Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

About KeePassXC's Code Quality Control

keepassxc.org

Post reply on HN
Print view View original

21–30 of 49 posts

Re: About KeePassXC's Code Quality Control

#21

Post by PaulKeeble »

I am now on the hunt for a non vibe coded alternative. I stopped open sourcing code after all my open code's licenses were broken by Microsoft and everyone else commercialising it. Which I guess is part of the point of why they did it and have put serious money to defending themselves in court against anyone that dare challenge it. Suffice to say I don't want anything to do with projects that participated in that theft and re-commercialisation of open source code.

Does not look like the original Keepass project is doing this which is the easiest migration away but I will check a bit deeper on their commits to be sure.

Re: About KeePassXC's Code Quality Control

#22

Post by Lariscus »

I didn't know about that and this is really concerning to me. AI has no place in security critical software like KeePassXC, and I remain unconvinced that they will only use it for simple tasks. I don't feel like I can trust this software any longer this is a password manager not just some random website where bugs basically don't matter. I hate that I have to replace yet another piece of software that I liked.

Re: About KeePassXC's Code Quality Control

#23

Post by phoerious »

eviks wrote: post #14

> We take no shortcuts. At KeePassXC, we use AI for Followed by shortcuts > As such, they are a net benefit and make KeePassXC strictly safer. They can also waste author's/reviewer's time chasing imaginary ends, taking time away from the "regular" review, or with some level of trust add some plausibly explained vulnerability. Nothing is strict here I'm sure if you ask your favorite AI bot, he'll come up with a few mo…

If we're wasting anyone's time, it's our own. Your comment reads like the AI would make up hundreds of invalid complaints, which is simply not true. You can see for yourself in our GitHub repository if you care.

Re: About KeePassXC's Code Quality Control

#24

Post by phoerious »

blibble wrote: post #18
droidmonkey wrote: post #13

Earlier quoted context omitted.

> From where does that confidence come? From decades of experience, quite honestly.

you have decades of experience of reviewing code produced at industrial scale to look plausible, but with zero underlying understanding, mental model or any reference to ground truth? glad I don't work where you do! it's actually even worse than that: the learning process to produce it doesn't care about correctness at all, not even slightly the only thing that matters is producing plausible enough looking output to…

The statement that correctness plays no role in the training process is objectively false. It's untrue for text LLMs, even more so for code LLMs. Correct would be that the training process and the architecture of LLMs cannot guarantee correctness.

Re: About KeePassXC's Code Quality Control

#25

Post by blibble »

phoerious wrote: post #24
blibble wrote: post #18

Earlier quoted context omitted.

you have decades of experience of reviewing code produced at industrial scale to look plausible, but with zero underlying understanding, mental model or any reference to ground truth? glad I don't work where you do! it's actually even worse than that: the learning process to produce it doesn't care about correctness at all, not even slightly the only thing that matters is producing plausible enough looking output to…

The statement that correctness plays no role in the training process is objectively false. It's untrue for text LLMs, even more so for code LLMs. Correct would be that the training process and the architecture of LLMs cannot guarantee correctness.

> The statement that correctness plays no role in the training process is objectively false.

this statement is objectively false.

Re: About KeePassXC's Code Quality Control

#26

Post by phoerious »

blibble wrote: post #25
phoerious wrote: post #24

Earlier quoted context omitted.

The statement that correctness plays no role in the training process is objectively false. It's untrue for text LLMs, even more so for code LLMs. Correct would be that the training process and the architecture of LLMs cannot guarantee correctness.

> The statement that correctness plays no role in the training process is objectively false. this statement is objectively false.

I'm just an AI researcher, what do I know?

Re: About KeePassXC's Code Quality Control

#27

Post by blibble »

phoerious wrote: post #26
blibble wrote: post #25

Earlier quoted context omitted.

> The statement that correctness plays no role in the training process is objectively false. this statement is objectively false.

I'm just an AI researcher, what do I know?

> I'm just an AI researcher, what do I know?

me too! what do I know?

(at least now we know where the push for this dreadful policy is coming from)

Re: About KeePassXC's Code Quality Control

#28

Post by s_ting765 »

jpeterson wrote: post #4

Code submissions either meet the standards of the project or they don't. Whether it was generated by human or AI is irrelevant.

People get confused talking about AI. For some reason they skip the fact that a human prompted the LLM for the generated output. One could almost think AI is an agent all on its own.

Re: About KeePassXC's Code Quality Control

#29

Post by phoerious »

blibble wrote: post #27
phoerious wrote: post #26

Earlier quoted context omitted.

I'm just an AI researcher, what do I know?

> I'm just an AI researcher, what do I know? me too! what do I know? (at least now we know where the push for this dreadful policy is coming from)

The whole purpose RLVR alignment is to ensure objectively correct outputs.
Post reply on HN