Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

About KeePassXC's Code Quality Control

keepassxc.org

Post reply on HN
Print view View original

11–20 of 49 posts

Re: About KeePassXC's Code Quality Control

#11

Post by KronisLV »

jpeterson wrote: post #4

Code submissions either meet the standards of the project or they don't. Whether it was generated by human or AI is irrelevant.

> Whether it was generated by human or AI is irrelevant.

No, some projects take fundamental issues with AI, be it ethical, copyright related, or raising doubts over whether people even understand the code they're submitting and whether it'll be maintainable long term or even work.

There was some drama around that with GZDoom: https://arstechnica.com/gaming/2025/10/civil-war-gzdoom-fan-... (although that was a particular messy case where the code broke things because the dev couldn't even test it and also straight up merged it; so probably governance problems in the project as well)

But the bottom line is that some projects will disallow AI on a principled basis and they don't care just about the quality of the code, rather that it was written by an actual person. Whether it's possible to just not care about that and sneak stuff in regardless (e.g. using autocomplete and so on, maybe vibe coding a prototype and then making it your own to some degree), or whether it's possible to use it as any other tool in development, that's another story.

Edit: to clarify my personal stance, I'm largely in the "code is code" camp - either it meets some standard, or it doesn't. It's a bit like with art - whether you prefer something with soul or mindless slop, unfortunately for some the reckoning is that the purse holders often really do not care.

Re: About KeePassXC's Code Quality Control

#12

Post by arghwhat »

KronisLV wrote: post #11
jpeterson wrote: post #4

Code submissions either meet the standards of the project or they don't. Whether it was generated by human or AI is irrelevant.

> Whether it was generated by human or AI is irrelevant. No, some projects take fundamental issues with AI, be it ethical, copyright related, or raising doubts over whether people even understand the code they're submitting and whether it'll be maintainable long term or even work. There was some drama around that with GZDoom: https://arstechnica.com/gaming/2025/10/civil-war-gzdoom-fan-... (although that was a particu…

> No, some projects take fundamental issues with AI, be it ethical, copyright related, or raising doubts over whether people even understand the code they're submitting and whether it'll be maintainable long term or even work.

These issues are no different for normal submissions.

You are responsible for taking ownership and having sorted out copyright. You may accidentally through prior knowledge write something identical to pre-existing code with pre-existing copyright. Or steal it straight off StackOverflow. Same for an LLM - at least Github Copilot has a feature to detect literal duplicates.

You are responsible for ensuring the code you submit makes sense and is maintainable, and the reviewer will question this. Many submit hand-written, unmaintainable garbage. This is not an LLM specific issue.

Ethics is another thing, but I don't agree with any proposed issues. Learning from the works of others is an extremely human thing, and I don't see a problem being created by the fact that the experience was contained in an intermediate box.

The real problem is that there are a lot of extremely lazy individuals thinking that they are now developers because they can make ChatGPT/Claude write them a PR, and throw a tantrum over how it's discriminating against them to disallow the work on the basis that they don't understand it.

That is: The problem is people, as it always has been. Not LLMs.

Re: About KeePassXC's Code Quality Control

#13

Post by droidmonkey »

thunderfork wrote: post #6

My great concern with regards to AI use is that it's easy to say "this will not impact how attentive I am", but... that's an assertion that one can't prove. It is very difficult to notice a slow-growing deficiency in attentiveness. Now, is there hard evidence that AI use does lead to this in all cases? Not that I'm aware of. Just as there's no easy way to prove the difference between "I don't think this is impacting…

> From where does that confidence come?

From decades of experience, quite honestly.

Re: About KeePassXC's Code Quality Control

#14

Post by eviks »

> We take no shortcuts. At KeePassXC, we use AI for

Followed by shortcuts

> As such, they are a net benefit and make KeePassXC strictly safer.

They can also waste author's/reviewer's time chasing imaginary ends, taking time away from the "regular" review, or with some level of trust add some plausibly explained vulnerability. Nothing is strict here

I'm sure if you ask your favorite AI bot, he'll come up with a few more reasons why the statement is overconfidently wrong.

Re: About KeePassXC's Code Quality Control

#15

Post by eviks »

droidmonkey wrote: post #13
thunderfork wrote: post #6

My great concern with regards to AI use is that it's easy to say "this will not impact how attentive I am", but... that's an assertion that one can't prove. It is very difficult to notice a slow-growing deficiency in attentiveness. Now, is there hard evidence that AI use does lead to this in all cases? Not that I'm aware of. Just as there's no easy way to prove the difference between "I don't think this is impacting…

> From where does that confidence come? From decades of experience, quite honestly.

How can you have decades of experience in a technology less than a single decade old? Sounds like ones of those HR minimum requirement memes

Re: About KeePassXC's Code Quality Control

#16

Post by riedel »

jpeterson wrote: post #4

Code submissions either meet the standards of the project or they don't. Whether it was generated by human or AI is irrelevant.

I would agree, IMHO keepassXC should however actually lay out their review standards better to actually be able to review security relevant code. I am a happy keepassxc user on multiple devices. However, trying to use and extend it in various settings, I simply still do not understand their complete threat model, which makes it very difficult to understand the impact of many of extensions it provides: being it for quick unlocking or API connection to browsers that can be used for arbitrary clients.

Re: About KeePassXC's Code Quality Control

#17

Post by droidmonkey »

eviks wrote: post #15
droidmonkey wrote: post #13

Earlier quoted context omitted.

> From where does that confidence come? From decades of experience, quite honestly.

How can you have decades of experience in a technology less than a single decade old? Sounds like ones of those HR minimum requirement memes

Decades of programming and open source experience.

Re: About KeePassXC's Code Quality Control

#18

Post by blibble »

droidmonkey wrote: post #13
thunderfork wrote: post #6

My great concern with regards to AI use is that it's easy to say "this will not impact how attentive I am", but... that's an assertion that one can't prove. It is very difficult to notice a slow-growing deficiency in attentiveness. Now, is there hard evidence that AI use does lead to this in all cases? Not that I'm aware of. Just as there's no easy way to prove the difference between "I don't think this is impacting…

> From where does that confidence come? From decades of experience, quite honestly.

you have decades of experience of reviewing code produced at industrial scale to look plausible, but with zero underlying understanding, mental model or any reference to ground truth?

glad I don't work where you do!

it's actually even worse than that: the learning process to produce it doesn't care about correctness at all, not even slightly

the only thing that matters is producing plausible enough looking output to con the human into pressing "accept"

(can you see why people would be upset about feeding output generated by this process into a security critical piece of software?)

Re: About KeePassXC's Code Quality Control

#19

Post by thunderfork »

droidmonkey wrote: post #13
thunderfork wrote: post #6

My great concern with regards to AI use is that it's easy to say "this will not impact how attentive I am", but... that's an assertion that one can't prove. It is very difficult to notice a slow-growing deficiency in attentiveness. Now, is there hard evidence that AI use does lead to this in all cases? Not that I'm aware of. Just as there's no easy way to prove the difference between "I don't think this is impacting…

> From where does that confidence come? From decades of experience, quite honestly.

[dead]
Post reply on HN