When Self-Hosted Apps Start Using AI to Write Code: A Privacy Enthusiast's Dilemma

A Reddit Post That Got People Thinking

In the self-hosting community, a user shared a concern that had been weighing on him: the open-source tools he uses every day were increasingly being built with AI-generated code. He pointed to a specific example — the note-taking app TriliumNext.

"I used to love Trilium, and when the original project was archived I specifically switched to TriliumNext," he wrote. "But when I looked at the contributor leaderboard and saw Claude sitting in second place, it felt strange. Is this still open source? People donate money, and then the maintainer uses some of it to pay for Claude tokens to generate code?"

This candid observation touches on a deeper anxiety spreading across the tech community: as AI becomes deeply involved in open-source software development, is the ideal of "self-hosting" and "independence from big corporations" being quietly rewritten?

The Original Spirit of Self-Hosting vs. the AI Paradox

To understand this unease, you first need to understand what the self-hosting community is really after. The poster was direct: "I self-host for privacy, to be independent from the big companies that hoover up your personal data like TicTacs — including AI companies."

There's a fascinating paradox here. Self-hosters choose to stay away from cloud services and data collection — essentially voting with their feet against big tech. Yet the mainstream AI coding tools today — Claude, GitHub Copilot, and others — are controlled by exactly those same giants. When an open-source project whose spiritual foundation is "resisting big tech" starts relying on big tech's AI to produce code, idealists are bound to feel a certain value misalignment.

The money trail makes it even more nuanced. The poster astutely asked: are donations being used to pay for AI token costs? This touches on an ethical gray area in open-source funding — should donor money support human labor, or is it acceptable to spend it on AI compute? The community has no consensus on this yet.

The Difference in Motivation Between Commercial and Open-Source Code

The poster also raised a key distinction: "In a company, they want you to ship fast, so you don't care about code quality — that's understandable. But in an open-source project, what's the point?"

This question cuts to the heart of what separates these two development contexts. In a corporate environment, AI-assisted programming delivers clear value through efficiency and delivery speed, and quality trade-offs follow an obvious business logic. Open-source software, on the other hand, has long been seen as the product of craftsmanship and passion. Users trust it partly because they trust the people willing to pour in unpaid hours to polish it. When AI enters the picture, the fear is that this human warmth gets diluted.

---

What is self-hosting? Self-hosting means deploying and running software on servers you control, rather than relying on third-party cloud services. Typical self-hosting scenarios include running Nextcloud on a home NAS instead of Google Drive, using Jellyfin instead of Netflix, or self-deploying Bitwarden instead of using LastPass. The core motivation is data sovereignty — users want sensitive information (photos, documents, passwords, calendars) to physically reside on hardware they control, not scattered across someone else's data centers. Reddit's r/selfhosted community has over 300,000 members, reflecting the size and activity level of this group. These users tend to be highly sensitive to privacy policies and data collection terms, and they're willing to invest far more effort than the average user in maintaining their own servers — all for the peace of mind of not being surveilled.

---

A note on open-source trust: The trust foundation of open-source software has historically been built on auditability, not purity of origin — anyone can read the source code and verify its behavior, which is the core security advantage over closed-source software. But the influx of AI-generated code is putting new pressure on this mechanism. Research shows that LLM-generated code exhibits specific vulnerability patterns, such as poor handling of edge cases and calls to insecure functions associated with known CVEs. A 2022 Stanford study found that roughly 40% of code generated by GitHub Copilot contained security vulnerabilities. If maintainers merge AI output without careful review, the promise of "auditability" becomes a formality — the code is technically open, but the actual review density has dropped significantly. This is why the quality control question matters more than whether AI was involved at all.

---

The Reality That "AI Is Everywhere"

The poster then acknowledged a reality that's nearly impossible to escape: "It's hard to find apps without AI these days. Even Linux uses AI now… If I said 'I'm a hardcore guy who will never run any AI-generated code,' I'd probably have to go back to TempleOS."

TempleOS, the operating system built single-handedly by the late programmer Terry Davis, is often invoked in the community as a symbol of "purely handcrafted, radically independent" software. Using it as a punchline reveals the bind we're in: a purist stance against AI is, in practice, almost equivalent to disconnecting from the modern software ecosystem entirely.

AI-assisted programming has moved from the fringes to the mainstream. It's no longer an experiment by some avant-garde team — it has permeated everything from operating systems to desktop apps. For ordinary users, "whether to use AI" is no longer a checkbox they can freely tick. It's a fait accompli.

---

About TempleOS: TempleOS was developed almost entirely by programmer Terry A. Davis (1969–2018) over roughly a decade. It's a 64-bit single-user operating system with around 100,000 lines of code, including a custom programming language (HolyC), compiler, kernel, and graphics system — all built by one person. Davis struggled with serious mental illness throughout his life, yet he constructed a complete software stack entirely on his own, which is extraordinarily rare in the history of software engineering. In the tech community, it serves as both a symbol of extreme individual programming and a reminder tinged with tragedy. Using it as the endpoint for "rejecting all AI code" implies a harsh truth: the complexity of modern software has long surpassed what any single person can hand-build and maintain. Some degree of tool dependency was always inevitable.

---

A More Mature Approach: From Resistance to Critical Scrutiny

To his credit, the poster didn't fall into black-and-white thinking. He added: "I'm in no position to criticize anyone — I'm far from the best developer. Even without AI, the TriliumNext developers have done really admirable work, freely available to everyone. I'm just sharing an unease that leaves me confused about the future."

This kind of self-reflection offers a healthier framework for the conversation. The question probably shouldn't be "is AI-generated code a cardinal sin?" but rather a few more pragmatic ones:

• Transparency: Should projects publicly disclose how much AI is involved in development?
• Quality control: Is AI-generated code being rigorously reviewed by human maintainers before merging, or is it going in directly?
• Sustainability: How do we ensure the long-term maintenance quality and security of open-source projects that rely heavily on AI?

For self-hosters, what actually needs evaluating has never been "who wrote this line of code" — it's "is this software trustworthy, is it secure, and is it still being maintained responsibly?" AI only changes how code is produced. It doesn't relieve human maintainers of responsibility for the final product.

A Closing Thought

This post resonated because it articulates a broadly felt sense of the times — when technology changes faster than our values can adapt, confusion is a natural response.

The core value of self-hosting was never "purely handmade." It's about control: control over your own data, over where your software runs, over whether to upgrade or migrate. Whether AI was involved in writing the code doesn't directly strip you of that control. What actually matters is whether the community can establish transparent norms around AI use, so that users can make informed choices.

Rather than agonizing over whether to be a "hardcore anti-AI purist," it's probably more productive to push for open-source projects to use AI more transparently and responsibly. That may be the more constructive response to this unease.