Discussion · bonfire.cafe

RE: https://mastodon.scot/@kim_harding/116108957641748718

I want this but as a Linux distribution. I don't think I'm asking for much here. I am just asking for the "open source community" to be to the left of Goldman Sachs

kim_harding ✅

@kim_harding@mastodon.scot · 2 months ago

Goldman Sachs launches AI-free index
https://www.axios.com/2026/02/20/ai-goldman-sachs-stocks-index
Goldman Sachs has launched an S&P ex-AI index, SPXXAI, which that lets you invest in the S&P 500 benchmark index minus all things AI.
This product is proof of the demand among investors for a way to hedge their exposure to the AI trade.

Martin Hamilton

@m@martinh.net · 2 months ago

@mcc Searching merged GH PRs authored by claude, just to feel something...

GitHub search for merged PRs authored by 'claude'. There are 2.3 million of them. Not great, not terrible.

mcc

@mcc@mastodon.social · 2 months ago

@m oh… this post was meant to be a reply to your post https://mastodon.social/@mcc/116115453811522063

mcc

@mcc@mastodon.social · 2 months ago

My understanding is that Bitwarden and KeePassXC, the two open source password managers, are *both* using random code generators at this point, which is terrifying as those are the exact tools where a small error could have the largest negative impact, and also tools that once you've committed to using it you can't quickly back out if they enter a code quality decline

https://github.com/bitwarden/clients/tree/main/.claude

GitHub

clients/.claude at main · bitwarden/clients

Bitwarden client apps (web, browser extension, desktop, and cli). - bitwarden/clients

char

@hack_char@infosec.exchange · 2 months ago

@mcc
AI assisted code generation is here to stay. It's not random and probably one of the best uses for an LLM. I'd only be concerned if LLM generated code was commited without review.

I only see 2 PRs that are marked ai-assisted for KeePassXC and neither look like a problem. The large commit @nina_kali_nina to bitwarden/clients also used checkmarx scanner, github-advanced-security scanner and claude to review, but, there are also 11 non-bot reviewers listed on it.

Jeff Atwood

@codinghorror@infosec.exchange · 2 months ago

@hack_char @mcc @nina_kali_nina no code should ever be committed without review

🏳️‍🌈🎃🇧🇷Luana🇧🇷🎃🏳️‍🌈

@luana@wetdry.world · 2 months ago

@mcc oh yikes wtf please not bitwarden

Nina Kalinina

@nina_kali_nina@tech.lgbt · 2 months ago

@luana @mcc nothing says "super safe password manager" more than "161 files changed, 776 lines added, 541 line removed, some files are hidden from PR by default, authored by Claude Sonnet, merged with some tests failing"

A screenshot of a commit from Bitwarden repo showing a change authored by Claude, with 161 files changed, 776 lines added and 541 lines removed; some of the changed files are hidden by Github

Tim Bray

@timbray@cosocial.ca · 2 months ago

@nina_kali_nina @luana @mcc Well to be fair, it was reviewed by ten humans and did pass all the tests: https://github.com/bitwarden/clients/pull/18584

Even given that, I still find the future opaque; will things sort out after the bubble pops in such a way that there's a sane/safe way to get value out of Claude-like software? I'm pretty convinced that YOLO-flavored vibe coding is a path going nowhere but baffled as to how things end up.

Timshel

@Timshel@social.sparkway.org · 2 months ago

@nina_kali_nina @luana @mcc @gabrielesvelto
Not saying they are not writing crap with claude but the commit in question (https://github.com/bitwarden/clients/commit/5dc49f2) is mainly renaming an icon module.

1+ more replies

mcc

@mcc@mastodon.social · 2 months ago

RE: https://wellduck.me/@greyduck/116110983001607000

I would like the answer to this question as well.

Federation Bot

@Federation_Bot · 2 months ago

When I say "fork every software project containing code by by 'AI code assistants', starting at the commit before the slop is known or believed to have been added, and resume from there", I really do mean every project

https://donotsta.re/objects/8e2166c6-3e0f-4ea3-8a29-3008702a39f7

Karel P Kerezman

@greyduck@wellduck.me · 2 months ago

@mcc I admit I don't know the KeePass ecosystem terribly well, but does this go "up the chain" to regular KeePass 2.x or is it just XC?