I want this but as a Linux distribution.

@mcc @itamarst I thought KeePassXC required human reviews / unit tests in order to mitigate any llm harms. Did that change?

More broadly, I don't really see how you can prove no LLMs were involved in code contributions if they are actually contributed by a human. Prove you used emacs or vi and didn't compile it ever on a cloud service? (I'm not happy about that state of affairs, mind you)

I suppose we can start adding some sort of watermark on code?

@mcc Aw man that sucks. Why would they... Ugh.

@luana@wetdry.world @mcc@mastodon.social @ariadne@social.treehouse.systems wouldn't you have to have a database of packages that don't contain LLM-written code? i don't think it's readily available

@elfin @mcc

If you're looking for an alternative to KeePassXC, GNOME Secrets is pretty much a drop-in replacement.

@johnlehet @mcc My educated guess is the problems are more likely to be things like

- sync protocol has a security flaw that makes it possible for malware in coffee shop wifi router to learn all your passwords

- sync protocol just plain stops working

- restoration of offline backups stops working, nobody notices for months

@jcnotwit @mcc I'm using the original KeePass on Linux, even though Mono seems not handle high density displays properly, no way I'll touch XC now it's using LLM coding.

@argv_minus_one @elfin that's great, but can it interop with a phone?

@draNgNon @itamarst

"I thought KeePassXC required human reviews / unit tests in order to mitigate any llm harms. Did that change?"

I literally don't give a shit. If you think it's OK to generate computer source code from a neural network, I don't trust yr judgement enough to trust your code reviews.

"More broadly, I don't really see how you can prove no LLMs were involved in code contributions if they are actually contributed by a human."

Same way you enforce any policy against stolen code

@mcc @luana @xarvos that is indeed the problem

@mcc @elfin

Can you be more specific? I wasn't under the impression that KeePassXC runs on phones.

@csolisr i'm told elsewhere in thread that vaultwarden has not accepted AI code, but vaultwarden replaces the *server*, not the client, right?

@argv_minus_one @elfin I do not use keepassxc

EDIT: checking google there *is* a "Keepass2Android", one assumes forked from the original keepass

@ariadne @mcc @xarvos that would be the pretty way. Another pretty way would be having nixpkgs maintainers add that info.

I said it was an awful way that would require full system building for a reason, I imagine it’s possible to override the default check phase or even the fetchers to check the downloaded src for .copilot and alike and fail if present.

@maaneeack @mcc StrongBox has been sold to a company with maybe iffy success with the products they have acquired. I had first hand experience with their mess-up of the Mac utility Bartender, which I bailed on after their version.

@WideEyedCurious
If you're ok with local storage and local replication rather than "cloudy", there's pwsafe. You could keep the db in some less local storage, I guess.
https://www.pwsafe.org/index.shtml

@mcc @argv_minus_one @elfin I use https://www.keepassdx.com/ on android, and sync the file over with Syncthing.

I don't THINK either of those projects use LLMs, but I haven't been machmir about poring over careful details when checking.

@greyduck @mcc From all that I have seen regarding The Original KeePass (authored by Dominik Reichl in C# for .NET/Mono) has made no mention of AI pollution. How Mono are handling AI I haven't looked at, but for .NET: Microsoft is as they are.

KeePassXC (maintained by the KeePassXC team in C++ using the QT toolkit) announced the use of AI and then clarified the scope later. KeePassXC is a separate project that uses the keepass vault format but it its own thing.

@mcc yikes

@chopsstephens @jcnotwit @mcc But there are forks of the pre-vibecoded XC now, no need to switch to a whole other program.