After a long hiatus of security fixes only the development of Etherpad has recently taken up speed again. But it seems to be nearly fully vibe coded with the help of Anthropic Claude and the amount of new features added makes it very unlikely that there is sufficient human code review.

I bring this up because as you probably know we host an instance of it over at https://pads.slrpnk.net/

Aside from the general issues with AI assisted code development and corporate capture through closed AI models like Claude, I consider it also a security risk as the NodeJS ecosystem (Etherpad is using that) is especially vulnerable to supply-chain attacks and AI halluciations make this issue significantly worse.

So basically this means we will probably have to shut down this service soon (stopping to update it is not a good option due to the many security issues found in NodeJS packages all the time), and look for an alternative.

If you have any important collaborative documents on our Etherpad instance, it would be good to export them in the near future. Best would be probably to export it as Markdown, as most alternatives seem to use that syntax.

As for alternatives, suggestions are welcome, but I did look into other options before (Hedgedoc, Cryptpad etc.) and was not so convinced by them either.

  • JacobCoffinWrites@slrpnk.netEnglish
    2·
    2 days ago

    Thanks for running etherpad for as long as you have - I really appreciate all the cool tools you’ve bundled together for us on this instance. Thanks also for ditching it when it turns slopware and became a security problem.

    I’m a bit biased towards cryptpad but mostly because I’ve been using it as a google docs replacement and haven’t read up on any issues yet. I’ll ask around to see if there are any other good recs and let you know.

    • budget_biochemist@slrpnk.netEnglish
      5·
      2 days ago

      This list seems to have a lot of false positives, or at least an unhelpfully broad definition of what is considered “slopware”.

      For example curl (stylised as “cURL”) is listed on that page as being “slopware” because it has a “permissive AI policy” because the developer decided against instituting a “strict non-ai policy” that dictated what development tools submitters could use..

      The developer of curl (Daniel Steinberg) is generally speaking one of the most anti-AI-OSS voices on Mastodon, and has banned AI-submitted code and bug reports to curl. He has given talks including keynotes at conferences about AI slop. News articles have been written about his stance against AI:

      If a project with a well-publicised anti-slop stance and an explicit no-AI policy is considered “slopware”, the list seems questionable.

      • Tiresia@slrpnk.netEnglish
        2·
        2 days ago

        It’s only “false positives” if you take the list as gospel truth. Since they cite their sources, people can and should judge for themselves whether the sources meet their personal standards.

        Because of this, it’s far better that they cast their net wide and let people greenlight elements from the list if they want than that they try to impose their own personal definition of AI slop by excluding anything from the list that they personally think is okay.

        But yeah, it would be nice if they included evidence of good behavior too, both for the alternatives they suggest (so they aren’t incentivizing devs to keep quiet) and for the problematic ones to clarify their stance.

    • poVoq@slrpnk.netOPMEnglish
      3·
      2 days ago

      Yeah quite sad to see.

      But if there are only minor AI code contributions that can be still reviewed well it isn’t that big of a deal from a security perspective.

  • Jim East@slrpnk.netEnglish
    2·
    3 days ago

    HedgeDoc seems like more of a replacement for Etherpad, with Cryptpad being “overkill” in terms of features, but I’d also be interested to know if there are other options available…

    • poVoq@slrpnk.netOPMEnglish
      1·
      3 days ago

      The problem with HedgeDoc seems mostly that the current 1.x version is basically abandoned, and the 2.x rewrite is stuck in development hell. Other than that, yes it would be a suitable replacement.

      • Jim East@slrpnk.netEnglish
        1·
        3 days ago

        I’m not familiar with the development situation there, but that’s unfortunate. Maybe some of our talented solarpunks could lend their programming skills to making HedgeDoc 2.x a reality?

  • jahtnamas [sie/hir]@slrpnk.netEnglish
    4·
    4 days ago

    idk, i liked using cryptpad over etherpad on disroot but it was based on me hoping to convert some friends using google docs rather than actual serious use.