So much AI, so many add-ons... and so many bugs

It must be possible to build some quality analysis scan on the addons advertised on xenforo.com
It would take time away from development to build such a thing and possibly further delay xf2.4 which nobody wants.

I'm sure the XenForo team will take action.
Chris D said:
We won't take kindly to the Resource Manager being filled with "slop" that doesn't follow our resource standards/guidelines! :)
Click to expand...
 
Alpha1 said:
It must be possible to build some quality analysis scan on the addons advertised on xenforo.com
It would take time away from development to build such a thing and possibly further delay xf2.4 which nobody wants.

I'm sure the XenForo team will take action.
Click to expand...
maybe AI can help get that done :p
 
vbresults said:
A solution I've been thinking about in three parts: mandatory tests and mock data for PHP functions in add-ons. Add-ons are pushed to github where automated tests and security checks are run. Accounts must be 2 years or older to submit add-ons and it is retroactive.

The tests will increase the quality of add-ons and provide a guardrail against slop submissions when paired with automated testing. If they fail, the code isn't uploaded to the directory. It's also odd for an account made yesterday with no posts to submit a resource today.
Click to expand...
Requiring to be a member for two years completely alienates any new possible developers, and when there are not that many active developers (on any platform) that becomes an issue.

Alpha1 said:
It must be possible to build some quality analysis scan on the addons advertised on xenforo.com
It would take time away from development to build such a thing and possibly further delay xf2.4 which nobody wants.

I'm sure the XenForo team will take action.
Click to expand...

I would prefer delays than to see the issues I am seeing elsewhere to happen here. One developer (who has since disappeared) caused at least $100k in damages by releasing a vibe coded add-on that had a critical exploit. Then there is everything happening in the FOSS community where there are supply chain attacks happening or people vibe coding complex software that they are unable to support or continue development on (Huntarr for example).

There really is no easy solution, but the bare minimum for now would be to require disclosure on usage so people are informed on what is being installed; if automated testing can be done there is a large amount of utilities (and AI) that can be used to help with that, but that is not something I would expect at this point.
 
This was posted earlier but was deleted, the one thing that makes me crinnge.
Or maybe we should just block AI addons entirely.
Click to expand...
I do not condone a full AI generated app but I do use it to assist.
 
Forsaken said:
Requiring to be a member for two years completely alienates any new possible developers, and when there are not that many active developers (on any platform) that becomes an issue.
Click to expand...
The quantity becomes irrelevant when they are not developers but sloppers, hackers, or shops quietly harvesting your internal forum data for training their models free of charge.

The former has already been identified in this thread, and I found and reported an instance of the latter in the directory. There are also foreign threat models not well-understood by admins here.

The open ecosystem that once existed is incompatible with new threats. To require developers to be registered for two years is a small cost. The alternative is doing nothing…

…until something really bad happens, or just shuttering the add-on marketplace and provider directory like Invision did. Then there will really be zero developers.
 
Forsaken said:
There really is no easy solution, but the bare minimum for now would be to require disclosure on usage so people are informed on what is being installed; if automated testing can be done there is a large amount of utilities (and AI) that can be used to help with that, but that is not something I would expect at this point.
Click to expand...

There is a very easy solution, imo.

To have access to adding resources, require add-on developers to provide to Xenforo a proof of liability insurance certificate, as well as having their physical address on file along with their legal name and company legal name (if any).

This simple requirement would get rid of the fly-by-nighters, scammers, and wannabees. If they want to write add-ons they can place them on their own websites or elsewhere, but placing them on Xenforo should be a privilege that least has some assurances for the end user.

My company has both standard liability and cyber liability coverage, and it's not expensive.
 
MySiteGuy said:
This simple requirement would get rid of the fly-by-nighters, scammers, and wannabees.
Click to expand...
It would, but it would also get rid of basically every add on that is not coded for profit. We would lose a lot of excellent free add ons and even a bunch who develop add ons as a business would think twice. While I support the idea in principle b/c I find it strange to buy software from someone where I don't even know the name or country of inhabitance of, let alone a full address, it would in practice also have very negative effects. Possibly insurance can be tricky as well, depending from where people live. So while it sounds attractive on first look the idea probably does need a second look and some reasoning, wether it will really solve the problem. A name, an address and an insurance does not make one a good programmer and neither does hinder from creating AI slop.
 
MySiteGuy said:
To have access to adding resources, require add-on developers to provide to Xenforo a proof of liability insurance certificate, as well as having their physical address on file along with their legal name and company legal name (if any).
Click to expand...
I thought about something like this — requiring a DUNS like Apple does on the app store. It works for us but solo unincorporated devs would be left out.
 
