The list is (in my opinion) just human written slop.

The requirements for some software to make it in the list are so lax, that the list loses its meaning. It really isn’t a list of “slop” but just list of software which is somehow connected to AI. In my opinion it’s similar to the anti systemd hate. People think they understand some software better than the maintainer who wrote it.

Examples of bs criteria:

  • Having AI features - This one is a conundrum to me. Why do you need a list for it? If you are using the app, you know if it has AI features or not and if you have not noticed, why are you bothered?
  • Having agents.md in the repository - This one does not mean anything on it self. Could just be there for others to use, not necessary for the maintainers. It’s Open Source, remember? Someone else might read it and might want to use different tools than you.
  • KeepassXC - This one is bizzare. They link KeepassXC’s blog post, which explains why KeepassXC is very much not “slop”. Every tiny change has to be reviewed by a maintainer regardless if it was human or AI written. Because they allow LLM usage, they also encourage people to disclose their usage. This is what I think should secure codebases aim for.

Ironically I will link to the list: https://codeberg.org/small-hack/open-slopware

Also the KeepassXC blog post: https://keepassxc.org/blog/2025-11-09-about-keepassxcs-code-quality-control/

Yes, I am aware that I have no authority over which links you can post and which ones not but hopefully this post will convince you.

Perhaps someone will create a better list of actual slop? I think the idea of it is pretty good, this particular list is crap though.

  • smeg@infosec.pub
    link
    fedilink
    English
    arrow-up
    60
    arrow-down
    6
    ·
    1 day ago

    Counterpoint: I think it’s reasonable to inform people of what a dev team allows into their project, or how they’re directing the development of the product.

    For some people, it will be a hard no. Others maybe don’t mind AI interoperability if it’s not in the codebase itself. Others won’t mind if the app is critical to their workflow, but may reject apps that are less critical. Others don’t care at all.

    I look at it like the Denuvo labeling curator on Steam. Nothing wrong in informing people.