For about a year as a hobby I've been writing an app that scratches several itches that I've had with the fediverse (multiple accounts at once, supporting both microblog- and threaded-style content, synthetic/hybrid feeds, etc.) and for the past month or so have been using it exclusively on the desktop and about 50% of the time on mobile (Voyager is my main mobile client and source of inspiration here). I'd like to open source the whole thing. But the code is mine, therefore buggy and bad. Normally I'd not worry too much about that, but in the age of LLM attacks I don't want to contribute more security vulnerabilities to the world. Should I use an LLM security tool to analyze my code and point out security issues so I can patch them before releasing the code? If so that would more or less be the only AI contribution. I'm a practical-minded person and use AI tools at work so it doesn't bother me, but I know lots of people here have strong (and often helpful) opinions on the matter.

you are viewing a single comment's thread
view the rest of the comments

[–] Hoimo@ani.social 1 points 11 hours ago

If you're the only one using it, you could just publish the source and let us review it. Worst case we find some terrible flaw and you have to stop using it for a bit while you fix it.

But I can't imagine any big vulnerabilities in a local frontend anyway? I'd be more worried about accidentally sending/resending requests and generating unnecessary load for the server. For authentication it's hard to mess up as long as you're not sending passwords to servers other than the one you're trying to log in.