79
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 30 Jul 2026
79 points (100.0% liked)
Free and Open Source Software
22743 readers
17 users here now
If it's free and open source and it's also software, it can be discussed here. Subcommunity of Technology.
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 3 years ago
MODERATORS
Not sure how important this is to anyone, but this does look as though it was heavily leveraging Claude and Cursor. May not be a bad thing, depending on the dev's usage of those agents, but I do think it's important to know.
regardless of whatever else you think about AI, it's a good idea to be very wary about security-sensitive apps that are written using LLMs.
there's a self-hostable S3 replacement called RustFS, with development that leans heavily on LLMs.
they had a security vulnerabilty last year.
one LLM-written commit added a complete authentication bypass to the code. literally, you could just send
rustfs rpcas the auth token instead of an actual token.it was fixed in a pull request named fix: Prevent panic in GetMetrics gRPC handler on invalid input which claimed to fix a different auth problem and just coincidentally removed the hardcoded auth token.
security stuff is hard, and LLMs are prone to over-confidence. that's a bad combo.