21
submitted 1 month ago* (last edited 1 month ago) by ueiqkkwhuwjw@lemmy.world to c/selfhosted@lemmy.world

According to the release:

Adds experimental PostgreSQL support

The code was written by Cursor and Claude

14,997 added lines of code, and 10,202 lines removed

reviewed and heavily tested over 2-3 weeks

This makes me uneasy, especially as ntfy is an internet facing service. I am now looking for alternatives.

Am I overreacting or do you all share the same concern?

top 50 comments
sorted by: hot top controversial new old
[-] patrick@lemmy.bestiver.se 13 points 1 month ago

It looks like that tool is more or less built by a single developer (you already trust their judgment anyways!), and even though the code came through in a single PR it was a merge from a branch that had 79 separate commits: https://github.com/binwiederhier/ntfy/pull/1619

Also glancing through it a bit, huge portions of that are straightforward refactors or even just formatting changes caused by adding a new backend option.

I'm not going to say it's fine, but they didn't just throw Claude at a problem and let it rewrite 25k lines of code unnecessarily.

load more comments (8 replies)
[-] d15d@feddit.org 7 points 1 month ago

They are not even trusting it themselves. This is from the release notes

I'll not instantly switch ntfy.sh over. Instead, I'm kindly asking the community to test the Postgres support and report back to me if things are working

Fuck that.

[-] MirrorGiraffe@piefed.social 5 points 1 month ago

Classic "test in production" strategy, very solid!

load more comments (2 replies)
[-] november@piefed.blahaj.zone 1 points 1 month ago

Hmm, no, I think I'll just uninstall.

[-] erikjan@fosstodon.org 7 points 1 month ago

@ueiqkkwhuwjw just this quote at the start of the release notes

> 14,997 added lines of code, and 10,202 lines removed, all from one pull request

This is already a major red flag even without the ai stuff right? Can't believe anyone would flaunt that like this.

[-] dev_null@lemmy.ml 2 points 1 month ago* (last edited 1 month ago)

The "single pull request" is a merge release from 79 separate commits. It's the sum of all work, it doesn't mean all of it was changed in one go.

load more comments (2 replies)
[-] notabot@piefed.social 5 points 1 month ago

I'm assuming this is some sort of canary message to indicate that the code base has been compromised, the author can't talk about it, and everyone should immediately stop using the service. Surely no-one would be unwise enough to commit this otherwise?

Even ignoring the huge red LLM flag, a 25kLOC delta in a single PR should be cause for instant rejection as there's no way to fully understand or test it, let alone in 2-3 weeks.

load more comments (2 replies)
[-] powermaker450@discuss.tchncs.de 5 points 1 month ago

ts getting you pinned to 2.17 in the compose file 🥹🤞🥀

[-] hendrik@palaver.p3x.de 4 points 1 month ago

Uh. I'd really prefer if people experimented with new technology a bit more cautiously and not directly jump to "the biggest release [...] ever done".

load more comments (4 replies)
[-] communism@lemmy.ml 3 points 1 month ago

That's concerning. If it was "I generated a function with an LLM and reviewed it myself" I'd be much less concerned, but 14k added lines and 10k removed lines is crazy. We already know that LLMs don't generate up to scratch code quality...

I won't use PostgreSQL with ntfy, and keep an eye on it to see if they continue down this path for other parts of ntfy. If so I'll have to switch to another UP provider.

[-] rozlav@lemmy.blahaj.zone 3 points 1 month ago

there is this repo that lists some slopware : https://codeberg.org/small-hack/open-slopware maybe someone can add it

[-] cecilkorik@piefed.ca 3 points 1 month ago

I think there's room for a little bit of nuance that page doesn't do a great job of describing. In my opinion there's a huge difference between volunteer maintainers using AI PR checks as a screening measure to ease their review burden and focusing their actual reviews on PRs that pass the AI checks, and AI-deranged lone developers flooding the code with "AI features" and slopping out 10kloc PRs for no obvious reason.

