Subh Mukherjee

Building Twelfth Brain, the infrastructure for intelligence to outlive the beautiful minds who hold it. Writer. Cross-domain thinker.

[Subh Mukherjee @Subh_Ks]

A model that reasons well is now a commodity, available to a teenager with a laptop on the same terms as a founder with a term sheet. What's still scarce is knowing what to ask it, what to trust in its answer, and what's worth building with what's left.

[Subh Mukherjee @Subh_Ks]

I didn't start building Twelfth Brain because I wanted to build a company. I started because I got tired of watching years of judgment disappear the moment it lived only inside someone's head. The company came later. The recognition came first.

[Subh Mukherjee @Subh_Ks]

Kahneman spent his career skeptical of expert intuition. Klein spent his studying it. They eventually agreed: gut calls are trustworthy only when the environment is stable and the feedback is fast. Everywhere else, expertise and confident guessing look identical from the outside.

[Subh Mukherjee @Subh_Ks]

You cannot interview your way to someone's judgment. It doesn't arrive as a chain of reasoning you can ask someone to narrate. It arrives as a felt sense, built from thousands of prior instances, compressed past the point of being explainable even to the person carrying it.

[Subh Mukherjee @Subh_Ks]

Two people can spend identical decades in the same field and end up with wildly different judgment to show for it. Time was never the ingredient that mattered. What you do with that time is what matters the most.

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Subh Mukherjee @Subh_Ks]

So here's the real question:

Are you building because you believe in it, or only while it's comfortable?

Because the answer to that determines everything.

#founders #startups #entrepreneurship

[Subh Mukherjee @Subh_Ks]

The founders who win aren't the ones who never fail.

They're the ones who couldn't stop building even when failing hurt.

[Subh Mukherjee @Subh_Ks]

Your losses are not a detour from your story.

They are your story.

Every founder worth following has a chapter they almost didn't survive.

[Subh Mukherjee @Subh_Ks]

#FounderLife #Burnout #SystemsThinking

[Subh Mukherjee @Subh_Ks]

Founders get praised for grit until burnout becomes the punchline. The narrative flips fast, from scrappy underdog to failure as personal shortcoming. But what if resilience isn’t about endurance? What if it’s a system?

[Subh Mukherjee @Subh_Ks]

Resilience is about designing systems that don’t rely on you being the one doing the outlasting.

What’s one system in your life treating resilience like a personality trait instead of a design problem?

[Subh Mukherjee @Subh_Ks]

Moonage Dream of Venture Capital https://t.co/RO9zJaZDt9