14 ms·

>How come this is trying to install its own vendored dependencies, including executable binaries, instead of checking for what's already installed? That approac

>How come this is trying to install its own vendored dependencies, including executable binaries, instead of checking for what's already installed? That approach can lead to both security and performance issues. Because the person who vibecoded this had no idea they should have been doing that.

user34283 7mo ago
Personal attacks directed at people who build OSS are not cool, even if you take issue with their supposed use of AI or vendoring of dependencies.
- bheadmaster 7mo ago
  Vibe coders are NOT programmers, they are leeches, feeding from the blood of the open source.
  - stavros 7mo ago
    Yeah yeah. This app is open source too.
    - bheadmaster 7mo ago
      That's even worse, they're polluting the open source space with AI slop. Anyone learning from open source will not learn anything useful from it.
      - stavros 7mo ago
        Man, nobody is learning anything any more, those days are gone. Programming with actual code is a niche hobby or a hyperspecialized profession now, like demoscene coders. Besides, even before LLMs, it's not like anyone ever said "you shouldn't have open sourced this, we can't learn from your code". We just didn't bother reading that code. Telling off people who contribute is not OK.
        bheadmaster 7mo ago
        AI slop is not a contribution.
        stavros 7mo ago
        [flagged]
        bheadmaster 7mo ago
        Nice detective work in an attempt to... ridicule my programming skills, I suppose? It's a useful tool and I built it myself, with my own ten fingers, using my brain. That's more than vibe coders will ever do. Meanwhile, your blog says in big text "I don't care for the joy of programming", so I don't consider your opinions on software development anywhere near relevant.
        stavros 7mo ago
        Excellent, on that we can agree.
        bheadmaster 7mo ago
        Good.
        shimman 7mo ago
        Thank you for being a human that defends their craft against the wanton destruction wrought by VC + SV. They are destroying the planet to solve problems that don't exist.
        cynicalkane 7mo ago
        This is a really embarrassing post. You stalked the author's online presence, turned up a TCP bridge utility, not really relevant to anything, and tried to shame the author for writing it, all so you can pretend you won an argument on the Internet?
  - user34283 7mo ago
    I doubt that you know the OP's background and knowledge. If someone on here would direct at me the insinuation that a flaw in my software was the result of me having "no idea" about what I am doing, we would not be having a civil discussion. In my view personal attacks should be flagged, but I don't have that ability because my account does not have enough Karma.
    - bheadmaster 7mo ago
      Look at the commit history. Vibe coded in 10 days, with obvious AI generated commit messages. Look at the diffs. If you can't tell AI slop from handwritten code, that's your problem. I won't censor myself because of your opinions.
      - user34283 7mo ago
        There is no need for me to look at "obvious AI generated commit messages" or check whether the code is handwritten. Personal attacks are still against the rules of this site, and that's why you, or in this case the commenter before you, should have censored themselves. This is not a matter of opinions.
        bheadmaster 7mo ago
        Calling a duck a duck is not a personal insult, no matter how much the duck dislikes being called a duck.
        shimman 7mo ago
        It reminds me of the billionaires that like to constantly tell people they could have "studied physics" when it's so obvious they would fail out of any intro calculus class (let's also ignore that they could easily pay for the top tutors to "study physics") but just want to code as smart and not come across as a moron, you're going to see the same thing with vibe sloppers too.
solvik 7mo ago
It’s a desktop app for mostly non-technical users, so bundling the runtime is a deliberate tradeoff to reduce setup friction and machine-specific breakage. That said, an optional “use system environment if available” mode could make sense for advanced users. A PR for that would be welcome, as long as it also handles the real complexity involved: platform differences, Python package compatibility, GPU backends, and missing system/compiler flags.
- Gormo 7mo ago
  > It’s a desktop app for mostly non-technical users, so bundling the runtime is a deliberate tradeoff to reduce setup friction and machine-specific breakage. That's not a very reasonable justification, considering that dynamic linking of dependencies has been industry standard in software designed for "non-technical users" for the past thirty years or so, and is basically a solved problem. I can understand having a downloadable archive that already includes things like FFMpeg and Python for Windows users (with everything already included in appropriate locations, so no runtime downloads necessary). But this is an especially bad practice for Linux, since most of the vendored dependencies are already installed by default on pretty much every Linux distro, and package managers are designed to sort out and install appropriate dependencies on behalf users, so that the "non-technical" among them aren't exposed to the massive risks of having application software retrieve and execute arbitrary binaries from the internet. The only thing it somewhat makes sense for would be the AI models it's retrieving, but even that ought to be implemented via a separate download/update script and not just baked into the main application runtime without even prompting the user that it's about to download a huge dataset. > A PR for that would be welcome, as long as it also handles the real complexity involved: platform differences, Python package compatibility, GPU backends, and missing system/compiler flags. These are the sort of things that config scripts at build time are designed to handle. It's already using Cargo here, which should be able to handle all of this just fine, so it's very perplexing to see that it isn't being used for this purpose, and what should be build-time dependency resolution is instead being palmed off to the application itself at runtime. That is an extremely strange -- and potentially dangerous -- approach.
  - marssaxman 7mo ago
rzzzzru 7mo ago
hey both! thanks for your feedback and reports, I'd be happy if they are added as issues on github. as said in the separate comment, I really wanted an app to be as "grandma-proof" as possible, therefore I really wanted to have one binary that does the magic for you. it's a karaoke app, not a tool that is aimed at engineers. we can indeed look at the local packages before downloading an executable, it's just not done yet but might be added in the future. I've built this project out of passion and it's 100% open-source and free, so please keep this in mind when criticizing.
- mentalgear 7mo ago
  While I can understand that, why not replace python deps with wasm versions ?
  - rzzzzru 7mo ago
    Simply because I was not aware of this option, that's it. Happy to consider it and also happy to receive contributions.
- Gormo 7mo ago
  > I really wanted an app to be as "grandma-proof" as possible, therefore I really wanted to have one binary that does the magic for you. Probably the best way to do that is to design, build, and distribute it like any other normal desktop application, and not come up with idiosyncratic and experimental methods for invoking bog-standard libraries and language interpreters. On Windows, just include the necessary binaries as part of the application distribution itself, in hardcoded paths, without any runtime download of executables from unclear sources. On Linux, use system defaults resolved at build time through a normal config script -- any "grandma users" on Linux will end up installing from distro repos, AppImage, Flatpak, etc, all of which have their own methods for handling dependencies, and is definitely not something the application should be trying to do by itself post-install.
  - rzzzzru 7mo ago
    noted, mate, and thanks for the feedback, really! I'm not experienced in building desktop apps per-se, so I went with the thing that looked reasonable to me. all your comments are valid tho. I'll take a look how can I resolve this in the future. cheers!

