AC

[Steven Lim @0x534c]

🚨 𝗣𝗼𝗽𝘂𝗹𝗮𝗿 𝗻𝗽𝗺 𝗽𝗮𝗰𝗸𝗮𝗴𝗲𝘀 𝗸𝗲𝘆𝘃 & 𝗰𝗮𝗰𝗵𝗲𝗮𝗯𝗹𝗲 𝗰𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲𝗱

Socket’s Threat Research Team has identified an 𝗮𝗰𝘁𝗶𝘃𝗲 𝘀𝘂𝗽𝗽𝗹𝘆 𝗰𝗵𝗮𝗶𝗻 𝗮𝘁𝘁𝗮𝗰𝗸 targeting the widely used 𝚔𝚎𝚢𝚟 and 𝚌𝚊𝚌𝚑𝚎𝚊𝚋𝚕𝚎 npm packages.

https://t.co/qgIwCwe9rp

On 𝗔𝘂𝗴𝘂𝘀𝘁 𝟰, 𝟮𝟬𝟮𝟲, attackers published at least ten malicious packages under these namespaces and quickly expanded to other maintainers’ projects. These packages collectively represent 𝘁𝗲𝗻𝘀 𝗼𝗳 𝗺𝗶𝗹𝗹𝗶𝗼𝗻𝘀 𝗼𝗳 𝘄𝗲𝗲𝗸𝗹𝘆 𝗱𝗼𝘄𝗻𝗹𝗼𝗮𝗱𝘀, and 𝗻𝗲𝘄 𝘃𝗮𝗿𝗶𝗮𝗻𝘁𝘀 𝗮𝗿𝗲 𝗮𝗽𝗽𝗲𝗮𝗿𝗶𝗻𝗴 𝗶𝗻 𝗿𝗲𝗮𝗹 𝘁𝗶𝗺𝗲. Socket is continuously updating the affected package list.

To help defenders, I’ve built a 𝗞𝗤𝗟 𝗮𝘂𝗱𝗶𝘁 𝗾𝘂𝗲𝗿𝘆 leveraging Socket’s ongoing list of compromised versions — enabling you to check your 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿 𝗳𝗼𝗿 𝗘𝗻𝗱𝗽𝗼𝗶𝗻𝘁 (𝗠𝗗𝗘) environment for exposure.

https://t.co/ePVVv7xi7k

#NPMSupplyChainCompromise #DefenderXDR #ThreatHunting

[Rohit @heyrohitai]

Instead of watching an hour of Netflix, watch this 2-hour Stanford lecture, which will teach you more about how LLMs like ChatGPT and Claude are built than most people working at top AI companies learn in their entire careers.

[angel @angeldot_]

Estos ingenieros de Anthropic acaban de mostrar cómo construyen una app completa desde 0

Con un solo loop de agentes.

40 minutos del equipo detrás de Claude Code

Usaron 3 agentes:

→ Uno planifica
→ Otro construye
→ Otro evalúa

Y el ciclo se repite hasta que la app funciona de verdad

“Los ganadores no serán quienes tengan el modelo más inteligente.

Serán quienes tengan el mejor loop”

Mira este vídeo y luego lee la guía completa sobre cómo crear y usar loops 👇

[Andrej Karpathy @karpathy]

LLM Knowledge Bases

Something I'm finding very useful recently: using LLMs to build personal knowledge bases for various topics of research interest. In this way, a large fraction of my recent token throughput is going less into manipulating code, and more into manipulating knowledge (stored as markdown and images). The latest LLMs are quite good at it. So:

Data ingest:
I index source documents (articles, papers, repos, datasets, images, etc.) into a raw/ directory, then I use an LLM to incrementally "compile" a wiki, which is just a collection of .md files in a directory structure. The wiki includes summaries of all the data in raw/, backlinks, and then it categorizes data into concepts, writes articles for them, and links them all. To convert web articles into .md files I like to use the Obsidian Web Clipper extension, and then I also use a hotkey to download all the related images to local so that my LLM can easily reference them.

IDE:
I use Obsidian as the IDE "frontend" where I can view the raw data, the the compiled wiki, and the derived visualizations. Important to note that the LLM writes and maintains all of the data of the wiki, I rarely touch it directly. I've played with a few Obsidian plugins to render and view data in other ways (e.g. Marp for slides).

Q&A:
Where things get interesting is that once your wiki is big enough (e.g. mine on some recent research is ~100 articles and ~400K words), you can ask your LLM agent all kinds of complex questions against the wiki, and it will go off, research the answers, etc. I thought I had to reach for fancy RAG, but the LLM has been pretty good about auto-maintaining index files and brief summaries of all the documents and it reads all the important related data fairly easily at this ~small scale.

