Transcript
A post by [object Object] (@zzt@mas.to) saying: courtesy of @davidgerard@circumstances.run, Proton is now the only privacy vendor I know of that vibe codes its apps: In the single most damning thing I can say about Proton in 2025, the Proton GitHub repository has a “cursorrules” file. They’re vibe-coding their public systems. Much secure! I am once again begging anyone who will listen to get off of Proton as soon as reasonably possible, and to avoid their new (terrible) apps in any case. https://circumstances.run/@davidgerard/114961415946154957
It has a reply by the author saying: in an unsurprising update for those familiar with how Proton operates, they silently rewrote their monorepo’s history to purge .cursor and hide that they were vibe coding: https://github.com/ProtonMail/WebClients/tree/2a5e2ad4db0c84f39050bf2353c944a96d38e07f
given the utter lack of communication from Proton on this, I can only guess they’ve extracted .cursor into an external repository and continue to use it out of sight of the public
Um, it’s a public repository. You can view the code that’s been added. Even if it IS AI generated, you can review it yourself.
I’m as anti-AI as anyone but this is misplaced AI-alarmism.
can review it yourself.
You’re a supervisor and you have 2 employees: Bill and Jim. As a supervisor your job is to ensure the work is being done correctly.
Bill is competent and rarely makes major mistakes. Jim does a decent job most of the time … but he’s also a savant at screwing up – he regularly fucks up in ways that aren’t immediately obvious but are guaranteed to cause serious problems days to weeks from the screw up.
You can glance over Bill’s work and be fairly certain it’s fine. You need to go over every single piece Jim’s work to check for problems, and even then some are probably going to slip through.
AI is currently Jim, and Jim has no business writing code for anything privacy or security focused.
Probably anti-Proton. I’m no conspiracy theorist, but the amount of pro BlueSky, anti Proton, anti Signal people I see on Lemmy make me wonder sometimes.
deleted by creator
It really reminds me of the Mastodon mob mentality that caused so much trouble for fosstodon :/
That is pretty immaterial to the issue. The issue is that when it comes to security, it’s extremely poor form to rely on unintelligent mimicry.
I’d bet they just added it to their global .gitignore where it should be, then removed it because they didn’t want their private dot files committed to a public repo.
I don’t think this user knows much about git works. I don’t think this is nefarious or “vibe coding” as it’s colloquially known to be. It’s a bit much to describe all LLM use blindly as vibe coding, when vibe coding usually means just blanket accepting AI content.
deleted by creator
Is the privacy of their code that much of an issue in this case given its a public repo? Its going to get scraped by the bots regardless.
deleted by creator
Are we really shitting on companies because they have a config file for the wrong editor? Sorry, a config file for the wrong editor (excluding emacs because be as prejudiced as possible against those folk)?
Do I like “AI First” editors? Hell no. But VSCode is rapidly making that pivot and I don’t know the lineage of Cursor well enough to know if it also used to be “just any other editor”. And, from a quick google, it supports local LLMs (e.g. ollama), so the “Big AI is going to have all your code” problem is mitigated…
Also, the repo is on Github. Big AI (Microsoft) already HAS all their code. And before we have “Well you should selfhost a gitea!”: If your website is public facing, it has been scraped by “AI”. And if your open source project is hidden behind ten paywalls? I am not gonna finish that joke because people get really pedantic and pissy when you try to define “Open Source”.
At the end of the day: At a project level? If active code review by qualified developers is going on, I really don’t care how the code was written. I DO care about those individual developers and their abilities as they continue to use “AI” based tools but… that is a different discussion.
I WOULD be interested in a link to the actual offending file. I’ve been part of enough projects where it was easier to just have dotfiles for every major editor because you have a wide range of contributors and no true scotsman doesn’t have one of the local vimrc style plugins running. Whereas if it is massive instructions on how to generate code, I would get a lot more worried.
But an unsourced screenshot of a discussion thread ain’t it.
deleted by creator
But isn’t this a public repo?
Privacy for a codebase is not the same as privacy for me. Security through obscurity would be more at odds with privacy for the end user.
Do you understand the difference between using AI assistance for coding and vibe code?
Yeah using cursor or any AI assistance != vibe coding. I’m just confused why they acted guilty and edited their history without saying anything
And still no drive client for Linux…Fuck those guys :)
Rclone foo!
