I think we’re in a time where a lot more people could be contributing modules for specialized purposes (because of the improvements in AI for generating code), so it would be a good time to consider a new index. The old one was retired, I think, because so much of the code referenced was ancient and unmaintained; it’s not doing anyone any favors to point them at a 20 year old module that almost certainly doesn’t work correctly in a modern Webmin version and probably has security problems.
But, we’re also planning a major refactor of how UI works, which will make it easier for AI (and humans) to get UI right in Webmin. Currently, I think the ui-lib is the weakest part of developing for Webmin, and one that confuses agents and humans quite a lot. Getting a good looking UI out of ui-lib is hard as hell, and seemingly only Ilia can do it (I can’t). And, some other major API changes are coming, partly to address the new reality that high capability security threats are widespread now. Anybody can be a super hacker, if they’re ready to spend a few bucks on AI model usage. The need for security in depth has become more pressing.
So, a new index of Webmin/Virtualmin modules would be good and timely since so many folks are making new modules and updating old ones using LLM assistance, I’d like to get the ui-lib problem fixed first so we’re able to encourage modern habits for folks making new modules, and it definitely needs reviews and some kind of vetting, which is a harder problem than just listing modules people contribute.
From a safety perspective, if we’re making 3rd party modules easier to find and install, we’d feel responsible for performing some kind of automated malware detection (and even with that, installing random Webmin modules is potentially very dangerous!), which is costly. AI security reviews already chew up my usage limits extremely quickly, for just my own software; expanding that to review every new module someone submits could cost quite a lot. Even low-cost models like GLM add up really fast for full repo security audits. The WordPress index does malware scans, but I think they use old-fashioned AV anti-malware tools that obviously miss a bunch of stuff. I think we’d need to build our own deterministic tools (tools that run the module in a container and see whether the app does things that aren’t advertised functions, checks for known weird behaviors like making network connections, etc.) as well as LLM-based security audits. All of that is time-consuming and expensive. We’re not exactly rolling in money for infrastructure like this or for burning millions of tokens every month on security audits of third-party code.
I’ve long wanted to build a third-party ecosystem for Webmin and Virtualmin. It’s important for serving customers who have specific needs. But, it’s always been kind of a chicken and egg problem. Until recently there weren’t many maintained third-party modules (and there still aren’t really all that many, I’ve seen a half dozen folks post things). There was a lull in third-party dev for many years…there were lots of modules in the 00s, with almost no new ones through the 10s and 20s, and many of the old ones going unmaintained.
