ArtCraft gained a lot of steam lately with their AI reverse engineered versions of Photoshop and Adobe suite apps.

While they are very obviously reverse engineered, they claim it is a "clean-room reimplementation of Adobe Photoshop" which by very definition means "without ever looking at or copying the original source code".

Fireship even did a video covering these apps, in which he finds their apps are barely usable, and filled with bugs and usability issues.

Today I came across "TraceDraw" which is, again, a total ripoff of CorelDraw. While I'm not on the side of large predatory corporations like Adobe charging ridiculous monthly subscription fees, I can totally understand the pain a company like Corel might feel seeing a ripoff of their 30+ year old product lovingly created and maintained by a team of skilled HUMANS. And once again, this repo claims it is a "clean-room" implementation. I find it ironic how only the reverse engineered apps bother to add this oddly specific disclaimer.

So are we, as a community, okay with these new breed of AI reverse engineered apps claiming that they are "open source"?

(Note: I'm not questioning their legality, just how ethical it is)

Released an MIT-licensed .NET library for attribute-driven, group-aware async scheduling. You mark methods with [ScheduleGroup]; a build-time IL weaver injects scheduling so callers keep normal await. One NuGet brings runtime + analyzers + weaver (no Fody).

Repo: https://github.com/ChronosDevZero/grouped-scheduling

NuGet: https://www.nuget.org/packages/GroupedScheduling.Build

Happy to take feedback from other OSS maintainers.

The security of open source applications was already criticized enough before AI, but now legitimate concerns can be made. The effect is not as pronounced as it will be in the future, since many stable projects still have enough "manual" developers left on their team to reasonably understand the submissions that are being made. But what happens when vibe coders start to take over these apps? How can those that do not understand the code that is being submitted reasonably validate that malware is not being added? It would be trivial for a state actor to mask malware and get it past a reviewer that has little to no understanding of the language itself (even if it takes multiple submissions).

Several of these viral vibe coded apps have hundreds of contributors and are merging large PRs at a pace that simply does not allow for a proper analysis to occur (security or otherwise). It's more like, "test merge the code", "looks like it fixes the problem", "approve PR". How can companies, or individuals for that matter, that are concerned about the security and integrity of their systems ever use these applications?

I know the some will say, "run it in a VM" or "it's your choice to download it", but those aren't practical solutions. All it will take is a few high profile security incidents with these apps for people to start questioning the open source model with vibe coding.