serverbox.stupidlabs.lol
Back to storiesRanked by HN
Comments
48 total · 48 loaded
Are you guys really letting a (as of now) non FOSS, presumably vibecoded app have access to your servers, presumably as root, as most people don't follow best practices?
The choice of Tauri for a Linux app using AppImage is a dead giveaway they have no clue what they are doing.
Can you expand on that? The point of an appimage is so you don't have any dependencies or linking errors. Rust can still link to libraries, so that doesn't seem to be a weird pattern to me.
Electron appimage would be weird though since it does all its bundling by itself
Sure. Tauri tries to claim its lighter than Electron by not including a full web browser in its runtime and instead using the system renderer. But Linux doesn't have a universal system renderer like Windows and Mac does so it uses Webkit2Gtk on Linux. Libwebkit is an absolute mess of a library. It hardcodes the path to /usr which doesn't work in AppImages resulting in this[1] hack of a fix that replaces `/usr` with `././`. This problem isn't unique to Tauri as I have seen apps using Wails copy this same trick to package their AppImages.
Now the problem with libwebkit goes even deeper because Tauri uses libwebkit2gtk-4.1 after moving away from 4.0. When you build an AppImage you want to do it on the oldest possible distro you want to support because it will be built against GLIBC of that distro release. Due to how most devs release apps now, that means they compile against an Ubuntu LTS release because Ubuntu is the only option with Github Actions[2]. The first LTS version of Ubuntu with 4.1 is 22.04, so now by default you can expect every Tauri (and also probably Wails) AppImage to be built against GLIBC 2.36. But theres a bug in the interaction of older libwebkit2gtk and newer freetype that happens when you use an AppImage built on Ubuntu 22.04 on a newer distro. It crashes when displaying an emoji character. Freetype is one of the libraries you cannot include in an AppImage but you must include libwebkit2gtk, the solution is to use a newer libwebkit2gtk but thats only available in Ubuntu 24.04 and bumps the GLIBC to 2.39. Do you see how much of a mess this usage of libwebkit2gtk in an AppImage turns out to be.
And moving beyond that, the Tauri devs has an absolute disdain for the AppImage format and treat it as a 2nd class platform as you can see in this[3] PR where AppImage developers tell the Tauri devs to update to newer tools instead of mirroring the old obsolete broken tool that was taken down. This also meant that AppImages created by Tauri's build tools depended on libfuse2 being installed on the system while newer AppImages using the type2-runtime do not anymore. I believe Tauri has finally moved forward and stopped doing this recently. Electon is no better on this and electron-builder uses an outdated hardcoded tool that makes bad AppImages that depend on libfuse2 too.
I do like the AppImage format, but I do not believe anything that uses libwebkit2gtk-4.1 is fit to be distributed as an AppImage at this time. This means that Tauri (and by extension probably Wails, and some of these other NOT Electron frameworks) are not fit to be truly called cross platform. It does look like Tauri was making progress on Flatpak documentation so app developers could have a second cross distro packaging method. Ideally I think any framework that wants to label itself as cross platform should make it easy to package both AppImage and Flatpak and not run into the above libwebkit2gtk issues.
[1]<https://github.com/tauri-apps/tauri/blob/ad0b98a2329e369364e...>
[2]This is not entirely true, you can use a docker image inside the Github Actions Ubuntu VM or a sysroot but that is beyond even most expereinced app devs to setup.
Most people already run software like that on their computer, even if it's just your coding harness that could just as easily run ssh and use your keys in ~/.ssh to connect to your servers. In my case I'd get a permission prompt from 1Password as I have my keys in there, but with all the prompts that a modern macOS throws at you the chances of it getting approved mistakenly are not zero.
I'd not run OPs software either though.
Anyone who gives an LLM unfettered access to their ssh keys/agent socket deserves what they get IMO. I sandbox Claude with my own bubblewrap-based script which denies it access to anything I deem unnecessary.
I only tested it on WSL locally, there is bo way im connecting it to a live server without seeing the sourcecode.
Absolutely not.
It's from stupidlabs.lol
Made for stupid people?
Nope, cfEngine FTW!
Looks like TRUENAS if it was single-prompted. Also how will it know what my server runs if I install nothing on it? will my server just expose all information? I'm a bit confused why this was a design choice.
I just heard of TrueNAS for the first time in my life... So, checked google images.. there is some similarity for sure.
It detects the server OS "after SSH authentication" by running a small POSIX-shell probe.
It will not automatically expose "all information". It can access only what the SSH account can access.
Every time I connect to my server I receive a Delivery Status Notification (Failure) email from my gmail address as if it tries to use my phpmailer to send an email to testing@example.com
edit: the email comes from my website, when I connect a new user is created in my website with random name and that email address..
DOESN’T SEEM SAFE AT ALL!
[deleted]
[deleted]
What's the business model - and what guarantees are provided that Serverbox[0] won't rug pull after a seed round from Dillon-Edwards[1]?