user34283 7mo ago

Personal attacks directed at people who build OSS are not cool, even if you take issue with their supposed use of AI or vendoring of dependencies.

bheadmaster 7mo ago
Vibe coders are NOT programmers, they are leeches, feeding from the blood of the open source.
- stavros 7mo ago
  Yeah yeah. This app is open source too.
  - bheadmaster 7mo ago
    That's even worse, they're polluting the open source space with AI slop. Anyone learning from open source will not learn anything useful from it.
    - stavros 7mo ago
      Man, nobody is learning anything any more, those days are gone. Programming with actual code is a niche hobby or a hyperspecialized profession now, like demoscene coders. Besides, even before LLMs, it's not like anyone ever said "you shouldn't have open sourced this, we can't learn from your code". We just didn't bother reading that code. Telling off people who contribute is not OK.
      - bheadmaster 7mo ago
        AI slop is not a contribution.
        stavros 7mo ago
        [flagged]
        bheadmaster 7mo ago
        Nice detective work in an attempt to... ridicule my programming skills, I suppose? It's a useful tool and I built it myself, with my own ten fingers, using my brain. That's more than vibe coders will ever do. Meanwhile, your blog says in big text "I don't care for the joy of programming", so I don't consider your opinions on software development anywhere near relevant.
        stavros 7mo ago
        Excellent, on that we can agree.
        bheadmaster 7mo ago
        Good.
        shimman 7mo ago
        Thank you for being a human that defends their craft against the wanton destruction wrought by VC + SV. They are destroying the planet to solve problems that don't exist.
        cynicalkane 7mo ago
        This is a really embarrassing post. You stalked the author's online presence, turned up a TCP bridge utility, not really relevant to anything, and tried to shame the author for writing it, all so you can pretend you won an argument on the Internet?
- user34283 7mo ago
  I doubt that you know the OP's background and knowledge. If someone on here would direct at me the insinuation that a flaw in my software was the result of me having "no idea" about what I am doing, we would not be having a civil discussion. In my view personal attacks should be flagged, but I don't have that ability because my account does not have enough Karma.
  - bheadmaster 7mo ago
    Look at the commit history. Vibe coded in 10 days, with obvious AI generated commit messages. Look at the diffs. If you can't tell AI slop from handwritten code, that's your problem. I won't censor myself because of your opinions.
    - user34283 7mo ago
      There is no need for me to look at "obvious AI generated commit messages" or check whether the code is handwritten. Personal attacks are still against the rules of this site, and that's why you, or in this case the commenter before you, should have censored themselves. This is not a matter of opinions.
      - bheadmaster 7mo ago
        Calling a duck a duck is not a personal insult, no matter how much the duck dislikes being called a duck.
        shimman 7mo ago
        It reminds me of the billionaires that like to constantly tell people they could have "studied physics" when it's so obvious they would fail out of any intro calculus class (let's also ignore that they could easily pay for the top tutors to "study physics") but just want to code as smart and not come across as a moron, you're going to see the same thing with vibe sloppers too.

