I want this but as a Linux distribution.

[ruuda@fosstodon.org]

@mcc For the Bitwarden CLI, I was already not using it because it requires running code from NPM outside of a browser, but https://github.com/doy/rbw is a great alternative.

[lhengstmengel@mastodon.nl]

@aiono @lunarloony @nina_kali_nina yes, there is an android app available that works quite good: https://f-droid.org/packages/app.passwordstore.agrahn

[elmar_iachi@chaos.social]

@mcc "In the recently published blog post titled “About KeePassXC’s Code Quality Control“, the team stresses that AI assists developers during the review and drafting process, but no AI-generated code is merged into the KeePassXC codebase. The application itself remains fully human-written and continues to follow the rigorous security standards that its users expect."

https://linuxiac.com/keepassxc-clarifies-ai-policy-used-only-in-development-never-in-the-app/

[matt@toot.cafe]

@mcc Has Rust crossed the line yet? Rust has been such a valuable tool that I'm going to be really upset if we have to either give it up or fragment the community.

[gsprs@mastodon.social]

@nina_kali_nina > These PRs are generally very difficult to review for humans.

Is it difficult for humans using AI? I’ve heard it’s easier that way 😁

The anti-AI crowd is more than welcome to put in the work and fork the projects they criticize for using LLMs and maintain their own repo with 100% organic homegrown code, I wouldn’t hold my breath waiting for that though, being outraged over other people’s generous contributions is far more attractive.

[gsprs@mastodon.social]

@mcc Both KeePassXC and Bitwarden support exporting their databases to other password managers, how is that not a way to “quickly back out” from them? It’s not like there’s a vendor lock-in, moving from them to another password manager takes minutes at most.

[mirabilos@toot.mirbsd.org]

@mcc yes. They do. With this, they no longer are properly licenced FOSS, either…

[debacle@framapiaf.org]

@tragivictoria @mcc

https://www.debian.org/ports/hurd/

[benjamineskola@hachyderm.io]

@gsprs @nina_kali_nina @luana @mcc it’s funny because pro-AI sentiment has even less thought behind it

[gsprs@mastodon.social]

@benjamineskola @nina_kali_nina @luana @mcc A "no you" reply like this really hammers home the idea that anti-AI sentiment has no real substance behind it and is just a way to virtue signal the in-group political belief. AIs are currently not sentient and yet an LLM could come up with a more elaborate and constructive reply, what does that say about your supposed sentience?

[benjamineskola@hachyderm.io]

@gsprs Whe your starting point is “lol anti-AI people are stupid” there’s no point in putting real thought into a response. In fact there’s nothing of substance to respond to.

[benjamineskola@hachyderm.io]

@blotosmetek @nina_kali_nina @luana @mcc but you don't need an LLM in order to fix indentation and in fact they can't do so reliably anyway; so even using one for something 'harmless' like that shows questionable judgment.

[mcc@mastodon.social]

@yukijoou @mary what I am trying to describe is reducing iteration cycles, which is a non-necessary, but very useful thing. Regardless, sometimes I encounter software (for example the bluesky social app) where the build instructions run through expo and no others are given.

[mawhrin@circumstances.run]

@gsprs @mcc the ability to export passwords from a potentially compromised password manager is not the most important element of the jigsaw.

the potential of the compromise is.

[mcc@mastodon.social]

@AerynOS @tris meaning what?

Are you saying you have a software repository free of software containing LLM contributions?

It's very easy to say your distribution's unique software follows some principle or other because most Linux distributions write little software, instead mostly packaging other people's software.

[mcc@mastodon.social]

@CodingPhysicist Note vaultwarden is a separate project and has no specific signs of LLM use as far as I'm aware. I don't know what to do with this information though since surely vaultwarden is usually used with a bitwarden client?

[mcc@mastodon.social]

@gabrielesvelto @luana @nina_kali_nina @Timshel I am not qualified to speak on this but I've seen others look into it and seen that claud's bot submits many of these trivial/cleanup PRs, and some of them introduce security flaws, because the bot has no way of knowing if a change is good or bad. You shouldn't be trusting a bot which knows nothing but statistics to make minor random changes. Keep allowing that and eventually it will slip something awful past you.

[hack_char@infosec.exchange]

@mcc
AI assisted code generation is here to stay. It's not random and probably one of the best uses for an LLM. I'd only be concerned if LLM generated code was commited without review.

I only see 2 PRs that are marked ai-assisted for KeePassXC and neither look like a problem. The large commit @nina_kali_nina to bitwarden/clients also used checkmarx scanner, github-advanced-security scanner and claude to review, but, there are also 11 non-bot reviewers listed on it.

[mkljczk@pl.fediverse.pl]

@mcc@mastodon.social so I’m assuming the index is exclusively companies that have never touched so-called ‘AI’, which is what you’re expecting from said Linux distro?

[mcc@mastodon.social]

@mkljczk Eventually, I'd expect we should be able to build a complete computer's repository of software written only by people who have verified they haven't used LLM "code assistants". Since companies are unlikely to provide such verification, we should get as close as we should possibly get.

But since you asked, yes, I think any software or OSS code contributions from a corporation should be treated with concern right now, since many have adopted mandatory LLM policies.