Have you ever found a GitHub project or anything that seemed nice and tempting to install until you dug a bit deeper?
What are some red flags that should detur anyone from installing and running something?
You must log in or register to comment.
Evidence of vibe-coding. Em dashes and emojis sprinkled throughout the documentation? Code with inline comments pointlessly describing some change, as if you want to know what that block of code used to do more than what it actually does?
It’s vibe-coded garbage by someone who doesn’t know how to code. Stay far away.
inline comments pointlessly describing some change, as if you want to know what that block of code used to do more than what it actually does?
Oh, shit, am AI.
Same, but only after my boss decides to change the functionality for the third time in half a year.
Exactly. I worked on a interface where the elements where shift under conflicting business interests. The comments where a log of dates, person, and what they asked for as we worked on our side to build a case against the insanity.
The comments listed not only what it clearly did but also what it had previously done. Then inevitably something comes in hours before a launch window and that part does not get its comment updated.
cough huntarr cough
Yeah, that… I feel really bad for anyone who trusted and implemented it. The sheer level of exposure with that was mind-blowing. I mean, an endpoint you could hit and just… Get all the API keys?
For anyone who doesn’t know, this write-up is a good one: https://gigcitygeek.com/2026/03/08/huntarr-api-security-risk/
Long story short, a vibe-coded security nightmare for anyone foolish enough to trust it.
the fucking bouncing arrow at the bottom of the page is insufferable
Emoji ridden repos just scream scam to me, too. I feel like people who genuinely want to make an app and actually keep it maintained wouldn’t resort to AI slop code or even a description.
Omfg Gemini loves to add tons of comments on already self explanatory code. It’s super annoying.
I have a solution to that:
🌈✨ Stop using AI to code. ✨🌈
That ship has sailed. The question is how to use AI to code, for every project there’s a sweet spot and it rarely is 0% or 100%.
You really don’t need to. Nobody is forcing you.
And if they are, seriously considering finding another place of work.
Good luck finding a tech company that isn’t forcing devs to use AI.
Uh, I’m working at one.
That was quick.
Are they hiring?
And? I didn’t say it was impossible. I said “good luck”
I very much enjoy using AI for all the biloilerplate, test cases, suggestions, etc. It really makes me more productive, hard metrics behind it. Nobody is forcing me to, they just provide the license and let us use our judgment.
I honestly can’t think of a project where 0% AI would be better. For 100% maybe a very trivial PoC, but even that would require at least a code revision.
So, as with many things, use in moderation is fine.
It’s almost certainly also making your code worse.
It’s not impossible to use AI effectively (although I would argue it’s impossible to use large “frontier” models ethically, as the companies making them are burning the planet down to power the process), but you have to be extremely vigilant and thoughtful about what you’re using it for, and you have to review every single line of code it produces, or you’re going to miss bugs and you’re going to lose skills.
A good way to test yourself is to see if you can still scaffold out an application by hand. Doesn’t matter what… A to-do list, some buttons, whatever. Just test yourself to see if you can still do it.
If you can’t, then you’ve lost the skills necessary to be certain that what you’re producing with AI is actually good.
And if the idea of testing yourself like this makes you uncomfortable? Then AI isn’t a tool you use, it’s an addiction.
I mean, I do leet code semi-regularly, so I’m not too worried about getting rusty. Writing tests is boring as hell, the AI does a decent enough job for at least 90% of them.
I’d be curious to see what your hard metrics are based on.
https://mikelovesrobots.substack.com/p/wheres-the-shovelware-why-ai-coding
Points per sprint, features shipped, test coverage. Defects remain unchanged.
Whenever they start with “I built XXX”. People who write their own code say “I wrote”.
Eh, disagree on that one. Even if I write every bit of the code myself, producing good working software involves a lot more than just writing code. Just makes “building” feel like a better descriptor.
You may be the exception to the rule :)
The build is failing on main. Or they don’t have a build process at all.
Ah, sounds like my workplace.
The size of the download button
“Ads, In-App Purchases”
That game is gonna be full-on enshitification.
