Users opinion on the stuff that's being ignored by AFFiNE devs.

[adrianvic]

So I installed AFFiNE on my home server so I don't have to deal with trusting Notion with my notes, just to get disappointed by how hostile the self-hosted version is. I'll talk about the most aggravating issues to me, some were discovered while using my instance, other searching though issues and most of them come from here.

Here is a list of stuff devs been actively ignoring:

• Disable telemetry button is not working ([Bug]: Telemetry (device details, current url, email address) still sent when toggle is off in self-hosted #12465 [Bug]: Telemetry always enabled for anonymous viewers #12821 [Bug]: Telemetry is enabled by default #13675)
• The telemetry is EXTEMELY invasive for no reason
  • e-mail, name, avatar, fingerprints, and EVEN the URL you're accessing
  • they keep gaslighting the users saying that the telemetry is anonymous; if that's true they're sending all that data to just delete on their side as soon as it comes in?
  • if you want to be safe "for now", make sure you cannot reach telemetry.affine.run
  • users not logged in are tracked without warning and that's a big no-no in various jurisdictions
  • you have to opt out of telemetry on every device, every browser, and to add insult to the injury the server admin is held hostage without being able to tell what happens with his users data (no global toggle)
• you cannot disable AI, the current option will only break the AI chat, without hiding anything
• AFFiNE security is ass
  • one click RCE has been open since v0.25.1; we're on 0.27.4 and it's still not fixed. How can you push a new version with an open RCE in your app?
  • not to talk to the (thank god) patched redirect that affects versions below 0.26.0. I could blame a LLM for that but no model on earth will write regex that accepts anything before the allowed address if you tell it will be used in production
  • Project structure is weak, with ports exposed without much reason (GraphQL API). I can understand that being because the self-hosted version is just a product derived from the commercial version and at the end of the day the person installing is the one responsible for security - but that doesn't paint a good picture of the official instance's security.
  • Promised E2E encryption but never shipped.
• Devs keep dodging this question.

Sounds like a company wanting to be the one making "open-source" without actually making things open. Why is the server not open-source? I can already download it and patch any license validation if I wanted to, why be so hostile? Smells like ignorance, that's not how open-source works. I will never pay for AFFiNE, because even paying I will still be tracked, spied on and ignored.