Jono Stiansen 🇨🇦🥃

Trying to be a forcing function for better managers.

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

My wife was very kind on this Father’s Day, she asked a friend of mine how to do some elixir themed cookies relevant to our little family!!! (My daughters name is Ada) #myelixirstatus

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@karpathy @ReadwiseReader save

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@JackyZhong0124 @shawnbuilds @realsigridjin @tokifyi @OpenAI @nicopreme @MisbahSy SOLD

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@shawnbuilds @realsigridjin @tokifyi @OpenAI @nicopreme Old UBC grad here/AI engineer - moving back to Vancouver in the summer - looking forward to checking out the community as it is now.

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@jaynitx @ReadwiseReader save

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@QuinnyPig @mitchellh @ReadwiseReader save

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@rohanpaul_ai @ReadwiseReader save

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@brian_scanlan @readwise save

[Logan Kilpatrick @OfficialLoganK]

Say hello to Gemini Embedding 2, our new SOTA multimodal model that lets your bring text, images, video, audio, and docs into the same embedding space! 👀

[Boris Cherny @bcherny]

Released today: /loop

/loop is a powerful new way to schedule recurring tasks, for up to 3 days at a time

eg. “/loop babysit all my PRs. Auto-fix build issues and when comments come in, use a worktree agent to fix them”

eg. “/loop every morning use the Slack MCP to give me a summary of top posts I was tagged in”

Let us know what you think!

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@dani_avila7 @readwise save

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@timdesilva @sc_cath @readwise save

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@MatthewBerman @readwise save

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@usemonologue I seem to be stuck in recording mode - despite closing and opening it lots of times in different settings - I see "cancel" and "stop" and the sign wave in the middle never moves - and neither function work - I've even restarted my phone and no dice.

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@usemonologue LOVE THE APP - I've been waiting. PLEASE PLEASE PLEASE give me a apple shortcut for kicking off a note :-)

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@gdb @Readwiseio save

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@houmanasefi @gdb this might correspond to how cheap software labour is in that country vs value.

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

Some good friday satire 😀 it's cuts a bit deep though

[hiroshi @daddynohara]

> be me, applied scientist at amazon
> spend 6 months building ML model that actually works
> ready to ship
> manager asks "but does it Dive Deep?"
> show him 37 pages of technical documentation
> "that's great anon, but what about Customer Obsession?"
> model literally convinces customers to buy more stuff they don't need
> "okay but are you thinking Big Enough?"
> mfw I am literally increasing sales
> okay lets ship it
> PM says there's not enough Disagree and Commit
> we need to disagree about something
> team spends 2 hours debating whether the config file should be YAML or JSON
> engineering insists on XML "for backwards compatibility"
> what backwards compatibility, this is a new service
> doesn't matter, we disagree and commit to XML
> finally get approval to deploy
> "make sure you're frugal with the compute costs"
> model runs on a potato, costs $2/month
> finance still wants a cost breakdown
> write 6-pager about why we need $2/month
> include bar raiser in the review
> bar raiser asks "but can we do it for $1.50? we need to be Frugal"
> spend another month optimizing to hit $1.50
> ready to deploy again
> VP decides we need to "Invent and Simplify"
> requests we rebuild the entire thing using a new framework
> framework doesn't exist yet
> "show some Ownership and build it yourself"
> 3 months later, framework is half done
> org restructure happens
> new manager says this doesn't align with team goals anymore
> project cancelled
> model never ships
> manager gets promoted to L8 for "successfully reallocating resources"
> team celebrates with 6-pager retrospective about what we learned
> mfw we delivered on all 16 leadership principles
> mfw we delivered nothing else
> amazon.jpg

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@bcherny @ReadwiseReader save

[Jono Stiansen 🇨🇦🥃 @JonoCodes]

@VasiliyZukanov @KentBeck @karpathy no but it changed the scale