this post was submitted on 08 Aug 2025
403 points (85.2% liked)

Privacy

3546 readers
82 users here now

Welcome! This is a community for all those who are interested in protecting their privacy.

Rules

PS: Don't be a smartass and try to game the system, we'll know if you're breaking the rules when we see it!

  1. Be civil and no prejudice
  2. Don't promote big-tech software
  3. No apathy and defeatism for privacy (i.e. "They already have my data, why bother?")
  4. No reposting of news that was already posted
  5. No crypto, blockchain, NFTs
  6. No Xitter links (if absolutely necessary, use xcancel)

Related communities:

Some of these are only vaguely related, but great communities.

founded 9 months ago
MODERATORS
fxomt@lemmy.dbzer0.com
otter@lemmy.ca
shaytan@lemmy.dbzer0.com
fxomt@piefed.social
403
Proton is vibe coding some of its apps. (infosec.pub)
submitted 1 week ago* (last edited 1 week ago) by irelephant@lemmy.dbzer0.com to c/privacy@lemmy.dbzer0.com
183 comments fedilink hide all child comments
 

TranscriptA post by [object Object] (@zzt@mas.to) saying: courtesy of @davidgerard@circumstances.run, Proton is now the only privacy vendor I know of that vibe codes its apps: In the single most damning thing I can say about Proton in 2025, the Proton GitHub repository has a “cursorrules” file. They’re vibe-coding their public systems. Much secure! I am once again begging anyone who will listen to get off of Proton as soon as reasonably possible, and to avoid their new (terrible) apps in any case. https://circumstances.run/@davidgerard/114961415946154957

It has a reply by the author saying: in an unsurprising update for those familiar with how Proton operates, they silently rewrote their monorepo’s history to purge .cursor and hide that they were vibe coding: https://github.com/ProtonMail/WebClients/tree/2a5e2ad4db0c84f39050bf2353c944a96d38e07f

given the utter lack of communication from Proton on this, I can only guess they’ve extracted .cursor into an external repository and continue to use it out of sight of the public

you are viewing a single comment's thread
view the rest of the comments
[–] oatscoop@midwest.social 34 points 1 week ago* (last edited 1 week ago) (1 children)

can review it yourself.

You're a supervisor and you have 2 employees: Bill and Jim. As a supervisor your job is to ensure the work is being done correctly.

Bill is competent and rarely makes major mistakes. Jim does a decent job most of the time ... but he's also a savant at screwing up -- he regularly fucks up in ways that aren't immediately obvious but are guaranteed to cause serious problems days to weeks from the screw up.

You can glance over Bill's work and be fairly certain it's fine. You need to go over every single piece Jim's work to check for problems, and even then some are probably going to slip through.

AI is currently Jim, and Jim has no business writing code for anything privacy or security focused.

[–] grindemup@lemmy.world -3 points 1 week ago (1 children)

This is a great example since AI isn't taking on the role of an independent software engineer here, so there is no "Jim" and this is much less of an issue than y'all are making it out to be. You know that auto-correct is also a form of ML right? Have you considered that tools can be used responsibly and that standards for software developers still apply even when they use new tools?

[–] petrol_sniff_king@lemmy.blahaj.zone 5 points 1 week ago (1 children)

You know that auto-correct is also a form of ML right?

Yeah, and I don't fuckin use it.

Also, my auto-correct is saying that sentence is missing a comma, so I guess you don't either.

[–] grindemup@lemmy.world 1 points 1 week ago (1 children)

Cool that's great. Can you tell me that none of the software you use has been developed by software engineers making use of machine learning methods?

[–] petrol_sniff_king@lemmy.blahaj.zone 1 points 6 days ago (1 children)

I can: I do not use any software.