this post was submitted on 22 Jul 2026
313 points (99.7% liked)
Programming
27863 readers
281 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
while I agree with the sentiment. what if someone just sloppily hand-coded an insecure docker container, should you be able to kick that off too? I fear security isn't a good baseline to decide if a project should be hosted because security is a gradient and it becomes very subjective to say what constitutes secure. following that, would you give remediation opportunities for hand-coded insecure projects? It's a can of worms.
I would argue that they can argue it purely from a capacity perspective.
They can estimate the scale of handwritten code growing over a period of time, but not the scale of AI written code scaling, meaning their platform cannot anticipate the scale and therefore it is unsustainable. And at that point the scale of security awareness as a whole can be considered, e.g. "how many attack surfaces, e.g. repos, are we hosting?" vs "how many of our repos are insecure?"
I can talk to them and have them fix it without them being weird about it. But if they don't understand the poor design decisions in the first place then I have no confidence won't be able to actually fix it, and keep it fixed in the future.
It's fuzzy, and many generalizations are gonna be made.
Ultimately, it really comes down to human judgement and not your instance not your rules. They are hosting for free. They don't have any obligation to host your projects. The rules and everything are nice conventions, and a good attempt at transparency, but at the end of the day, there is someone with access to the admin panel who is going to make the decisions, and you're not really going to be able to do anything about them.
It's the same thing with lemmy tbh, although it's less annoying because it's much easier to self host and migrate to Forgejo, as opposed to hosting Lemmy. That's why I phrased it as "I would feel uncomfortable hosting this content" rather than trying to address the fuzzier arguments about the necessity of human judgement, the difficulty of detecting LLM generated code, or the possibility of incorrectness.