Vetting plugins

[IAmHugh 99]

With the advent of AI it is past time that the Emby team vets all new plugins. With AI making more mistakes than not and knowing there are more than a

few plugins that are AI generated or at minimum AI was used to help build them. One can typically tell the AI plugins by the rapid release and or the 

length and organization of the post for them. I understand vetting plugins is time consuming, but the alternative is ultimately user after user having 

issues with Emby they cannot fix. I just removed three plugins cause of a problem that cropped up with the 4.11.0.8 beta. Now to be fair I do not believe 

in this instance the plugins were the issue, but rather 4.11.0.8 itself.  Another point is when one is using AI to completely create their app or having AI

help they need to make it known or have their plugin pulled or blocked til they do. 

[muiz 41]

1 hour ago, IAmHugh said:

With the advent of AI it is past time that the Emby team vets all new plugins. With AI making more mistakes than not and knowing there are more than a

few plugins that are AI generated or at minimum AI was used to help build them. One can typically tell the AI plugins by the rapid release and or the 

length and organization of the post for them. I understand vetting plugins is time consuming, but the alternative is ultimately user after user having 

issues with Emby they cannot fix. I just removed three plugins cause of a problem that cropped up with the 4.11.0.8 beta. Now to be fair I do not believe 

in this instance the plugins were the issue, but rather 4.11.0.8 itself.  Another point is when one is using AI to completely create their app or having AI

help they need to make it known or have their plugin pulled or blocked til they do. 

Thats why always test things on a test Emby server. 

[IAmHugh 99]

4 minutes ago, muiz said:

Thats why always test things on a test Emby server. 

That's why dev vetting is essential. Like most I'm not building a secondary server just to test.

[muiz 41]

1 hour ago, IAmHugh said:

That's why dev vetting is essential. Like most I'm not building a secondary server just to test.

I always have a backup server. Sometimes its the Emby update itself that messes things up.
Then im back up in a few clicks.
Or build your own plugins. 

[IAmHugh 99]

I have Emby in a Podman media stack and all including Emby have snapshots taken and stored on a secondary drive.

because of issues with the 4.11.0.8 beta I actually had the chance to put that system to the test, and it rolled me back

to 4.11.0.6 without issue and all was good again. That said the plugins should always be vetted by the devs, especially

now with the advent of AI.

[Luke 43492]

Vetting plugins for what, display in the plugin catalog?

[IAmHugh 99]

@Luke no one finds you the least bit humorous. Vetting for malicious code and you know it.

[roormonger 7]

Nice

[IAmHugh 99]

Got to love someone reacting negatively to a thread like this all because they don't want to do the right thing and admit they at least used an AI

helper to create their plugin even if it's just a negative emoji. 

[roormonger 7]

I think the face palm emoji is because of your interaction with Luke (Emby dev). He was being serious when he asked that question. He wasn't being trying to be funny. He was probably genuinely wondering why a dev would use their time to vet plugins that aren't officially hosted in the plugin catalog. Which is silly.

[muiz 41]

1 minute ago, roormonger said:

I think the face palm emoji is because of your interaction with Luke (Emby dev). He was being serious when he asked that question. He wasn't being trying to be funny. He was probably genuinely wondering why a dev would use their time to vet plugins that aren't officially hosted in the plugin catalog. Which is silly.

Hes facepalming more people. I putted him on the ignore list here.

[SoliFlix 42]

Just try telling that to Google or Apple... none of the apps in their stores are labeled as "vibecoded" or created with the help of AI. And surely more than 50% of them are.

Even Google itself now generates 75% of its own code with AI.

Quote

Google CEO Sundar Pichai has revealed that 75 percent of all new code at the company is now AI-generated and approved by engineers.

https://www.etvbharat.com/en/technology/sundar-pichai-says-75-percent-of-new-code-at-google-is-generated-by-ai-enn26042705700

It would, of course, be desirable for this forum if the plugin creator mentioned this in their forum post. But as you already pointed out, you can usually tell whether something was created with the help of AI by looking at the writing style or the frequency of releases.

This translation was created with the help of AI. 

[IAmHugh 99]

1 hour ago, roormonger said:

think the face palm emoji is because of your interaction with Luke (Emby dev). He was being serious when he asked that question. He wasn't being trying to be funny. He was probably genuinely wondering why a dev would use their time to vet plugins that aren't officially hosted in the plugin catalog. Which is silly.

The assumption would be vetting them before they're ultimately allowed in the catalog.

 

@SoliFlixan actual good use of AI. Translation that is.

[roormonger 7]

You don't need to tell that to me. Should have just said that to Luke to begin with rather than getting all defensive.

 

I'm no dev or anything but to me the best thing a dev could do to make sure a plugin doesn't do anything malicious is to worry about the backend plugin capabilities rather than the plugins themselves. I plugin can't do anything malicious if it doesn't have a path to do so...

[ginjaninja 665]

Emby plugins are not "bounded" by Emby's 'plugin architecture', in ways that would matter if you had concerns. Plugins can do "almost anything", quite apart from interacting with Emby; at least that my understanding from writing (vibe coding :-)) a few plugins.

AI is a friend imo, if you have concerns and the repository is not public. AI can decompile and report on all functions of a plugin so you know exactly what a plugin is doing and how.

 

 

 

 

[IAmHugh 99]

4 hours ago, roormonger said:

ou don't need to tell that to me. Should have just said that to Luke to begin with rather than getting all defensive.

I wasn't the one in the wrong.

Edited October 26 by IAmHugh

[IAmHugh 99]

4 minutes ago, ginjaninja said:

AI can decompile and report on all functions of a plugin so you know exactly what a plugin is doing and how.

So AI checking its own work, right.

[ebr 16972]

We are currently working on systems to do just this for the catalog.