upvote
deleted
reply
deleted
reply
That's the chain, yes. The part people don't expect: the file is created inside the project, and Claude Code only adds it to your global git ignore, not the repo's .gitignore. So a fresh clone or a second machine commits it like any other file. In 539 of the 1,105 repos we traced, a commit co-authored by Claude itself changed the file.
reply
> the file is created inside the project, and Claude Code only adds it to your global git ignore, not the repo's .gitignore. So a fresh clone or a second machine commits it like any other file

A fresh clone wouldn’t have the file. This claim doesn't make any sense.

The only way I can see this getting committed is if someone edited their global .gitignore or, more likely, did a whole directory transfer to do a different machine to work on.

reply
Fair, “fresh clone” was wrong. It happens on a new machine or container without the global ignore, in a copied project folder, or once the file has been committed, since ignore rules don’t apply to tracked files.
reply
Why are you copying instead of git clone?
reply
The new wave of git users (coming from AI) don't know what git is.
reply
I wonder how many of this type are 'senior/principle software engineers' employed by our AI vendor overlords. This situation is the inevitable result of vocal VCs (ahem) poo pooing "age" and "experience" and promoting youth as a 'requirement' starting in the '00s, coupled with these same VCs now attempting to hijack an entire industry to run on their obviously immature and buggy and frankly possibly dangerous products.

The silver lining in all this is all of us very experienced "ancient" software practitioners will likely be in demand again. In a sane world, of course.

reply
In that case what relevance does the gitignore file have at all?
reply
That doesn’t make sense. I use my own global git ignore all the time because there are files that only I produce that I definitely don’t want committed (flycheck looking at you). A fresh clone wouldn’t contain these files because they are not committed in the first place. You will have to use a non-git transport mechanism to transfer the repo without also transferring your global git ignore.

Anyways this probably indicates that these repos don’t have a good code review process. The settings.local.json file name screams it’s local and shouldn’t be committed.

reply
They're probably mostly just random solo people who barely even know what git is. This---that people who don't know how to code can code now--is the whole thing that AI companies love to advertise, and it's true. But it also means that tools need to stop people from doing stupid things, because they won't know that the things they are doing are stupid.
reply
It's a disgrace that the parent comment was flagged. My vouching has undone that but it's likely to be flagged again.
reply
It's fully AI generated. Please don't vouch for comments that don't have human input, it's against the rules:

> Don't post generated text or AI-edited text. HN is for conversation between humans.

Also, it's wrong. Many people have since replied pointing out the basic error it made

reply
The author of this comment is also the one who submitted and authored the article being discussed.

No matter whether it's AI generated (I can't tell) or correct (it's not), it makes no sense to flag the response by the author.

reply
> It's fully AI generated

How have you determined that?

Furthermore, I have also noticed the error. I can still see it happening. Sandboxed agent, no access to global git ignore. Creates a new one after putting the secret in `.claude`. Same developer, same machine, fresh sandbox. No access to the original sandbox's global gitignore. Secret already on the project. Commit and push. Secret leaked.

reply
All of their comments were auto flagged from the moment they were posted. Must have triggered an LLM detector or spam detector.
reply
It's AI slop. If what it says is actually true, hopefully a human will post it.
reply
[flagged]
reply