I’m annoyed because I had to go find a tree that actually had the cursor files. If there’s a smoking gun, you gotta fucking link it when you call someone out.
The irony of Proton attempting to remove it this way is that GitHub trees are permanently available. The only way to remove something once a link has been created is to delete the repo. I’d expect a security-minded company to understand that. To me that’s much more egg-on-face than vibe-coding secure applications. Neither is good; only one very explicitly highlights you don’t know shit about security.
AFAIK, unless that tree has signed commits in the history after the commit introducing the cursor files (or it’s otherwise verifiable, like having been linked by a member of their team), that’s not a smoking gun.
I remember a meme that was shared a while ago, where somebody forked the Linux kernel on GitHub, made a joke commit under Linus’s details (which are NOT verified by design), and posted them around. I can’t find an instance of that right now, but here’s a somewhat similar example, where somebody put a fake backdoor in their fork and changed the url to the original repo, which lets them pretend the commit came from the original repo.
I’d love to see a smoking gun to confirm those claims, but commiting as somebody else, with a fake time, and editing history aren’t that difficult - if they could remove the file from history, somebody else could add it to history.
Absolutely fair! The other commits in that tree for the
.cursorfolder match existing contributors. This unchanged PR and this unchanged PR both contain the same structure. This tree comes from this unmerged, closed PR which also matches. This closed issue, commented on by maintainers, references this tree which corroborates the other unlinked commit tree. (Edit: I stopped because I got bored; see the other unchanged issues and PRs that show a rewrite of history)Attribution is never 100% especially when APTs are concerned. I am confident when I say there is way more evidence here showing the files officially exist and were officially part of the tree than many of the very confident yet unconfirmed APT attributions we actively rely on.
I don’t know what APT stands for in this context, but just one PR/comment from a trusted contributor seems like plenty of proof, you really went and did your homework, and then mine too ;D
Advanced Persistent Threat. For example, we assume the Lazarus Group is responsible for several high profile attacks. We don’t have anything close to the evidence here for direct attribution; using that as a bar I’d say the Proton attribution is pretty strong. Since my callout was security-focused, I wanted to ground it in other security terms. Your point was completely spot on and it was a great reminder to me because sometimes I forget the basics.
For folks that don’t know, there are a few bad things with the Proton response. First and foremost, you don’t rewrite
mainever just from a development perspective. It usually causes more trouble than it’s worth unless you’re a team of one and no one else has ever touched your repo. From a security perspective, it’s very misleading to assume rewriting history can clear history from GitHub as I hope I’ve shown here. Additionally, anyone with a local copy of the repo from before the rewrite can use the reflog to access that history. While it won’t work for any new pulls post-rewrite, it’s still a risk for a large repo like this.The correct way to handle this or other sensitive information being added to a repo is to use remove the file in a merge and rotate any secrets exposed. Take the hit on the chin; security is just about reducing risk not removing it. I have cleaned up plenty of repos before. Tools like gitleaks can search your active tree as well as your history for exposed secrets. Delete, commit, own the failure. Proper ignore files, meticulous review, and automated checks also help reduce risk.
Overall that’s why I think this is dumb. To me it would be a non-issue if a security-minded company had used security best practices to handle this.
How far have the mighty fallen.
Thinking of moving my main e-mail address to tuta. Alas, haven’t been able to find a good provider that uses tried-and-true protocols like IMAP.
Disroot is in my 👀 now because you guys reminded me it was already, some time ago. Let’s see how that one goes!
Love mailbox.org, got the lite plan for €12 per year and works like a charm. Can use the secure mail address or the reg and just paste your public key into to use with Thunderbird.
I’ll be considering it, but if I have to deal with paid services in this good year of Arceus of 2025 I’d prefer them to at least deal with my national currency directly, or fall within my country’s jurisdiction.
I’ve made an exception for SDF simply because 1.- they’re awesome and 2.- the payment is one-time-only.
Hold your horses buddy it ain’t that bad, but if you want an alternative, Try Disroot
Tried that once, long ago, but I honestly don’t remember why I couldn’t complete the signup. Maybe an essay, or an issue with e-mail verification.
Might have to take a look at it again!
I would very much consider doing some actual research on tuta. Last I checked, they put a LOT of effort into preventing you from controlling your own inbox (Proton have their god awful sync program but it works). And their support forums were basically nothing but constant complaints of downtimes and outages.