Just because a project is using AI code reviews or has an AGENTS.md is not necessarily a red flag. A yellow flag, maybe, but the evidence that the Linux Kernel itself is on that list should serve as an example of why you can't just kneejerk anti-AI here. If you know anything about Linus Torvalds you know he has zero tolerance for bad code, and the use of AI is not going to change that despite everyone's fears. If it doesn't work out, Linus will be the first one to throw it under the bus.

load more comments (3 replies)
[-] WhyJiffie@sh.itjust.works 1 points 1 month ago

did not know that the serde developer tolnay is a military apologist. I'm disgusted. serde is a very good tool.. I'll think about what to do about this. such a shame...

load more comments (2 replies)
[-] osanna@lemmy.vg 3 points 1 month ago

Sigh. Time to switch to gotify

load more comments (3 replies)
[-] phoenixz@lemmy.ca 3 points 1 month ago

I'm a developer

I sometimes sometimes use AI for an answer to a complicated problem because normally I'd open up 20 pages , have to go through them all to find the right answer

AI gets me the answer right away, though it likely is completely wrong or at least partially wrong. Either way, it gives me a general direction and with that I only have to search through one or two pages to confirm, so the same process is just a little faster.

I laso have used AI on a couple of occasions to ask it to write code for a complicated problem. Again, you don't copy the code, god no, it's always the worst, and it is in 80% of the cases still at least riddled with bugs, or just complete bullshit. However, it might give me an alternative idea or a direction to take to implement or fix this complicated feature problem.

That's the extent to which I've used AI and for the foreseeable future that won't change because AI still can't code. It's still wildly flailing around and it might produce something that implements a certain functionality, but it's a guarantee that that functionality will have more bugs and security holes than features

[-] s3rvant@lemmy.ml 3 points 1 month ago

I am also a developer and agree entirely.

Asking for advice, examples or the occasional boilerplate is at most how I use AI and certainly not integrated directly into my IDE.

load more comments (2 replies)
[-] Natanox@discuss.tchncs.de 3 points 1 month ago

Yeah, this is now inherently untrustworthy. Better to switch to an alternative.

load more comments (14 replies)
[-] not_IO@lemmy.blahaj.zone 3 points 1 month ago

we're all so fucked

[-] LiveLM@lemmy.zip 2 points 1 month ago* (last edited 1 month ago)

Look, if he wanted to introduce AI code, whatever, but doing it all at once in a 14k line change is crazy.

Surely it would be better to introduce AI by letting it handle misc changes here and there instead of starting with the "biggest release ever done" (his words), no?

[-] Fmstrat@lemmy.world 2 points 1 month ago

Uovote and comment on: https://github.com/binwiederhier/ntfy/issues/1645

Please add this to the post.

[-] shirro@aussie.zone 2 points 1 month ago

I can see the pragmatic appeal. Maintaining a lot of code for an open source project is thankless. Go is designed for idiots like me so it makes sense that an llm should be able to emit code that mostly works. There are classes of errors that are less likely in Go and the compiler and linting will prevent some foot guns and then it would have been tested.

Ethically I hate anything to do with the llm industry and all it represents. I hate the environmental impacts. The social impacts. The disregard for intellectual property. The devaluing of human effort. The scam economics. I won't use anything touched by it on principle and if that means walking away from a dead Internet so be it. There is enough pre-2020s books, audiobooks, movies, music and code to keep me interested for the rest of my life.

[-] possiblylinux127@lemmy.zip 2 points 1 month ago

I'd run for the hills

There are so many issues with AI

load more comments (6 replies)
[-] nfreak@lemmy.ml 2 points 1 month ago

Definitely time to find an alternative. What the actual fuck is this

[-] Mora@pawb.social 1 points 1 month ago

I switched to Gotify when I ran into an issue where ntfy would delete old api tokens when creating more than 20. Only thing missing in Gotify is UniversalPush, other than that it feels actually more solid than ntfy to me.

[-] uzay@infosec.pub 1 points 1 month ago

Oh ffs..

Thanks for the heads-up

[-] Kushan@lemmy.world 1 points 1 month ago

Fuck, I love ntfy, it's one of the best self hosted push notification systems I've used. It has been flawless so far.

Don't like this.

[-] x00z@lemmy.world 1 points 1 month ago

I'll embrace the inevitable fork.

load more comments
view more: next ›
this post was submitted on 08 Mar 2026
21 points (92.0% liked)

Selfhosted

58589 readers
9 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS