bemeeker

I’ve been working on an open source project called Pando (https://github.com/trypando/pando) that is meant to help with part of this problem. Specifically the last part of your question, which inventories these apps.

When someone at a company builds an app, they become the owner/maintainer of that app, and it can be transferred to someone else when leaving, or to a group/team for shared ownership. Or, it can just be decommissioned.

I think it’s important to treat internal tools built by non-technical employees essentially as drive data. It should be shared with those who need it, and if it needs to be kept forever, it should be owned by a group or “shared drive”.

With that said, I also think that as a developer building internal tools, you fall into a bit of a different bucket. When contracting with these companies, I imagine the expectation is that you will build something high quality and maintainable, which can be passed off to a platform team. This is functionally different from non-technical users building their own tools.

For apps at scale, you can use Vercel or Railway for ease of use. I prefer to use Cloudflare pages/workers and a DigitalOcean droplet or something. Putting it up in standard cloud infrastructure also forces you to think a little bit more about how it’s built. E.g. where does the database live? Is there a separate API service, or built-in? Thinking like that will help your app perform better already at scale, instead of just having a python app with SQLite or something (nothing wrong with that, but there is a time and place for everything).

I put my smaller ones in Pando (https://github.com/trypando/pando), which is an open source project I’m working on, but it’s self hosted.

This is sweet. It’s very similar to an open source project I’ve been working on called Pando! (https://github.com/trypando/pando).

It’s cool to see other people seeing this problem and trying to solve it too!

It’s more of an orchestrator. Destinations are controlled through runtime “adapters” which essentially tell Pando where and how to put apps. Instead of partitioning a container, it creates an isolated network and deploys the different workloads of your app as containers (database, web, api, etc.)

Since it’s modular, the goal is to be able to use AWS, GCP, kubernetes, etc. as the destination for apps, if you are already using that.(not all of them are built yet). By default it uses Docker.

This is very similar to the open-source platform I’ve been building called Pando (https://github.com/trypando/pando)

Validating to see others trying to solve this problem too!

I agree with this. People are vibe-coding apps all the time at work, and who knows where they go, especially when that person leaves the company.

With that said, for apps that require scalability, I don’t see this as the same problem, since that suggests they are widely used, and will be maintained similarly to a product or standard internal tool was, 5 years ago.

But for the rest of them, this is why I made Pando. It’s my way of trying to find a solution to preventing a ton of apps and company data to get thrown around and forgotten about.

I think it’s inevitable as AI becomes more powerful and more readily available. It’s a new way for people to think about problems and solutions at work.

Is it always good? No. Is it happening? Yes.

I’ve been working on an open-source platform called Pando (https://github.com/trypando/pando) to help provide a safer outlet for these internal apps.

I don’t think it’s realistic to suppress these apps, so there should be something to point users/employees to.

I recently posted on Show HN for my project Pando (https://github.com/trypando/pando). It didn’t “flop” in the sense that a bunch of people saw it and disliked the idea, but more that it was immediately buried in other posts and didn’t get much of any visibility.

I feel like getting visibility on Show HN is a complete luck game, but I don’t want to repost constantly and become a nuisance to people who actually follow new posts.

Is there some existing etiquette around this that I should be aware of (e.g. don’t post again, wait a week, etc.)?

Ive been working on https://github.com/trypando/pando.

People are building things with AI all the time at work, and with no outlet for it, security violations are running rampant.

Pando gives employees a safe place to put these, and reduces the burden on IT and security teams when dealing with them.

Love to hear it! I’m calling it “alpha” largely because it hasn’t had enough use for me to consider it stable, even though it’s worked fine for folks so far.

There also might be breaking changes as it matures, but it will enter a beta soon enough!

A big problem with this personalization is that people are using AI to build what they need at work.

That in and of itself is not the problem, but there’s nowhere to put it. (Shameless plug for Pando https://github.com/trypando/pando, which is open source and targets this exact problem)

This works great for things that only an individual needs, but when teams of people need access to something, SaaS is still the most viable option.

With that said, that doesn’t necessarily apply to personal use projects, and building what you need is a great way to save on subscriptions costs now. And it’s really fun.

I’m starting to think there’s no good alternative to this.

Which is fine, it makes sense with where AI is at currently.

This is the way.

I’ve been working on an open source project called Pando (https://github.com/trypando/pando), which is meant to help alleviate “Shadow AI” vibecoded apps in workplaces, and give employees an outlet for what they build.

With that said, it’s a big project and I’m a solo maintainer right now, and as a result I’m using AI for much of the development process. Obviously this isn’t new. AWS, Google, Meta, and pretty much every company and developer is using AI to assist in development and code review now. It’s the name of the game in many cases.

So my question is, when building with AI, without another human to read my PRs, what are some ways to ensure the code isn’t slop?

Currently, I’m doing standard unit tests (but no mutation tests, so these could be bad tests), duplication testing, CodeQL scanning, integration and smoke tests, and I’m also using SonarQube and CodeRabbit. This has slowed down PR velocity tremendously, but I’m ok with that if my quality and peace of mind is increasing.

I could build Pando closed source and put out a bunch of slop, and no one would be the wiser until stuff started breaking, but that’s not the point of the project. But being completely visible, and targeted at real orgs, I feel like the bar is high.

Thoughts?

Curious why to use this over something like Coolify’s cloud offering?

This is a super cool way to visualize how things are connected!

Sometimes when managing large systems it can be hard to have a picture in your head of how everything is connected, and the dependencies things have on one another, so I can see a need for this.

Might be a little overkill for the average hobbyist, but who doesn’t love a little overkill…

Because Windows sucks. Linux distros are already superior open-source OS options.

It would be kinda fun to see play out, but I doubt it would get much adoption from the community.

I feel sorry for lots of the people in the comments here. I have always been able to cut the BS with my managers, and it has been well received.

I think that people generally prefer clear communication, unless they are trying to hide behind processes instead of get things done.

I agree with many others in the thread. It’s pretty much impossible to not install apps that have “vibe coded” aspects to them now, if not completely vibe coded. We see this with Amazon/AWS boasting that a large percent of their code is now AI generated.

I think with that in mind, scanning tools like Trivy become more useful.

I am building a tool (https://github.com/trypando/pando) to help people deploy vibe coded apps at companies more safely and easily, and share them securely.

This has been really well received, and I think it’s because YES there are risks with AI generated apps, but the risks don’t currently outweigh the productivity gains.

No. Could I have made a lot of money? Yes.

Would I have made a lot of money? Probably not.

I don’t think they are trying to solve a problem, but rather remain a competitor in the smarthome space. We see this with Apple HomeKit and the HomePods. Since companies like Amazon and Google/Nest have released a nodes with screens, Apple follows.

They like to follow a lot.. it’s easier to let others find out what works and what doesn’t first.