My current approach, that I am slowly migrating everything toward (from gmail), is my own domain that I own and addresses at that. I then use (paid) services to manage the email server and just change my DNS settings so that said emails get routed to the right service. I keep a local copy of all my emails on my desktop (working on a solution to my NAS). So if the company goes to shit? I can migrate my entire existence to a new one within 24 hours (usually less because Cloudflare is really good…).
Currently I use Proton (and hate their sync program). I’ve seen a LOT of good word on Fastmail and like that they don’t have any special sync program at all. Main issue is that Proton still have the best VPN for torrenting (linux ISOs only, obviously) and I need to math out what it would cost to switch to just ProtonVPN and then Fastmail. But (Not That) Will Smith wrote up a really good blog post a few months back where he went into why he likes Fastmail and he (and Brad Shoemaker) tend to be my kind of “Yes, I am making my life harder but for a reason maybe”.
not email but are there any good alternatives for cloud storage? i backup some of my passwords and pictures to my proton drive manually
Its not cheap to start with, but the best thing you can do is just go buy a 2 or 4 bay synology (I hear ugreen is also good. Fuck qnap) and set up a local home NAS. The vast majority of people will never need more than that and you can back up all your photos and documents in a form factor you can grab when evacuating a burning building.
For essential stuff where you do want/need an off site backup? All of these cloud services are backed up by Amazon et al storage. Do a bit of research (there are plenty of pre-rolled solutions but people get pissy and annoying) and figure out how to encrypt the important docs and push them to cheap storage. Not free but you are literally paying pennies on the dollar compared to any other paid back-up service and… if the storage is free then you are the product.
Or, if you really don’t care: Learn to encrypt your sensitive important data and put it in a google drive.
would hndl be a concern?
That is up to you how much you care and what encryption schemes you use (which I intentionally will not make a recommendation on). Best practices is to maintain your own off site backups but… good luck.
That said? If we reach the point that the “good” encryptions are trivially decryptable then the entire modern world is already collapsing as e’rybody goes after the banks and governments. Otherwise? That is going to cost significant compute resources. How important do you think you are that someone is going to track a random bucket to you and then focus on decrypting those tax documents?
Posteo?
Looks paid, I prefer to discard any possible solutions on my country’s currency before I even take a look at having to deal with international KYC shit.
so if nobody likes proton what do you guys do? i am getting tired of the email shuffle.
I feel like every email post is a “don’t use platform x” and there are very few (if any?) universally well received services out there. In which case the community will probably just give up and go back to Google.
We probably need a tier chart or something to add perspective. Proton have made dumb decisions recently but they’re still better than Google/Microsoft
I dont hope to find a secure email platform anymore. If i have some info i want to protect i can encrypt it myself before sending, or send it via some secure instant messaging like signal. Email is too hard to make secure, and in he end of the day, the other person youre talking to probably has a gmail or something. Its not worth the hassle imo. There are other ways to have secure communication, outside emails.
it’s good to keep secure communications separate anyways, so you don’t accidentally send the secret message to the wrong place or without the security measures.
i don’t get why people want it in the same place as their fucking gaming chats, imagine sending state secrets to #fursuit-showoff because you didn’t notice which specific channel you’re in
This is a great point. We spend so much time naval gazing on the best platform for our side, but what about the other side? Might as well use any old service and encrypt your private comms specifically. Yes it’s effort to encrypt but I think it’s the best compromise of privacy without housing your own mailserver
I’ve been using Posteo for years and don’t have any complaints.
How is the initial storage limit?
I’m not sure what the options all are, but it looks like I have 2 gigs at $1 per month.
I self host my mail. There are plenty of people telling you not to do so, but I sincerely have made very good experience with it the last 10 years. The absolute minimum you should do is to have your own domain, otherwise you are in a vendor lockin.
Then, use PGP where possible with an open source mail client such as thunderbird.
I use GPG in Thunderbird with ForwardEmail (because I use a custom domain)
I don’t really care
deleted by creator
Valid answer!
What question do you think you asked?
There never was a question
Kind of the point I was making…
Can answers only be given for questions, or can they also mean ”reaction"?
Sure. It’ll still never earn respect.
Yes.
ok and? No other service offers as complete a package as Proton
This is the argument people use when discussing Microsoft products
Is M$ stuff provably e2ee? Is Proton a publicly traded company? Does M$ have even close as good a track record as Proton? Are most M$ clients OSS?
