Hermes - Video Downloader

https://lemmy.world/post/37908767

I appreciate the spirit, but to shine some more light around the negativity you’re seeing in the comments, it’s a lot to ask for others to run your code on their machines. If you want folks to be running in docker, that’s oftentimes basically giving root access.

If I’m giving root access, I’d at least want for the person who wrote the code to have a thorough understanding of what the code, which once again is running as root on my home network, is doing.

The LastPass hack a few years back was enabled by a self-hoster running an outdated version of Plex on their personal machine. There is weight in choosing what software to run and support in your personal setup. The negativity you’re seeing is due to the belief that vibe coding, while able to produce something functional, is not reflective of solid, sustainable, and secure software development practices, and simply does not meet the bar for code to give root access to. It’s (probably) not personal.

virtually all home server setups run docker compose. no one is complaining about Docker, they’re complaaining about AI. The code is immaculate. Its fully tested as well. No one as looked at the code.

Also idk where you heard Docker is like giving root, thats just not correct on multiple levels. If it were a privledged container, which is unnecessary, then we could have a discussion. If you want a daemonless service, use podman. Use anythign you want, the source is there. Docker is not a requirement but is certainly not an issue in any way.

Also since you complained no one looked at your code, you have support for plain text passwords in your code. That’s a huge no no.
Thanks for looking. Make a pr.
Why the fuck would I when your this hostile?

github.com/TechSquidTV/Hermes/blob/…/security.py

Well I think you lied. Only password hashes are stored and verified using bcrypt. I want to see the issue you claim to have found. So, where did you see this security issue you claim I have a responsibility to fix?

Here’s the test that proves user’s are registered with a hash. github.com/TechSquidTV/Hermes/blob/…/conftest.py#…

the user model in the database doesn’t even have a password field: github.com/TechSquidTV/Hermes/blob/…/models.py#L2…

So please, what am I missing?