Transcript
A post by [object Object] (@[email protected]) saying: courtesy of @[email protected], Proton is now the only privacy vendor I know of that vibe codes its apps: In the single most damning thing I can say about Proton in 2025, the Proton GitHub repository has a “cursorrules” file. They’re vibe-coding their public systems. Much secure! I am once again begging anyone who will listen to get off of Proton as soon as reasonably possible, and to avoid their new (terrible) apps in any case. https://circumstances.run/@davidgerard/114961415946154957
It has a reply by the author saying: in an unsurprising update for those familiar with how Proton operates, they silently rewrote their monorepo’s history to purge .cursor and hide that they were vibe coding: https://github.com/ProtonMail/WebClients/tree/2a5e2ad4db0c84f39050bf2353c944a96d38e07f
given the utter lack of communication from Proton on this, I can only guess they’ve extracted .cursor into an external repository and continue to use it out of sight of the public
I’d bet they just added it to their global .gitignore where it should be, then removed it because they didn’t want their private dot files committed to a public repo.
I don’t think this user knows much about git works. I don’t think this is nefarious or “vibe coding” as it’s colloquially known to be. It’s a bit much to describe all LLM use blindly as vibe coding, when vibe coding usually means just blanket accepting AI content.
deleted by creator
Is the privacy of their code that much of an issue in this case given its a public repo? Its going to get scraped by the bots regardless.
Yeah, this logic would encompass all open source projects. Hell, my comment right now will be read by an AI. Why? I’m posting it in a public place.
Are we really shitting on companies because they have a config file for the wrong editor? Sorry, a config file for the wrong editor (excluding emacs because be as prejudiced as possible against those folk)?
Do I like “AI First” editors? Hell no. But VSCode is rapidly making that pivot and I don’t know the lineage of Cursor well enough to know if it also used to be “just any other editor”. And, from a quick google, it supports local LLMs (e.g. ollama), so the “Big AI is going to have all your code” problem is mitigated…
Also, the repo is on Github. Big AI (Microsoft) already HAS all their code. And before we have “Well you should selfhost a gitea!”: If your website is public facing, it has been scraped by “AI”. And if your open source project is hidden behind ten paywalls? I am not gonna finish that joke because people get really pedantic and pissy when you try to define “Open Source”.
At the end of the day: At a project level? If active code review by qualified developers is going on, I really don’t care how the code was written. I DO care about those individual developers and their abilities as they continue to use “AI” based tools but… that is a different discussion.
I WOULD be interested in a link to the actual offending file. I’ve been part of enough projects where it was easier to just have dotfiles for every major editor because you have a wide range of contributors and no true scotsman doesn’t have one of the local vimrc style plugins running. Whereas if it is massive instructions on how to generate code, I would get a lot more worried.
But an unsourced screenshot of a discussion thread ain’t it.
Pretty on point, the .gitignore in the repo has a CLAUDE.md
https://github.com/ProtonMail/WebClients/blob/main/.gitignore
Um, it’s a public repository. You can view the code that’s been added. Even if it IS AI generated, you can review it yourself.
I’m as anti-AI as anyone but this is misplaced AI-alarmism.
can review it yourself.
You’re a supervisor and you have 2 employees: Bill and Jim. As a supervisor your job is to ensure the work is being done correctly.
Bill is competent and rarely makes major mistakes. Jim does a decent job most of the time … but he’s also a savant at screwing up – he regularly fucks up in ways that aren’t immediately obvious but are guaranteed to cause serious problems days to weeks from the screw up.
You can glance over Bill’s work and be fairly certain it’s fine. You need to go over every single piece Jim’s work to check for problems, and even then some are probably going to slip through.
AI is currently Jim, and Jim has no business writing code for anything privacy or security focused.
This is a great example since AI isn’t taking on the role of an independent software engineer here, so there is no “Jim” and this is much less of an issue than y’all are making it out to be. You know that auto-correct is also a form of ML right? Have you considered that tools can be used responsibly and that standards for software developers still apply even when they use new tools?
You know that auto-correct is also a form of ML right?
Yeah, and I don’t fuckin use it.
Also, my auto-correct is saying that sentence is missing a comma, so I guess you don’t either.
Cool that’s great. Can you tell me that none of the software you use has been developed by software engineers making use of machine learning methods?
That is pretty immaterial to the issue. The issue is that when it comes to security, it’s extremely poor form to rely on unintelligent mimicry.
Does anyone here actually review code?