Edit: Proton isn’t perfect, not by a long stretch. I’m not stanning them either way, but being alarmist and giving in to mob mentality is counterproductive.
For me they just offer the right balance of being partially OSS, strong privacy and strong security that I can pragmatically “overlook” things even as a leftist and free/libre “hardliner” (as I already mentioned: the pragmatic kind. I don’t see a point in using Linux-Libre and am ok with proprietary blobs or “tainted” packages for codecs necessary for piracy if there is no alternative and if they don’t cause active harm (as in “phoning home” or shit like that. Linux-libre is a detriment to your security BTW)
deleted by creator
I use it with the full knowledge that they will start to track me and share my IP with Europol if they come with a warrant. (They are unable to comply with anything further, thanks to their e2e architecture)
It is part of my threat model and I use it solely for private stuff.
I couldn’t care less that the CEO had one slipup praising a Republican with a seemingly good track record (although I did not investigate that matter)
And being a Luddite about AI is really counterproductive, it has arrived in our society and if correctly utilised will be just another tool used to automate or autocomplete etc.
Basically what your IDE already does but on steroids
(Disclaimer: it’s Friday and I’m tired so there is a real – if small – chance I’m being a contrarian armed with superficial knowledge. I can’t rly tell myself 🙃)
deleted by creator
I totally agree, but think that the toot you shared is a bit alarmist
Its like complaining an accountant uses a calculator
A calculator produces reproducible results and does not introduce security flaws into your code that you don’t care to look for
Then do care to look for? There are PRs, there is a dev that approves changes. It’s stupid to resist agentic AIs when they boost productivity by a lot.
Citation that isn’t anecdotes please, only actual study I’ve seen into this was a ~19% drop and even that was flimsy.
19% drop in what?
Uh, idk how they got that number. It goes against the observations of literally everyone in the industry, so maybe it’s not the industry that is biased, but the benchmark they did is incorrect?
Like just several sprints before I’ve saved my team by generating proto contracts taking backend repo as a context, as backend was busy with other higher important things to unblock us. No AI here means we would be blocked full stop for the entire sprint. And when backend did generate the contract, it was almost identical, and the diff in contracts allowed to identify the issue in the entities they send.
True, some tasks can be done faster without AI, because you have the context and the amount of code volume is actually fairly low.
But
while the “high developer familiarity with [the] repositories” aided their very human coding efficiency in these tasks.
My brother in Christ, in big enterprise project chances that you have some familiarity with the code, well, they are non-zero, but also not that high.
Uh, idk how they got that number. It goes against the observations of literally everyone in the industry,
Scientific study vs anecdotal data, that’s what studies are supposed to be, the formalisation and distillation of data into conclusions based on said data.
so maybe it’s not the industry that is biased, but the benchmark they did is incorrect?
Possibly, do you know how that’s normally tested ?
Like just several sprints before I’ve saved my team by generating proto contracts taking backend repo as a context, as backend was busy with other higher important things to unblock us. No AI here means we would be blocked full stop for the entire sprint. And when backend did generate the contract, it was almost identical, and the diff in contracts allowed to identify the issue in the entities they send.
Anecdote, from a single person.
I don’t doubt that that is your experience, but it’s just that, your experience.
and before you bring out the “but everyone i know all says the same”, that’s still anecdotal, it’s what anecdotal means.
My brother in Christ, in big enterprise project chances that you have some familiarity with the code, well, they are non-zero, but also not that high.
I mean, sure ? i’m not sure how that is relevant though.
As i said, the one study i’ve seen is somewhat flimsy…
Do you have literally any other study to backup any claims to the contrary?
My original comment was in response to :
It’s stupid to resist agentic AIs when they boost productivity by a lot.
That might be true, but for it to be applicable the productivity boost needs to be real, and for public claims to be taken seriously, provably real.
That you, personally, think you are seeing this is great, works for you.
I’m definitely vibe coding all my stuff, why wouldn’t I? I’m still responsible for what I commit to main but it’s so much faster to get shit done like this
If you don’t break the project style, other code, and you actually test and review what you write, then yea
Yeah that’s the idea. seems like many people are thinking that either you don’t do code reviews at all or you’re writing every line of code yourself even if AI could have done a lot of grunt work.
deleted by creator
why do you think he is an asshole?
deleted by creator
