Stirling PDF: Self-hosted, web-based PDF manipulation tool

Original Article ↗ Hacker News Discussion ↗

A self-hosted web app for PDF manipulation, Stirling PDF, is drawing attention both for its broad feature set and for marketing that it was “originally developed entirely by ChatGPT.” Commenters probe how much AI-generated code remains, raise concerns about code quality, security, and suitability for handling sensitive documents, and contrast it with CLI tools, desktop editors, and browser-based alternatives. The exchange broadens into the challenges of trustworthy, open-source PDF tooling—especially around editing, signing, and privacy—highlighting both the appeal of local, web-based utilities and the difficulty of validating their safety.

Project overview & purpose

  • Self-hosted, web-based PDF manipulation tool using underlying libraries like PDFBox and pdf.js.
  • Popular with people who want local, browser-based PDF utilities for non-technical users (e.g., family) instead of random online services.

ChatGPT-origin controversy

  • README line “Originally developed entirely by ChatGPT” triggered debate.
  • Some read this as a red flag for code quality, security, or even misleading marketing.
  • Creator clarifies: only the first 24-hour prototype was done via ChatGPT; the app has since had over a year of human development.
  • Several commenters suggest updating the documentation to explain this origin more clearly.

Quality, bugs, and tests

  • Mixed reports: some users say they “loved it” initially but found many bugs and unusable tools; others say it “works well enough” for basic tasks.
  • Test coverage is reported as low; code quality criticized in places as showing AI-generation artifacts.

Security, privacy, and deployment

  • Strong concern about running any PDF-manipulating tool, especially AI-generated code, on untrusted input or on the public internet.
  • Several recommend:
    • Self-hosting with no outbound network access (firewalls, Kubernetes network policies, Docker with restricted egress).
    • Using tools like Little Snitch / opensnitch or packet sniffers to verify “no outbound calls” claims.
  • Some conclude they’d only use it on a private network and with trusted PDFs, which limits utility.

Alternatives & ecosystem

  • Alternatives mentioned for overlapping tasks: built-in macOS Preview, Firefox’s PDF editor, Okular, Master PDF Editor, PDFsam, various CLI tools (pdfjam, LibreOffice, etc.), and commercial PDF suites.
  • Some prefer CLI tools directly; others value the web UI as a single, device-agnostic front end.

PDF signing & advanced features

  • Multiple commenters want robust digital signing with certificates, compliant with standards like eIDAS.
  • General sentiment that open-source support for secure PDF signing and qualified certificates is weak.
  • Tools and libraries for signing do exist, but setup and PKI concepts are considered complex and under-served.