I’ll see that and raise you a “app is free, but all functionality is paid, which you only find out after you have used the app for its intended purpose and now want the results of the work that you did, specifically when attempting to rescue files from your phone, for instance.”
I’ll also toss in “all functionality is paid on a subscription model that automatically renews unless you manually disable it and you have to buy at least in one year increments”
I really like the ‘free trial’ that requires your CC information and will begin billing you ‘soon’ unless you remember to cancel (and probably burn the card too).
Yeah, in app purchases.
Goddamn! Had this one with “smartdraw.com” lately. I had to draw up a map of our property for a buidling permit, so I looked for an appropriate tool. Spend 3 hours drawing a layout. but turned out I can’t export the drawing unless I buy a year subscription of 8 dollars per month. Fuck them and fuck subscriptions! I downloaded LibreCAD and learned the basics of that.
That’s not the case at all. For ads, perhaps, but in application purchases? Many games (especially free to play games, of which there are many excellent ones) have purchases you can make in the game.
Helldivers 2 is an excellent game, and that has DLC packs and individual items you can purchase in game. So does World of Tanks (which is also free to play).
Even some perfectly normal applications have that tag, because there’s a shareware version (maybe with a launch nag “Ad”) and the full paid version (which may only cost a few quid), that you can upgrade to from within the free version. It still counts, even if it’s just a one time thing.
There are many scummy practices some game/application makers employ using ads or in-app purchases, but many don’t, and both types have that sort of label applied.
Honestly, I see that label applied to basically everything these days, so I just ignore it and judge the application based on the nuance of how their monetisation is presented.
Are you really using world of tanks as a good example of in app purchases?
If I can remove the ads, and unlock pro features with a one time purchase, sure, but if the app is charging me monthly, that’s a deal breaker.
“A user you’ve blocked has previously contributed to this repository.”
Where that user is Claude? I think that’s the only username in my blocklist.
“releases” on a GitHub repository containing no code
Support only through a Discord server
Especially in the homebrew/modding world some even only distribute their stuff over discord. Which is an extra level of stupid. Dont think anything else can beat this.
Stalker Gamma comes to my mind, for that you had to join a discord in order to access the launcher, that launcher would auto download and install a bunch of mods for Stalker Anomaly into one big modded game.
Soma Assetto Corsa mod packs were only available to download through Discord, it was awful
I recently deleted my Discord account. This is an immediate nope for me.
Sadly way too many niche groups there and also fb for me to delete. I’d have nothing otherwise.
I just interact as little as possible and never install their software.
Having no documentation. Documentation is essential. A blurb about what it is and how to build it doesn’t count. And please, integrate it with the software, OS, or at least distribute a readme alongside. So much software assumes you have a 100% stable internet connection for online help.
User manuals, I remember those, fondly. Unfortunately a pretty dead concept these days, but certainly a green flag if there is one, but absence is not a red flag.
A readthedocs.io entry is also a green flag (you can always download it for later offline…).
“Update/Accept or Remind me later”
Requires cloud connectivity.
The install process requires one of:
- Running a command with npm
- Manually compiling binaries from source
- Manually installing dependencies
These aren’t bad per-se, but my experience has led me to associate these with spending a bunch of time trying to resolve errors and having to give up in the end and not install the software after all, so if there’s any alternatives that I could use I am trying those first.
Sometimes compiling is painless.
But if it throws any errors, I’m out.
A requirement.txt that doesn’t list versions. Especially if it has pytorch. I’ve fought dependency issues for too long with projects like that.
all the academic code
Omg. As soon as I see npm, I nope out. So so so so so many dependencies, broken this, not working that. I’m over it.
Supply chain attacks are a bitch.
"To use program xyz, sign up!
“Ask me later” instead of “no”
-
It’s not already in my distro’s package manager
-
A github project with 1000 open issues and no commits for 3 years.
Ubuntus package repo is so out of date though. It’s such a pain in the ass.
You clearly haven’t seen Debian stable.
-