solvik 7mo ago

It’s a desktop app for mostly non-technical users, so bundling the runtime is a deliberate tradeoff to reduce setup friction and machine-specific breakage. That said, an optional “use system environment if available” mode could make sense for advanced users. A PR for that would be welcome, as long as it also handles the real complexity involved: platform differences, Python package compatibility, GPU backends, and missing system/compiler flags.

Gormo 7mo ago
> It’s a desktop app for mostly non-technical users, so bundling the runtime is a deliberate tradeoff to reduce setup friction and machine-specific breakage. That's not a very reasonable justification, considering that dynamic linking of dependencies has been industry standard in software designed for "non-technical users" for the past thirty years or so, and is basically a solved problem. I can understand having a downloadable archive that already includes things like FFMpeg and Python for Windows users (with everything already included in appropriate locations, so no runtime downloads necessary). But this is an especially bad practice for Linux, since most of the vendored dependencies are already installed by default on pretty much every Linux distro, and package managers are designed to sort out and install appropriate dependencies on behalf users, so that the "non-technical" among them aren't exposed to the massive risks of having application software retrieve and execute arbitrary binaries from the internet. The only thing it somewhat makes sense for would be the AI models it's retrieving, but even that ought to be implemented via a separate download/update script and not just baked into the main application runtime without even prompting the user that it's about to download a huge dataset. > A PR for that would be welcome, as long as it also handles the real complexity involved: platform differences, Python package compatibility, GPU backends, and missing system/compiler flags. These are the sort of things that config scripts at build time are designed to handle. It's already using Cargo here, which should be able to handle all of this just fine, so it's very perplexing to see that it isn't being used for this purpose, and what should be build-time dependency resolution is instead being palmed off to the application itself at runtime. That is an extremely strange -- and potentially dangerous -- approach.
- marssaxman 7mo ago

rzzzzru 7mo ago

hey both! thanks for your feedback and reports, I'd be happy if they are added as issues on github. as said in the separate comment, I really wanted an app to be as "grandma-proof" as possible, therefore I really wanted to have one binary that does the magic for you. it's a karaoke app, not a tool that is aimed at engineers. we can indeed look at the local packages before downloading an executable, it's just not done yet but might be added in the future. I've built this project out of passion and it's 100% open-source and free, so please keep this in mind when criticizing.

mentalgear 7mo ago
While I can understand that, why not replace python deps with wasm versions ?
- rzzzzru 7mo ago
  Simply because I was not aware of this option, that's it. Happy to consider it and also happy to receive contributions.
Gormo 7mo ago
> I really wanted an app to be as "grandma-proof" as possible, therefore I really wanted to have one binary that does the magic for you. Probably the best way to do that is to design, build, and distribute it like any other normal desktop application, and not come up with idiosyncratic and experimental methods for invoking bog-standard libraries and language interpreters. On Windows, just include the necessary binaries as part of the application distribution itself, in hardcoded paths, without any runtime download of executables from unclear sources. On Linux, use system defaults resolved at build time through a normal config script -- any "grandma users" on Linux will end up installing from distro repos, AppImage, Flatpak, etc, all of which have their own methods for handling dependencies, and is definitely not something the application should be trying to do by itself post-install.
- rzzzzru 7mo ago
  noted, mate, and thanks for the feedback, really! I'm not experienced in building desktop apps per-se, so I went with the thing that looked reasonable to me. all your comments are valid tho. I'll take a look how can I resolve this in the future. cheers!