Hauahau essa porra de foguete não dá ré me deu alguns flashbacks.
Papo de gerência que só sabe acelerar mas nunca sabe pra onde..
Eis o resultado de um antigo job meu, a empresa que falava isso terceirizou todos os devs, diretores vazaram com seus bônus, e agora está revertendo de uma das maiores Fintechs de investimentos (com app, jornalistas, feed e plataforma de vídeo próprios) para um grupinho no zap haurhauha
Eu já desativei a minha há muito tempo, burrinha e fica coletando dados das conversas constantemente pra vender anúncios com base no que ouviu.
Nessa época de IA vale muito mais a pena montar um mini "Jarvis" em casa que é muito mais expansível, e sem vender os dados pra terceiros
@acgfbr Aparentemente, alguém usou pra torrent ou pra uma parada ilegal; isso explicaria o auto-ban. Quando voltaram ao ar, eles exigiram que concordássemos com novos termos sobre o que pode ser hosteado nos serviços .
SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.
We’ve released Next.js versions 16.2.6 and 15.5.18 with important security fixes.
These fixes address multiple vulnerabilities across high, moderate, and low severity, including one upstream React issue. We strongly recommend upgrading as soon as possible.
⬇️
@ranman@syhw The benchmark is unrealistic by design, and it passes a message you've missed: we've built way more impressive code with no internet at all.
Did @Stable chain get configured out of spec? Suddenly, blocks below 12,004,000 carry a baseFeePerGas with a value that doesn't fit in u64
Stablescan is currently showing 0 transactions per block for the past couple of hours
There was plenty of much harder software created eons ago without any internet wiki, Stackoverflow, or a docs subdomain.
LLMs are mathematical prediction models; they're not "smart" nor self-conscious. They're tools that can be useful when used correctly.
Stop underestimating how amazing humans can be. Sometimes it's like our entire history has been forgotten because a model that, not long ago, couldn't count Rs in strawberry can now make some pretty interfaces
Believing what companies say has never been a good idea, not just llms. Would they be legally liable? I doubt it. But what they are doing wrong here isn't anything new
People think engineers can be replaced just because they can't see how expensive, unprofitable, and full of band-aids it is to develop and host LLMs on a wide scale