Only my own code and so far most of it has been unacceptable.
i once wrote a script to launch a program with specific flags that i think was mostly correct, it holds center place on my CV
Pure, unabashed honesty. I love it. 🫶
Uh yeah? You’d be stupid not to review code, whether written by an AI or a human. I don’t trust either.
I’m guessing OP means code you use rather than code you write, in other words auditing. Likely very few of us do that with any thoroughness. IIRC proton does have some independent auditing.
That’s what I mean too. Y’all don’t just copy-paste from stack overflow praying it works do you?
No, like proton mail app. Have you reviewed it? Or Signal or Veracrypt or TheNewHotness.
That obviously not what they meant. They mean, do you review the code for every open source application you use? Do you review every library you utilize? I’m willing to be it’s a no for both of these, because no one has time for that.
Yes, and it’s one of the most important things I do. Given the AI codegen boom we’re seeing, it’s also the skill I have that is increasing the fastest in value.
yes as a consultant/freelancer THIS is where the majority of my work is coming from now. if you’re good at this SERIOUSLY consider consulting and freelancing for various companies that are now desperately trying to fix their AI tech debt. It’s the ONE thing that is completely in demand right now due to the sheer incompetence of all these places that decided vibe coding and AI was the way to go.
you have no idea how much money you can potentially be making right now doing this. I’m booked solid for the rest of the year purely because of this.
Not gonna really be thing long-term. Up front savings vs customer long term retention. The up front savings are what business cares about. So yeah you’ll get some companies who fucked up. Most just double down on the a. I.
What you’re doing is entering the bargain-phase
Does anyone here realize that one person using Cursor doesnt mean “tHeY’rE vIbE cOdInG aCrOsS tHe wHoLe pLaCe!”
Then why didn’t they just say that instead of being shady and rewriting history?
Because thier bosses aren’t accounta le to you and I? That don’t have to say a dn thing
that would make sense if it wasn’t a fucking business selling the promise of security lol
Probably anti-Proton. I’m no conspiracy theorist, but the amount of pro BlueSky, anti Proton, anti Signal people I see on Lemmy make me wonder sometimes.
How is this proof of vibecoding?
Cursor is an AI-powered code editor that understands your codebase and helps you code faster through natural language. Just describe what you want to build or change and Cursor will generate the code for you.
Using cursor doesn’t mean you’re vibe coding.
I use ai all day at work for development, none of it is vibe coding.
Yeah there’s a big difference in code quality between using cursor as an aid to write code and vibe coding which would be asking it to write and debug large swathes of code with little human input. AI is very good at correctly writing a couple lines at a time. It quickly loses the plot when trying to write hundreds of lines or more and the human user has no idea what it’s doing anymore.
Sure, but even VS code has been pushing Copilot pretty hard and from the screenshots the setups look fairly similar. It’s a recently released code editor with their own personal AI built in vs. VS Code which has the AI as an extension (or built in, I don’t know what the default install is like these days).
If they’re using it to auto complete lines of code or fill out boilerplate then I don’t see the problem. If they’re typing “make me a password manager” into the prompt window, hitting enter, and accepting it blindly, that’s a problem. Also the code is (at least in this case) open source, so there should be better evidence of bad vibe coded code than the presence of a config file
I think there are better things to criticise Proton for, and unless there is more to the vibe coding than using the Cursor, citing this as a reason will get those other criticisms ignored in the noise.
Cursor is an “ai powered” code editor, cursorrules is a file it uses for configuration.
Unfortunately, so is Visual Studio and VS Code.
The presence of an AI assistant isn’t evidence of vibe coding. Even using that AI assistant to auto-complete lines or small sections of boilerplate isn’t vibe coding. To do that you need to ask the AI for whole swaths of code and then just accept what it gives you.
Proton’s repo here is open source. What portion of it presents issues? Any?
Sure, but cursor is different since it’s marketed as an Ai editor. VScode is just a general one.
Proton’s repo here is open source. What portion of it presents issues? Any?
Ai code is plausible bullshit, it may work, it may have bugs or vulnerabilities. It’s harder to spot these since its plausible bullshit.
but cursor is different since it’s marketed as an Ai editor. VScode is just a general one.
See, that is just the thing: VS Code is marketed as an AI editor. The homepage is literally an autoplaying video of an AI writing code with this title, big and bold, right at the top of the screen:
Poor choice of words on my part, The only appeal of cursor over vscode is the ai features.
Why would you use Cursor instead of VS (the standard for decades) if you’re not going to use the AI features Cursor was specifically created for?
It doesn’t matter Proton is the whipping boy of the fediverse
