Skip to main content
okikio_dev u/okikio_dev avatar

okikio

u/okikio_dev

Feed options
Hot
New
Top
View
Card
Compact

It is more like using pre-cut vegetables to make a salad than anything else. I still made the salad I just used tools that sped up the repetitive parts.

That is basically what AI was here. I used it mostly for docs, research, templating, and basic setup. The project itself, the decisions behind it, and the final result are still mine.

I can understand the apprehension to AI generated code, AI generated anything to be honest. The reason I didn't mention it earlier is because it has never really mattered before.

In 10 years of building software, I’ve never needed to list out the tools libraries, editors, etc... that I've used as part of my process.

The code is fully open source and MIT licensed. You can use it however you wish.


tbh, it's a philosophical difference but imo AI can't create anything, it's not sentient. you can use it as a tool, but just because you use a hammer to create a roof does not mean the hammer created the roof...you did. a more apt metaphor would be you give AI a task it will give you a result it will not necessarily give you a solution.

I personally use AI like auto-complete, I've been using auto-complete for years, it's just smarter auto-complete imo.

A good example would be for this project, AI did pickup the patterns behind DDNS but it doesn't understand that Synology approaches DDNS in a somewhat unsafe manner natively. AI also doesn't understand the nuance by default that's primarily why the `cloudflare-ddns` project has a separate update model/process included under the `/updates` endpoint, so you can actually have a more secure alternative if your usecase demands it.

For my usecase I was fine with the slightly less secure but more Synology native `/nic/update` endpoint.


You should be able to use WAFs and other defences if you so wish, but it was more designed with the assumption that you are not exposing your DSM publicly, so there really isn't a point in using WAFs if you're not exposing publicly. If you are exposing publicly then you should absolutely look to setup WAFs, etc... Personally I recommend using Tailscale so you can access your NAS outside your private network, that way you avoid the headache of setting up WAFs.


you should be able to just use a CNAME record to point your custom domain at your Synology domain


The synology domain is a good solution too, but if you want a custom domain that's when you'd want to use the cloudflare ddns


Yikes, thanks for pointing both out, I've now fixed the internal worker.dev and I didn't know other people had already created Cloudflare Worker DDNS services, TIL 🤦‍♂️.

When I was doing research I kept running into containers, so I thought a Cloudflare Worker would be kinda neat and novel, now that I know that others have already had the same idea kinda deflates my enthusiasm a little but anyway. At least the one thing I've got going for me is that I designed the repo to be simple and easy to deploy using a single button Cloudflare deploy badge.

I wouldn't trust any DNS related security to AI generated code (count of number of times DNS took services down https://adrianco.medium.com/the-internet-is-down-it-was-dns-again-e86341db21d5 ), a lot of that I wrote myself but I did AI generate the docs taking screenshots here and there to make it easy to follow.


Your concern about anyone pointing the domain at any other IP Address is valid tbh and to some degree how DDNS works by default, there's not much you can really do about that.

Besides that the shared secret is not inherently a Cloudflare API Token, it can really only be used through the Cloudflare Worker itself, which allows you to lock down how changes to your domains can be made. If some attacker has your Cloudflare API Token they can use it anywhere, including literally just adding A records linking to a completely different IP Address if they wanted.

The Cloudflare API Token isn't granular enough to limit the access to just a specific record, you have to give permission to an entire DNS Zone meaning, if anyone got access to your Cloudflare API Token you might as well have just given them your Cloudflare Email/Password + any 2FA you setup as well. It's for all intents and purposes a security nightmare.


I used AI for some parts that doesn't mean I didn't make it though. In fact, AI can't make anything by definition, plus a solution like this already existed I wouldn't have bothered making one. I used AI primarily for bootstrapping and autocomplete, and to write some of the docs for other people to use. But the bigger question is does it solve the problem and does it do so reliably.