I want this but as a Linux distribution.

[maaneeack@noc.social]

@johnlehet @mcc I knew 1password was getting worse, my renewal is soon and that's not happening now. Someone in thread said keepass 2.x isn't infected with AI. There's passwordstore.org and passky.org which I just learned about. Honestly I'm not sure what to try, this is a big PITA.

[dramforever@mastodon.social]

@mcc So uh I have bad news about this Linux thing...

[lunarloony@dosgame.club]

@nina_kali_nina I was tempted to do Vaultwarden, but the Bitwarden clients are affected so I don't think that'd help much. Might be an okay stop-gap until I have the time to invest in it properly.

[csolisr@hub.azkware.net]

@mcc Which reminds me, how is the reimplementation of Bitwarden, Vaultwarden, doing in that regard? I'm using the latter precisely because I'm wary of depending on a commercial product that happens to be open-source, but can yank the open licensing at any point in time.

[drangnon@hachyderm.io]

@mcc @itamarst I thought KeePassXC required human reviews / unit tests in order to mitigate any llm harms. Did that change?

More broadly, I don't really see how you can prove no LLMs were involved in code contributions if they are actually contributed by a human. Prove you used emacs or vi and didn't compile it ever on a cloud service? (I'm not happy about that state of affairs, mind you)

I suppose we can start adding some sort of watermark on code?

[csolisr@hub.azkware.net]

@WideEyedCurious @Lingmops @mcc Wondering if there's a way to save OTP derivation keys in an encrypted file, then use the CLI to decrypt and then derive the current six-digit code.

[eladnarra@disabled.social]

@mcc Aw man that sucks. Why would they... Ugh.

[argv_minus_one@mastodon.sdf.org]

@elfin @mcc

If you're looking for an alternative to KeePassXC, GNOME Secrets is pretty much a drop-in replacement.

[zwol@masto.hackers.town]

@johnlehet @mcc My educated guess is the problems are more likely to be things like

- sync protocol has a security flaw that makes it possible for malware in coffee shop wifi router to learn all your passwords

- sync protocol just plain stops working

- restoration of offline backups stops working, nobody notices for months

[mcc@mastodon.social]

@argv_minus_one @elfin that's great, but can it interop with a phone?

[mcc@mastodon.social]

@draNgNon @itamarst

"I thought KeePassXC required human reviews / unit tests in order to mitigate any llm harms. Did that change?"

I literally don't give a shit. If you think it's OK to generate computer source code from a neural network, I don't trust yr judgement enough to trust your code reviews.

"More broadly, I don't really see how you can prove no LLMs were involved in code contributions if they are actually contributed by a human."

Same way you enforce any policy against stolen code

[ariadne@social.treehouse.systems]

@mcc @luana @xarvos that is indeed the problem

[argv_minus_one@mastodon.sdf.org]

@mcc @elfin

Can you be more specific? I wasn't under the impression that KeePassXC runs on phones.

[mcc@mastodon.social]

@csolisr i'm told elsewhere in thread that vaultwarden has not accepted AI code, but vaultwarden replaces the *server*, not the client, right?

[mcc@mastodon.social]

@argv_minus_one @elfin I do not use keepassxc

EDIT: checking google there *is* a "Keepass2Android", one assumes forked from the original keepass

[luana@wetdry.world]

@ariadne @mcc @xarvos that would be the pretty way. Another pretty way would be having nixpkgs maintainers add that info.

I said it was an awful way that would require full system building for a reason, I imagine it’s possible to override the default check phase or even the fetchers to check the downloaded src for .copilot and alike and fail if present.

[johnlehet@mas.to]

@maaneeack @mcc StrongBox has been sold to a company with maybe iffy success with the products they have acquired. I had first hand experience with their mess-up of the Mac utility Bartender, which I bailed on after their version.

[mozziediver@mastodon.social]

@WideEyedCurious
If you're ok with local storage and local replication rather than "cloudy", there's pwsafe. You could keep the db in some less local storage, I guess.
https://www.pwsafe.org/index.shtml

[gaditb@icosahedron.website]

@mcc @argv_minus_one @elfin I use https://www.keepassdx.com/ on android, and sync the file over with Syncthing.

I don't THINK either of those projects use LLMs, but I haven't been machmir about poring over careful details when checking.

[just_one_bear@mastodon.social]

@greyduck @mcc From all that I have seen regarding The Original KeePass (authored by Dominik Reichl in C# for .NET/Mono) has made no mention of AI pollution. How Mono are handling AI I haven't looked at, but for .NET: Microsoft is as they are.

KeePassXC (maintained by the KeePassXC team in C++ using the QT toolkit) announced the use of AI and then clarified the scope later. KeePassXC is a separate project that uses the keepass vault format but it its own thing.