Muhammad Ukasha

Webflow Partner of the Year Finalist | Scaling Agencies & Brands with Webflow | Helped Scale 2 Agencies to Exit

[Muhammad Ukasha @Ukasha_Design]

Alhamdulillah, I am super stoked to find out that I'm a finalist in @webflow's "Professional Partner of the Year" award category.

It's a real honor to have my name included alongside such an insane group of talented people!

#webflowconf #webflowawards

[shadcn @shadcn]

Rooting for @github. They’ve given me years of free infra. happy to give them some time to figure this out. You got this.

[Polymarket @Polymarket]

BREAKING: Vibe-coding platform Lovable reportedly suffered a breach that exposed users’ AI chat histories, source code, & database credentials.

[Vercel @vercel]

We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin:
https://t.co/0S939n3qHC

[Brad Traversy @traversymedia]

It’s kind of crazy what we (myself included) are willing to give access to in the name of productivity.

I have a feeling we will look back on these years with A LOT of regret. For many reasons. This is just one. Again, myself included.

[Muhammad Ukasha @Ukasha_Design]

@iamkhuramsohail @Ahmad__Mukhtar Running 2 inverter ACs, 2 refrigerators on a 5kw system.

[Ruben Hume @rubenhume]

Probably one of the most original brands I’ve seen lately, indeed

[dax @thdxr]

maybe gta6 is also too dangerous to release

[trish @TrisH0x2A]

it's honestly embarrassing that Chrome accidentally became the best PDF viewer while Adobe spent decades making Acrobat slower and more bloated

[Muhammad Ukasha @Ukasha_Design]

@goncalotex @omma_ai What tool do you use to record the site?

[Muhammad Ukasha @Ukasha_Design]

@superwhisper @steipete Nobody got the joke haha

[Mo @atmoio]

Claude Mythos is Delusional

[Pedro Sánchez @sanchezcastejon]

Los alto al fuego siempre son una buena noticia. Sobre todo si conducen a una paz justa y duradera. Pero el alivio momentáneo no puede hacernos olvidar el caos, la destrucción y las vidas perdidas.

El Gobierno de España no aplaudirá a quienes incendian el mundo porque se presenten con un cubo.

Lo que toca ahora: diplomacia, legalidad internacional y PAZ.

[mal @mal_shaik]

claude code core

[Muhammad Ukasha @Ukasha_Design]

@petergostev I actually think they are keeping it in the dark just like Anthropic was.

[Sakshi Sugandhi @SakshiSugandhi]

"AI makes everyone a developer" is true the same way "cameras makes everyone a photographer"

[Muhammad Ukasha @Ukasha_Design]

We are officially 100% in the movie "Her" now.

Pretty soon, it feels like we're gonna see the line between "software" and "entity" disappear in real life.

[Shubham Saboo @Saboo_Shubham_]

This is getting way too real!

I can now get on a video call with my OpenClaw Agents to chat with them face to face.

All i need to do is to send them a Google meet invite.

[Muhammad Ukasha @Ukasha_Design]

@leinwand @webflow That's what I'm talking about. Amazing updates.

[Muhammad Ukasha @Ukasha_Design]

@markoilico

[Spline @splinetool]

Today, we're releasing Omma.

Create 3D, Websites, and Apps with AI agents.

Start now on https://t.co/Q6aAIWZYyJ
Follow @omma_ai

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.