Hello.
Just my opinion.
But I will not touch any new (possibly AI generated or also self-made) applications provided by any new member as RPM only (i.e. deployed only on openrepos).
In worst case without even a link to a git repository.
.
So, and this goes out to all new or reactivated or new AI capable ‘programmers’ out there.
Please, pretty please, try to use chum.
That would indeed need @Keto to create a “few” more accounts.
But this will make the code you created visible to the users and make it reproducible/safe to be the one that matches the RPM binaries.
And it will compile for all SFOS versions.
.
All that stuff is not given by openrepos. I do use openrepos but only having activated repositories of users I trust.
.
Thoughts?
–edit
This thread is not specifically about AI and vibe-coding.
For that, see here:
Is there anything to think about?
There are people who contributed for years such as yourself and there are brand new accounts distributing apps, some without source, some completely decline sharing source, and most using AI.
People can chose if they should download an app, vibe coded or not, from complete strangers without source and somehow be ok with it. Coming from openrepos or even Jolla store.
Seconding your view, but like to add that chum infrastructure currently is not fit for user to overview an influx of many new apps. Client app doesn’t support “recently changed” like storeman, and the web view only shows the last 12 changed apps. Would it be possible to provide a longer backlog?
Well, I’ve been developing apps for over a decade for SFOS yet I don’t publish on Chum because it’s very chaotic. Last time I tried I decided I’m too old for such an overcomplicated sh…tuff. In addition, the Chum app itself lacks pretty much everything you want out of a store app.
Unless someone makes it more dev friendly, I don’t see myself using it. I do link to the source code and the apps are built using CI so pretty much exactly what the obs does except I have an extra step of downloading them and uploading them to openrepos.
I’ve done four apps for SFOS. With AI, it’ speeds up and helps with problem solving, especially since I’m new to silica, qt and all
I’ve only programmed in Java, html, css, javascript and python before. But of course all is submitted to harbour, chum and, for those interested: open repos.
And, all is on github There can probably be some things to complain about, but they all stay on the phone, no telemetry and as few permissions as is possible to have the app doing what it needs.
Even Torvald uses AI to update the kernel. Nothing wrong with that
It requires manual account approval & manual approval of each submission. I’m not complaining but I think it’s understandable that people go the path of least resistance instead, which is Openrepos, where you open an account and start uploading your stuff (I guess that’s how it works).
OpenSource
Yes, definitely. Should be a must imho. But providing that or not is not a 100% correlation to using AI or not.
AI
I recently learned that there’s differences in how people code with AI, and how they react to requests for transparency. So, if I have the impression that the person knows what they’re doing and always check the end result, I do not much care if they used some AI assistance.
Although I will say that it can be sad to see how little an AI-assisted coder might understand about what they’re producing. I guess that’s why many vibe coders get prissy when pressed for details.
I do use openrepos but only having activated repositories of users I trust.
That should go without saying. But I see your point, definitely, esp. now we’re seeing so many new users. @Basil might formulate a big fat warning at least, to put on the website? And whoever develops Storeman might do the same in-app?
There may be other issues with the code than telemetry, information leaks or permissions. Recently, there have been some posts from users about some vibe-coded apps, that they keep background processes active unnecessarily, which leads to higher battery consumption.
Linus Torvalds is known for being very strict about the quality of code that is accepted into the kernel. He certainly doesn’t let an AI agent freely make changes to the codebase, but for sure he goes through every proposed change line by line before approving or asking the AI to re-iterate. And you are right about there is nothing wrong with using AI, if you do it correctly.
Although I am a new SfOS user, I am very reticent to use any apps from OpenRepos, because source code is often not provided (and even if it is, there is no guarantee it matches the RPM thats downloaded).
As a new user, knowing who to trust on OpenRepos is very difficult (or almost impossible).
OpenRepos seems to mostly follow the Windows mentality of downloading binaries from random strangers, which is completely abhorrent to me as a Linux desktop user, just far too risky.
Chum seems much better in this regard, and presumably Jolla do some checks for apps submitted to the Jolla Store (plus Sailjail gives some protections).
Yeah, I am deeply suspicious of any AI-generated apps, because it’s not clear how much the “developer” understands their program, and I believe AI has a habit of generating very poor quality code (to be polite). Also, if AI makes it easy to quickly generate low-effort apps, then who is to say the developer will stay around to fix bugs, rather than getting their next ‘high’ from doing another new app?
AI undoubtedly has it’s place, but without clear disclosure of how it was used, it’s just easier/safer to avoid anything that might have been created by AI.
In the early days of the original Jolla Phone, there was an incident where at least one user’s OpenRepos repository had package(s?), that the package manager wanted to replace the phone’s own package(s) with, even though it was/they were incompatible with the phone.
As far as I remember, the packages were there for a legitimate reason, but the incident showed how easily malicious actors could break SFOS, if there were no safeguards in place. I don’t remember, if the issue was resolved by removing the packages from OpenRepos or something else was done.
maybe it can be detected if ai is used? anthropic puts a fingerprint into texts generated by claude since 2nd of August, this fingerprint could then be detected in the source code
As an end user I appreciate if there are no big bugs, app is maintained if needed and dev is open for feedback. That way I can trust in developer’s intention to build and maintain good app.
That to me is more important than dev using LLM. Then I can contribute either money or translation or even something else.
And user feedback will show the app quality in the end anyway.