You only need a DUNS when you want to sell anything on the App Store. I don't have a DUNS and I have two free apps on the App Store.
Personally, I think corporations or indie devs developing for a living aren't the most dangerous in this case.
But I agree, if they sell something here, they should have some kind of registered. DUNS unfortunately, isn't something you have in Europe.
 
smallwheels said:
It would, but it would also get rid of basically every add on that is not coded for profit. We would lose a lot of excellent free add ons and even a bunch who develop add ons as a business would think twice. While I support the idea in principle b/c I find it strange to buy software from someone where I don't even know the name or country of inhabitance of, let alone a full address, it would in practice also have very negative effects. Possibly insurance can be tricky as well, depending from where people live. So while it sounds attractive on first look the idea probably does need a second look and some reasoning, wether it will really solve the problem. A name, an address and an insurance does not make one a good programmer and neither does hinder from creating AI slop.
Click to expand...

True, a name and address do not make one a good programmer. However, they at least make it easier to hold someone accountable. Plus it makes it harder for those who have been banned from coming back under another name (its happened before).

For non-paid add-ons, the insurance requirement could be waived, but not proof of who they are and where they live.

As far as anyone who's currently offering paid add-ons thinking twice, in the USA, for example, a basic policy can start under $20/month for businesses bringing in modest income.
 
MySiteGuy said:
True, a name and address do not make one a good programmer. However, they at least make it easier to hold someone accountable. Plus it makes it harder for those who have been banned from coming back under another name (its happened before).
Click to expand...
In theory. The question is how XF would verify these, what would hinder someone to use a fake ID and if you would really be willing to bring someone to court in let's say Pakistan, when you live in the US and wasted 20$ on a bad add on that did not live up to expectations. ;)

MySiteGuy said:
in the USA, for example, a basic policy can start under $20/month for businesses bringing in modest income.
Click to expand...
Here in Germany things are more buerocratic. Liability insurances for IT stuff are indeed not terribly expensive, but clearly we would talk about a couple of 100€ per year at minimum. To get one in the first hand can be difficult as you would have to have a formal business firsthand insurance companies are a bit of a pita as well - which means dealing with the tax office and other stuff. Loads of buerocracy. Realistically, no one with a clear mind would do that to be able to offer an add on for XF. It's not that you could become rich through XF add ons. :p
 
new_view said:
luddites. 10 years from now no one in their right mind will be writing over 100 loc, except the luddites.
Click to expand...
Sure, 10 years from now when models have been extensively trained by all the companies that are adopting them and making their employees use them to replace their jobs which is happening now. However current models are at most at junior developer level, and generally are not consistent or of high enough quality to trust. That is more and more problematic when people do not know how to read or understand the output, and the majority of people do not even bother to double check output in the first case.

But when you have people releasing vibe coded add-ons that are making changes to the admin panel, authentication/registration and also payment systems that is a problem; all 3 of those areas are prime attack vectors, and I would not trust a less skilled developer, much less an idiot with AI to develop anything properly.
 
MySiteGuy said:
There is a very easy solution, imo.

To have access to adding resources, require add-on developers to provide to Xenforo a proof of liability insurance certificate, as well as having their physical address on file along with their legal name and company legal name (if any).

This simple requirement would get rid of the fly-by-nighters, scammers, and wannabees. If they want to write add-ons they can place them on their own websites or elsewhere, but placing them on Xenforo should be a privilege that least has some assurances for the end user.

My company has both standard liability and cyber liability coverage, and it's not expensive.
Click to expand...
Maybe not to that extent, but it had been brought up to have resource providers vetted to some extent by XF before providing services, but that didn't go anywhere.

At this point I just want the bare minimum of disclosure, anything else is just a bonus.
 
Frankly, if I was going to spend serious coin on an add-on, I'd be doing that kind of vetting myself. For free add-ons, which is all I use now, I would likely just stick to what I know, which is guys like Xon and others who have been around as long or longer than me. Maybe less expensive paid devs like AndyB if no reputable free options were available for the need. I see no reason to take a flier on someone new and unknown. Not that I am likely to be in that position. The site runs fine with what I have in place and might not make it to the end of my current domain registration (2029) so I won't be sinking much into it beyond the necessary, e.g. paying the hosting and XF support.
 
All i use for addons are the official ones that xf designed.
I did use @Xon's sign up and abuse addon but didn't renew that licence.
I also had ozzmozz's free addons on my site and had complaints from my members.
 
At a minimum, some self moderation is never a bad thing. When an unknown developer with little history comes out with 20 add ons on the same day or over a short period of time, I'd say some alarm bells should sound loud and clear. Exercise caution. Let it play out.

BTW, DUNS is a scam and I would trust chatgpt to give me a better synopsis of a business profile over those guys. They remind me of the BBB guys over here in NA.
 
Even more interesting are those who've completely let go and let AI do everything. Not only using AI to code, but AI to write their addon descriptions, AI replies in addon support threads, AI to create their own store pages. Its everything. All encompassing AI front-to-back.

@SenseiXS is one example. After being registered for 9 years, they spit out 11 AI coded addons (64% paid) in 15 days, with the front-to-back AI (website, support replies, etc).

Not the only one, just the last example I stumbled across. Absolutely off-putting.
 
Last edited:
Back
Top Bottom