The clone is perfect though, vibe coded or not: as it doesn’t work it’s obviously a 1:1 copy that’s just accurately mimicking the original…

Which are? I’m not joking, “GitHub broken” and “Google has issues” are not arguments against a better encryption default.

The submodule argument is transitional at best.

As for the pro side (note that this is my opinion, I’m not deeply involved in the discussion - and with not deeply I mean “not at all”):

The case the author aggressively ridiculed ("I don’t use GPG to trust, I trust the GitHub authentication!) is one that anyone would have if they’d want to stay safe from centralized systems.

Another is upstream availability: once an algorithm is identified as broken (no matter how small) usage drops rapidly - there’s a reason why no one uses md5 anymore although it “would be fine” for purely collision mitigation.

And then there the simple fact that the integrity hash is a security feature, not purely anti collision (as the author also describes). Just because they (nor I!) can’t see an attack vector at the moment doesn’t make this less of an issue.

In short: it’s the other way around: you’d need way stronger arguments than “there will be a transition pain” to knowingly compromise your security.

For me it’s the exact extreme opposite than your first point: The LLMs as death of copyright could be an actual food thing.

The issue im struggling with is the ecological and economic harm. It feels a bit as if the steam machine would’ve been invented but you’d throw in babies in addition to coal.

For the plus sides you’re right (as in: I agree so it must be ;) )b- with one minor exception: the vibe coding part is not bad in itself. I actually used vibe coding as a very hard exercise: develop something and find ways to estimate its quality and performance but you are not allowed to look into the code! It’s a fun brain teaser because it forces a pure outcome-perspective. The code itself is irrelevant for this, it’s the mental training that’s really interesting.

Oh except people who publish vibe coded stuff as a cool new project without disclaimer. Or as PRs. Or as … Well anything where do see itself is actually important.