By the way, if you go to https://github.com/claude and "block this user", every Github repo you visit containing code written by Claude will actually have a warning sigil

[bmartin427@techhub.social]

@mcc done, although in the process of blundering around looking for the block button I have apparently inadvertently opted into copilot ‍️

[mcc@mastodon.social]

@bmartin427 github is basically now a website-sized dark pattern to opt you into copilot without your knowledge

[mozziediver@mastodon.social]

@mcc Thanks!

[aho@mastodon.social]

@mcc those a good way to figure out bad code...

[micha@23.social]

@mardor @mcc wow didn't catch that. Thx!

[beemdvp@techhub.social]

@mcc oh great idea actually, it means we can do a double take on a project's reliability

[m@martinh.net]

@CoralineAda @mcc Thank you so much for this, Coraline - you may have just saved humanity!

Hmmm. Perhaps we could use the GH API to give us an early warning when a much loved codebase is compromised. Maybe starting with something like this:

curl -s -H "Authorization: Bearer $AUTH_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  "https://api.github.com/search/issues?q=is:pr+is:merged+author:claude&per_page=100&page=1" \
  | jq -r '.items[].repository_url | sub("https://api.github.com/repos/";"")' \
  | sort \
  | uniq -c

This gets us a very lazyweb list of recently infected repos, although there are only ten results returned, with no pagination. That's a bit less than the 2.3 million commits reported in the web UI

      1 biner88/chart_sparkline
      1 davidray/twitter-bootstrap-calendar
      1 laudspeaker/laudspeaker
      1 ripienaar/free-for-dev
      4 segmentio/action-destinations
      2 uptech/flutter_app_analytics
      (etc)

Also author:claude is of course but one vector for the hungry ghosts...

[stelar@mas.to]

@mcc amazing tip

[taffer@mastodon.gamedev.place]

@mcc Does anyone know if this is triggered by Clod opening a PR or Issue, or is it actual merged commits?

[mcc@mastodon.social]

@Taffer merged commits seems to be the only possibility that makes sense, but Microsoft is very mysterious?

[val@oc.todon.fr]

@Taffer @mcc It happens when people tell Claude Code to commit their changes and allow it to set --author or Co-Authored-By.
The @claude account itself doesn't seem to be doing anything.

[canine3625@mastodon.social]

@mcc made a mastodon account to tell you this fucking rules, thank you

[kstrlworks@techhub.social]

@mcc Consider the following as well:

https://github.com/cursoragent
https://github.com/gemini-code-assist

Copilot doesn't let you block it unfortunately.

[derekmceachern@infosec.exchange]

@mardor @micha @mcc thanks for this, I couldn't find it either

[norbertschuler@norden.social]

@mcc works pretty well. I have done an obvious test

[glyph@mastodon.social]

@mcc thank you for the suggestion, this has proven to be a real engine for interpersonal disappointment

[jkanev@fediscience.org]

@mcc Nice! Also, leave github and switch to #codeberg. (@Codeberg )

[nick@donotsta.re]

@mcc oh no

[emjonaitis@mathstodon.xyz]

@mcc interesting. I’m not sure about the sensitivity of this as a marker; when I go to a repository I use a lot, I don’t see this banner, but I do see a recently edited folder called .claude — am I misunderstanding when I assume that means some of the code has been written by this tool?

[mcc@mastodon.social]

@emjonaitis The marker appears whenever a git commit is created with the "co-authored-by" label. This is something claude can be configured to not create:

https://code.claude.com/docs/en/settings#:~:text=Claude%20Code%22%2C%20%22pr%22%3A%20%22%22%7D-,includecoauthoredby,-Deprecated%3A%20Use%20attribution

Moreover, one assumes that this only occurs when claude actually *performs the commit*. I would assume there are means of using claude where claude changes the code on disk and then the co-authored-by does not appear. Unfortunately, I don't know how to get an answer to that question without talking to a claude user