cross-posted from: https://lemmy.dbzer0.com/post/50693956

TranscriptA post by [object Object] (@zzt@mas.to) saying: courtesy of @davidgerard@circumstances.run, Proton is now the only privacy vendor I know of that vibe codes its apps: In the single most damning thing I can say about Proton in 2025, the Proton GitHub repository has a “cursorrules” file. They’re vibe-coding their public systems. Much secure! I am once again begging anyone who will listen to get off of Proton as soon as reasonably possible, and to avoid their new (terrible) apps in any case. https://circumstances.run/@davidgerard/114961415946154957

It has a reply by the author saying: in an unsurprising update for those familiar with how Proton operates, they silently rewrote their monorepo’s history to purge .cursor and hide that they were vibe coding: https://github.com/ProtonMail/WebClients/tree/2a5e2ad4db0c84f39050bf2353c944a96d38e07f

given the utter lack of communication from Proton on this, I can only guess they’ve extracted .cursor into an external repository and continue to use it out of sight of the public

There is alt-text in the post's body. It was too long to put here.

all 11 comments

sorted by: hot top controversial new old
[–] 18 points 1 year ago (2 children)

I dislike using AI when im writing my own code, simply because I do not believe AI is fair use or leads to anything positive for the creators of the works its trained on. I do use it to debug some stuff or get some hints but always double check whether the solution is good afterwards. With that said, if the cursorfile is just a settings file it only proves that someone has used AI in their IDE, the code itself does not necessarily have to be generated by an AI. And even if it were it could still be fine, it all comes down to the developers and the review process. The code is not inherently flawed because an AI wrote it. As long as humans are there to point out, find and prevent issues/security flaws its fine to use.

Here comes the problem though. The term "vibe coding" mainly refers to people with little to no skill as developers, mainly relying on AI to do the heavy lifting. That is very problematic. Thats when security flaws, issues and tech debt start to rack up. I havent looked at the code or researched repo history, but i would believe these devs are better than "vibe coders"

  • source
  • hideshow 2 child comments
  • [–] 3 points 1 year ago

    Based on my experience with prompts and seeing what they produce when attempting significant function... I'm kind of shocked anyone makes to produce a working project at all.

    I still haven't quite gotten over getting annoyed at bad suggestions even though I can just ignore them when they are bad.

  • source
  • parent
  • [–] 5 points 1 year ago

    Tbh I would not be at all surprised if they were vibe coding. The snafu with the new authenticator app logging secrets, them just churning out random new apps no one asked for instead of meaningfully improving their existing products, claiming to open-source all their apps despite the Android calendar app still (after years) not being open-sourced (and with a GitHub link on their web page that implies all their code is available, but it in fact just links to the web clients), etc. have all combined to the point where I simply no longer trust them.

  • source
  • parent
  • [–] 8 points 1 year ago (6 children)
  • [–] 11 points 1 year ago (4 children)

    Cursor is a version of a popular coding program that integrates Ai into the editor. A .cursor is a text file that you put into your code folder that gives extra context and information to the Cursor code editor.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 10 points 1 year ago (3 children)

    Does anything here imply that the entire application was "vibe coded"? Or is it possible that a developer just used AI a few times to help with a line or two?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 16 points 1 year ago (1 child)

    No. There’s no indication that any AI code was or was not added to their repository, nor is there any indication that any “vibe coding” was done. It could be that some junior developer installed Cursor on their machine and was playing with it and committed the .cursor file which was subsequently removed. More likely, they’re experimenting with introducing some AI into their development workflow as almost every company seems to be doing these days. Not great, but not nearly as alarming or damning as this post suggests.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 8 points 1 year ago

    No, it's entirely possible they used cursor without any AI at all (that's unlikely, AI is kind of cursor's big thing), used it in a few places, as a slightly better autocomplete, or to "vibe code the whole thing". There are probably good reasons to avoid proton, but a text file in their repo related to a specific text editor isn't very significant.

  • source
  • parent
  • [–] 17 points 1 year ago

    So a Cursor config file made it into the repo and was later removed and they just declare that this must be a case of trying to obfuscate their vibe coding policy? "They must have moved it to a private repo!" That seems like a logical jump made out of personal bias.

    A far more likely case, (and one I've seen in dozens of projects myself) is that someone was using Cursor locally and committed the file by mistake. Then when they realised this, they removed it.

    People (especially juniors) commit their .idea or .vscode files all the time. Normally, I catch this at review time, but sometimes it slips by. It's still not great that anyone was using Cursor in the first place, but this alone is hardly evidence of policy or conspiracy.

  • source
  • 15 comments in c/privacy@programming.dev view that post
    [–] 13 points 1 year ago (2 children)

    Visual Studio and VS Code have an AI assistant as well, yet we don’t decree all programs written with them as ‘vibe coding’. The presence of an AI assistant in the IDE isn’t evidence of vibe coding.

    Proton’s repo here is open source. What portion of it presents issues? Any?

  • source
  • hideshow 2 child comments
  • [–] 13 points 1 year ago*

    I think the difference here is cursor is a fork of VS code that is specifically dedicated to AI based workflows. Which means it's highly likely, although not guaranteed, that AI is being used as opposed to the other options you mentioned which are very popular IDEs where AI is a secondary feature that might not even be enabled. That being said I don't think there's anything wrong with using AI with oversight, what I do see as a problem is the fact that in the face of criticism they went and hid the evidence. That's terrifying for a privacy focused organization to do.

  • source
  • parent
  • [+] 4 points 1 year ago (7 children)
  • [–] 5 points 1 year ago (6 children)

    Either because you posted to ml and they're doing their boycott ml thing, or that we're consolidating on this comm now: https://feddit.uk/post/32996358.

  • source
  • parent
  • hideshow 6 child comments
  • [+] 3 points 1 year ago (5 children)
  • [–] 5 points 1 year ago (4 children)

    God knows at this point, both seem active enough with users apparently refusing to use either.

  • source
  • parent
  • hideshow 4 child comments
  • [+] 3 points 1 year ago (3 children)
  • [–] 1 point 1 year ago (2 children)

    The programming.dev has more active posters, but you do you

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago

    anyone knows any alternative email?

  • source
  • [+] -12 points 1 year ago (2 children)

    Proton users deserve what's coming for them

  • source
  • hideshow 2 child comments