Have there been any notable incidents where mistrusting a curl | sh was the cause? I hear people say not to do it way more than I hear people talking about actual incidents it's caused.

Not as bad as giving it your root password which it asks on step 3. Not via sudo or run0, it asks you a password which it saves so it can then use sudo or run0. Uuuh no.

> I assume this project is all vibe-coded?

You know what happens when you assume, right?

https://github.com/duxlabs-dev/dux-shell?tab=contributing-ov...

Quoting in part from that:

> Using an LLM to help write code is fine. Submitting its output unread is not.

> * You are responsible for every line you submit. You have read it, tested it, and can explain it in review.

> * Say in the PR when a meaningful part of the code was AI generated.

> * Write PR descriptions, issues, and comments yourself. No AI-written or AI-rewritten text. A few plain sentences in your own words beat a page of generated summary. PRs and issues with AI-written text get closed without review.

> ...

> * PRs that read like unreviewed output, with narrating comments, invented APIs, or style that ignores the file they are in, get closed without review.

That looks very clearly non-vibe coded to me. (Also, it's a mature project with 79 releases over the last year and a bit, and 321 contributors.)

As much as I respect the abilities of agentic coding LLMs, I don't think we're yet at the point that you could vibe-code a novel Wayland DE. This is not trivial stuff!