No financial incentive in mind or planned... I was building it for myself... then, spent a few days extra polishing it so others can use it as well.
The macOS installer is not notarized, and while adding an exception in Gatekeeper exists, not everyone would be willing to do that, especially currently when even the app source is unavailable.
Apple charges $99/year to be able to notarize a app. Plus, it has one years long bug that any random Apple developer account can get stuck in, and then, you just can't get it notarized. Have a look at this thread: https://github.com/electron/notarize/issues/205
I do agree that notarizing it would make installing much easier.
Also, source code is coming day after tomorrow.
Only problem of course is that it's unlikely that this even exists in 5 years.
Pretty cool for those who are not running something like TrueNAS/FreeNAS/Proxmox. But then the question is why are you not. Even for MacOS im pretty sure you can glue up a raw bare metal box to Proxmox these days with Proxmox Datacenter Manager
Potentially interesting - of it is at a minimum source-availble - preferably FOSS?
I assume it is vibe-coded, so would need a pretty thorough review before considering using it.
License and source availability not being on the page/faq suggest this is just a hobby project, I guess?
OMG cool app, let me share my ip and cert
This is exactly the gap I needed filled, a proper desktop panel that manages my Linux servers over SSH without installing anything on them.
Is it open source?
Thank you...
Source code will be released day after tomorrow. I will add a comment in this thread itself, as well as update the site with a link to Github.
Thank you, I tried it, so far working great. One small thing I hit: when I tried connecting to a server I'd never connected to before, it refused at first with no clear error. I had to SSH in from my terminal once to accept the host key signature, and then it worked fine. Minor, but thought I'd pass it along. Great work!
Is this shipping wasm openssh or how does it work?
edit: nvm, for some reason I thought it runs in the browser.
It's free but not open-source?
I mean yeah sure, I'll give SSH access to a blackbox.
"Don't worry — the app is safe."
Source code will be released day after tomorrow. I will add a comment in this thread itself, as well as update the site with a link to Github.
Why not make this post the day after tomorrow then instead of today?
Man as someone thar was on the verge of going all in on programming is so demoralizing to see how easy it is to release pure SLOP nowdays
You have a never ending stream of show HN. It becomes meaningless.
Show HN: Linux server management over SSH – written in Rust and Tauri
2 hours
Show HN: The wanderer – cozy weekend game with no objective
14 days
Show HN: Feature-packed 6MB Rust+Tauri free bookmarking app
16 days
Show HN: HN-jobs aggregator – updated in real-time
27 days
Show HN: One no-subscriptions online search for all your agent needs
30 days
Show HN: 100% Free Indian Railways API
35 days
Show HN: Xkcd Search
45 days
Show HN: A calculator CLI to help your agents perform calculations accurately
55 days
Show HN: Hacker-News Jobs
57 days
Show HN: Hacker-News Buddies
58 days
Show HN: HTTPS://HN-Jobs.com
59 days
Show HN: JerrySniffs – MCP Server (and API’s) for web and social media search
75 days
Show HN: Give This Markdown to Your Coding Agent Before Publishing to NPM
3 months
Show HN: Nano-RAG – Agentic multi-hog retrieval without graph database
3 months
Show HN: Chat with UFO Files
3 months
I do. I love to build things, though these things are not that meaningful yet as I want them to be. Most of these (except last 3 and that 'A calculator CLI...') are being actively used by many.
But I should not have shared a single `show hn` more than once.. that I will take care of going ahead.
I think what I have trouble with is the lack of awareness. Anyone and everyone can do this now. It’s great. I do so myself at home, for myself.
But what are you (and millions of others) actually adding here?
If you truly love to build things, then actually build them, don't vibe code them.
So its pretty much abandoneware?
yikes, no thanks.
Clearly vibe-coded. Hard pass.
All of these "written in rust" ai-slop tools lately. Means absolutely nothing, really.
[deleted]
[deleted]
Beautiful, I have a fetish for beautiful software so here goes my upvote ^
I believe more Rust/Tauri apps will flood the market as that's the best combo right now for desktop apps in universal knowledge reusability for those who come from the web world HTML, CSS, JS. Simplicity and portablility
Just downloaded it and at 8MB is a thing of joy to see apps small again
Won't happen until Tauri can treat Linux as a first class platform. Which they cannot do because of architectural design and library choices.
Is there any webview control ready to use in linux? When I say Tauri it's just the webview control, used as a cargo package as "wry" in macos. I don't care about the framework itself, just the webview control. If that's the case then Rust/(stripped down WebView) is all we need to be honest
Edit: Looks like the same "wry" package can be used in linux
The README for wry under Platform Considerations suggests its not actually implementing the webview but just a wrapper that uses the correct one for each platform. The usage of WebKitGTK IS the problem that makes it second class on linux. I talked about this more in https://news.ycombinator.com/item?id=49514323