Transcript
A post by [object Object] (@zzt@mas.to) saying:
courtesy of @davidgerard@circumstances.run, Proton is now the only privacy vendor I know of that vibe codes its apps:
In the single most damning thing I can say about Proton in 2025, the Proton GitHub repository has a “cursorrules” file. They’re vibe-coding their public systems. Much secure!
I am once again begging anyone who will listen to get off of Proton as soon as reasonably possible, and to avoid their new (terrible) apps in any case. https://circumstances.run/@davidgerard/114961415946154957
It has a reply by the author saying: in an unsurprising update for those familiar with how Proton operates, they silently rewrote their monorepo’s history to purge .cursor and hide that they were vibe coding: https://github.com/ProtonMail/WebClients/tree/2a5e2ad4db0c84f39050bf2353c944a96d38e07f
given the utter lack of communication from Proton on this, I can only guess they’ve extracted .cursor into an external repository and continue to use it out of sight of the public
I don't think the concern is as much with the purity of their vibe coding, but rather that they're using an AI-first editor. This will almost certainly mean everything they're coding is being shared with AI provider(s) during the process, which some would view as at odds with Proton's stated emphasis on privacy.
Is the privacy of their code that much of an issue in this case given its a public repo? Its going to get scraped by the bots regardless.
The committed code in the repo will get scraped anyway, but the data used in testing is a different story. Not that anyone's ever tested with prod data.
I don't think the issue is a practical one though. It's more the company that stands on promises of privacy using tools that are overtly share-happy that seems to be a ideological discrepancy.
But in case my initial comment's "I don' think..." wasn't clear enough, this was my attempt at understanding why this might be a concern (or at least of interest) to folks in this community, not a personal statement of condemnation or anything. I personally could not give less of a shit what code editor they use.
Are we really shitting on companies because they have a config file for the wrong editor? Sorry, a config file for the wrong editor (excluding emacs because be as prejudiced as possible against those folk)?
Do I like "AI First" editors? Hell no. But VSCode is rapidly making that pivot and I don't know the lineage of Cursor well enough to know if it also used to be "just any other editor". And, from a quick google, it supports local LLMs (e.g. ollama), so the "Big AI is going to have all your code" problem is mitigated...
Also, the repo is on Github. Big AI (Microsoft) already HAS all their code. And before we have "Well you should selfhost a gitea!": If your website is public facing, it has been scraped by "AI". And if your open source project is hidden behind ten paywalls? I am not gonna finish that joke because people get really pedantic and pissy when you try to define "Open Source".
At the end of the day: At a project level? If active code review by qualified developers is going on, I really don't care how the code was written. I DO care about those individual developers and their abilities as they continue to use "AI" based tools but... that is a different discussion.
I WOULD be interested in a link to the actual offending file. I've been part of enough projects where it was easier to just have dotfiles for every major editor because you have a wide range of contributors and no true scotsman doesn't have one of the local vimrc style plugins running. Whereas if it is massive instructions on how to generate code, I would get a lot more worried.
But an unsourced screenshot of a discussion thread ain't it.
I wasn't shitting on anybody. You're ranting is misdirected.
But isn’t this a public repo?
Privacy for a codebase is not the same as privacy for me. Security through obscurity would be more at odds with privacy for the end user.