 children)

I just set up a ntfy server for Unified Push earlier this week to use with Matrix. Now I have to turn around and immediately replace it...

load more comments (2 replies)
[–] poVoq@slrpnk.net 30 points 1 week ago* (last edited 1 week ago) (4 children)

If you use ntfy mainly as a Unified Push distributor on Android, then I highly recommend switching to a XMPP client that can do the same.

load more comments (4 replies)
[–] Kushan@lemmy.world 27 points 1 week ago

Fuck, I love ntfy, it's one of the best self hosted push notification systems I've used. It has been flawless so far.

Don't like this.

[–] uzay@infosec.pub 26 points 1 week ago

Oh ffs..

Thanks for the heads-up

[–] shirro@aussie.zone 26 points 1 week ago (1 children)

I can see the pragmatic appeal. Maintaining a lot of code for an open source project is thankless. Go is designed for idiots like me so it makes sense that an llm should be able to emit code that mostly works. There are classes of errors that are less likely in Go and the compiler and linting will prevent some foot guns and then it would have been tested.

Ethically I hate anything to do with the llm industry and all it represents. I hate the environmental impacts. The social impacts. The disregard for intellectual property. The devaluing of human effort. The scam economics. I won't use anything touched by it on principle and if that means walking away from a dead Internet so be it. There is enough pre-2020s books, audiobooks, movies, music and code to keep me interested for the rest of my life.

load more comments (1 replies)
[–] osanna@lemmy.vg 25 points 1 week ago (3 children)

Sigh. Time to switch to gotify

load more comments (3 replies)
[–] powermaker450@discuss.tchncs.de 24 points 1 week ago

ts getting you pinned to 2.17 in the compose file 🥹🤞🥀

[–] x00z@lemmy.world 23 points 1 week ago

I'll embrace the inevitable fork.

[–] possiblylinux127@lemmy.zip 23 points 1 week ago (11 children)

I'd run for the hills

There are so many issues with AI

load more comments (11 replies)
load more comments
view more: next ›