ai reviews my mini webserver

000.md

ai reviews my mini webserver

i needed to share a single file so i wrote a quick webserver in bash like any normal person would. it supports head and get, which was all i needed. as far as i'm aware it doesn't misbehave too badly

then i showed it to a bunch of extremely smart phd level agi bots that are going to replace us all and asked them to review it and point out any flaws

what follows is a non comprehensive list of replies in no particular order. for fun you can guess which model said what

001.md

an attacker that can start the server can use it to cat /dev/random

002.md

this supposedly allows attackers to traverse paths

003.md

extremely serious issue only thwarted by the fact that that's not how ncat works

004.md

this server never actually worked because you forgot to export the thing

005.md

pretty much all bots got really excited by the possibility of reading files

006.md

not how anything works

007.md

go away you haxxor i'm not gonna help you break into this super secure server

008.md

not how quoting works in a shell

009.md

you should use this more robust method that breaks if you have a : in the name

010.md

slow data that arrives long after the script has exited

011.md

tbh this just shows how valuable the cvss scoring system is

012.md

your code is vulnerable if you change it to make it vulnerable

013.md

it doesn't refuse to run as root which is a major security issue

014.md

filename doesn't end up in the headers

015.md

your script should return 404 when it can't find a file to avoid disclosing that it couldn't find it

016.md

not using https is enough for a 6.5

017.md

restarting ncat on every connection seems counterproductive

099.md

i am aware that python's http.server is very easy to use, and so is nginx, and so is every other server really, but this was 6 lines of code that i wrote to share a log file with a friend

it's a silly project not intended for production use. i couldn't immediately break it, so i asked some people and some ai thingies (pretty much all the relevant ones in august 2025) to have a look

the ai results ranged from irrelevant, to nonsensical, to just laughably bad. there was a lot more but this is enough to convey my point. the human results ranged from "lol" to "why not just use..." to "pls dont"

in fairness to the bots, a lot of them did point out that this isn't hard to dos. just spawn a billion connections! ncat has a --max-conns option to address this, but there's already a read timeout and i couldn't be arsed to find a value that made sense for just running cat on a 100kb file. remember to pick a good one before deploying the next facebook on this

this was quite a few bots that are being sold as agi with all the thinking settings maxed out etc. overall i feel like i gave them a fair try, but they only managed to produce an endless stream of completely made up vulnerabilities. this is not what an expert would come up with

it's probably my fault tho. i am old and grumpy. i should have prompted better, or used the even newer models, or maybe i should just write react instead or possibly tailwind css? but you're absolutely right to point this out. let me try a completely different approach...