Post

@mkljczk Eventually, I'd expect we should be able to build a complete computer's repository of software written only by people who have verified they haven't used LLM "code assistants". Since companies are unlikely to provide such verification, we should get as close as we should possibly get.

But since you asked, yes, I think any software or OSS code contributions from a corporation should be treated with concern right now, since many have adopted mandatory LLM policies.

@m oh… this post was meant to be a reply to your post https://mastodon.social/@mcc/116115453811522063

@tris @mcc we are trying to be.

We recently introduced a policy of no LLM contributions with exceptions if people need to use LLM for accessibility purposes.

It's probably impossible to declaratively state all submissions are 100% human created but we have our stance and hope people will respect that and we will also reject submissions if we doubt authenticity.

@haqistan

Here's the text I'm currently copypasting into my own open source projects: https://codeberg.org/mcc/nameless-experimental-lisp/#contributor-agreement

I've seen other people with standard text, but nothing designed to be copypasted.

Incidentally, I am considering upgrading to something a little stronger, like this; what do you think about it? https://mastodon.social/@mcc/115872922320160715

@Brett_E_Carlock the problem is removing any one tool from my life is a relatively large time investment and projects are adding "boycott me" flags faster than I can switch to or create alternatives

@ftranschel "I can get LLM corruption out of all the software in my computer except my web browser and password manager", in addition to being at this point afaik still aspirational, is kinda… that's not a good outcome. The web browser and password manager have extreme persmissions and extreme capacity to do harm.

@mcc this is not great news, i hope is only XC and the OG keepass version is vibe code free

@mcc I'm about 10 steps beyond "I can't even" at this point.

I'm not even sure what to do anymore. Go back to putting passwords in notebooks? Stop using online banking or online shopping?

@mcc I emailed BitWarden about this and their response was, literally, "our code is open source, so it's fine."

The shit sandwich they're making isn't more appetizing because they do it in public view. Promtpfondlers are somehow even worse than Bitcoin dweebs.

@mcc Unclear about how KeePassXC is somehow compromised by using random key generators. The parameters are set by the user, and it is optional in any case. So what exactly is the problem here?

@mcc At which point are such applications just Claude with a logo tacked on?

@mcc You can avoid KeePassXC altogether. It's the nicest desktop client for your keepass DB, but you don't need to use it.

I am keeping an eye out for another fork for keepassxc if this goes on longer. On Android, you can use KeePassDX.

@mcc There are more password managers than those two, of course. I use GNOME Secrets as a desktop GUI application for some things. For the command line there's pass (https://www.passwordstore.org/), which uses GnuPG.

I use my own sopass (https://sopass.liw.fi/), which I wrote myself.

CLI isn't for everyone, but I'm sure we don't need to despair.

@mcc I can guarantee you that the Linux kernel and MacOS/Windows are being written by "random code generators" as you have put because most of the code pushed on to these projects are by engineers hired by big corporates who mostly have LLM subscriptions.

It is better to acknowledge and understand a tool than to spread FUD about it. I am no AI flag hoister but you are just scaring people away from genuinely good tools maintained by the same people for years.

KeePassXC is totally offline which reduces the attack vector a lot anyway. And the file format is open so you can pick many clients if you don't trust KeePassXC maintainers.

@mcc bitwarden ffs. I manage a paid family bitwarden plan and I'm happy with the service but I was planning on moving to proton family pass because of cutting down on us tech & now this

The problem I have with proton pass is that you can't add an account to the family plan if it already has paid proton services so that rules that out as an option

I'm not removing someone's mail plus just to add them to a family pass plan so I'll have to stick with bitwarden a little longer & see how things go

@mcc
AI assisted code generation is here to stay. It's not random and probably one of the best uses for an LLM. I'd only be concerned if LLM generated code was commited without review.

I only see 2 PRs that are marked ai-assisted for KeePassXC and neither look like a problem. The large commit @nina_kali_nina to bitwarden/clients also used checkmarx scanner, github-advanced-security scanner and claude to review, but, there are also 11 non-bot reviewers listed on it.

@mcc Both KeePassXC and Bitwarden support exporting their databases to other password managers, how is that not a way to “quickly back out” from them? It’s not like there’s a vendor lock-in, moving from them to another password manager takes minutes at most.

@mcc "In the recently published blog post titled “About KeePassXC’s Code Quality Control“, the team stresses that AI assists developers during the review and drafting process, but no AI-generated code is merged into the KeePassXC codebase. The application itself remains fully human-written and continues to follow the rigorous security standards that its users expect."

https://linuxiac.com/keepassxc-clarifies-ai-policy-used-only-in-development-never-in-the-app/

@mcc For the Bitwarden CLI, I was already not using it because it requires running code from NPM outside of a browser, but https://github.com/doy/rbw is a great alternative.

@mcc damn, i was hoping bitwarden would know better, been very happy with their stuff, now not sure what to do

@mcc Oh come on for fucks sake. I just migrated from KeepasXC to Vaultwarden/Bitwarden be außer of this shit. Passwordstore is great but the client and browser integration sucks. So now what?

@mcc Also, the main difference is that KeePassXC at least tracks the pull requests where AI-assisted code is used, and they require it. There's no way to confirm the same with Bitwarden. The pull request may or may not have been using AI. There's no clear track record how long they've been using it.

@mcc KeePassXC has merged only a little bit of AI-assisted code, not in any critical parts. And there has been no merges of that kind of code since last November. KeePassXC is not preferred to use AI code, but they require people to let them know if they are trying to push code that includes it. It doesn't mean the code will not be reviewed before it's even accessed. Majority of the developers are NOT using AI. Read their blog post.

https://github.com/keepassxreboot/keepassxc/pulls?q=is%3Apr+label%3A%22pr%3A+ai-assisted%22+is%3Aclosed

@mcc KeepassXC as well? I have a hard time as it is to trust a password manager. It seems I have to write my own?

@mcc 😭

@mcc yikes

@mcc Aw man that sucks. Why would they... Ugh.

@mcc I've pinned my KeePassXC version to the last one without AI-generated code.

@mcc I'd argue that password managers are very easy to jump between. They tend to have good export and import functions. I've transitioned from keepass to dashlane to bitwarden to vaultwarden with little effort.

@mcc Excuse an undereducated question from a long term 1password user who is going to move from it now: is the issue with “random code generators” that random passwords generated by these apps are easy to crack?

I’m looking at moving to Keepassium and as I understand it each of these apps in this family have different code to do password generating and are thus all different.

@mcc Let me tell you something more scary: These projects accept code contributions from random people they don't know, they never meet. Nobody knows these contributors' skill level, their mental health status, the acutal intend. They might be sloppy coders introducing bugs every other line. They could be maniacs. They could be evil nations' agents trying to implement backdoors.

Why doesn't this scare you?

@mcc oh yikes wtf please not bitwarden

RE: https://wellduck.me/@greyduck/116110983001607000

I would like the answer to this question as well.

@mcc I admit I don't know the KeePass ecosystem terribly well, but does this go "up the chain" to regular KeePass 2.x or is it just XC?

@mcc Yeah, KeePassXC going this route really hurt. I'm probably going to migrate back to a text file encrypted with gnupg for basic password management, but I have no idea what I'm going to use for one-time passcodes.