Output:
Instead of getting answers in text/terminal, I like to have it render markdown files for me, or slide shows (Marp format), or matplotlib images, all of which I then view again in Obsidian. You can imagine many other visual output formats depending on the query. Often, I end up "filing" the outputs back into the wiki to enhance it for further queries. So my own explorations and queries always "add up" in the knowledge base.

Linting:
I've run some LLM "health checks" over the wiki to e.g. find inconsistent data, impute missing data (with web searchers), find interesting connections for new article candidates, etc., to incrementally clean up the wiki and enhance its overall data integrity. The LLMs are quite good at suggesting further questions to ask and look into.

Extra tools:
I find myself developing additional tools to process the data, e.g. I vibe coded a small and naive search engine over the wiki, which I both use directly (in a web ui), but more often I want to hand it off to an LLM via CLI as a tool for larger queries.

Further explorations:
As the repo grows, the natural desire is to also think about synthetic data generation + finetuning to have your LLM "know" the data in its weights instead of just context windows.

TLDR: raw data from a given number of sources is collected, then compiled by an LLM into a .md wiki, then operated on by various CLIs by the LLM to do Q&A and to incrementally enhance the wiki, and all of it viewable in Obsidian. You rarely ever write or edit the wiki manually, it's the domain of the LLM. I think there is room here for an incredible new product instead of a hacky collection of scripts.

[Google Cloud Tech @GoogleCloudTech]

Introducing the Open Knowledge Format (OKF), an open specification that formalizes the LLM-wiki pattern into a portable, interoperable format.

AI is only as smart as the context we give it. As we build more advanced, agentic AI systems, they need accurate metadata and context to be useful. But in most organizations, that context is locked inside fragmented data catalogs, isolated wikis, scattered code comments, or the minds of senior engineers. Every time a new AI agent is built, teams are forced to solve the exact same context-assembly problem from scratch.

To solve this, we've announced OKF, a vendor-neutral, open specification that formalizes the "LLM-wiki pattern" into a portable, interoperable format. It provides a standardized way to represent the enterprise knowledge that modern AI systems rely on.

— Just markdown: readable in any editor, renderable on GitHub, indexable by any search tool
— Just files: shippable as a tarball, hostable in any git repo, mountable on any filesystem
— Just YAML frontmatter: for the small set of structured fields that need to be queryable: type, title, description, resource, tags, and timestamp

We’ve also shipped reference implementations to help you hit the ground running, including an enrichment agent for BigQuery, a static HTML visualizer, and live sample bundles on @github → https://t.co/ilhAMCrcTc

➕ Knowledge Catalog can now natively ingest OKF!

Stop reinventing data models and building bespoke integrations for every new AI tool. Here's more about how OKF works → https://t.co/FR4kJRsgEH

[angel @angeldot_]

Andrej Karpathy, ingeniero de Anthropic:

"El mayor error en la IA ahora mismo: la gente está forzando a los agentes a trabajar en vez de dominar primero el modelo. Cometimos ese error en 2016 en OpenAI. Nos costó 5 años."

Lo que Karpathy quiere decir realmente:

1. Deja de forzar a tu agente a hacerlo todo, entiende primero el modelo que hay debajo

2. Las demos son fáciles, los productos tardan una década. La conducción autónoma lo demostró: si te saltas los cimientos, todo se rompe.

3. El agente no es el producto. Sus cimientos lo son. Construye eso, y los agentes salen solos.

"Tú que estás construyendo agentes ahora mismo: tú estás en la vanguardia. No OpenAI. No DeepMind. Tú."

mira el vídeo → guárdalo → y lee el artículo de abajo ↓

[AC @chimpinano]

Cumplimiento y Defensa contra Fraude y Abuso de Credenciales en Internet https://t.co/yteSBrWCnB y Defensa contra Fraude y Abuso de Credenciales en Internet&via=BrightTALK

[VoidZero @voidzerodev]

We're thrilled to announce the first stable release of Oxlint - version 1.0!

Our Rust-powered JavaScript/TypeScript linter delivers 50~100x faster performance than ESLint with 500+ rules and zero configuration required.

Time to give it a try!

https://t.co/gTpmsEYrZl

[elhacker.NET @elhackernet]

Filtradas 184 millones de contraseñas de Apple, Gmail, Instagram, bancos y más
https://t.co/D6oFdmXzsP

[AC @chimpinano]

Automatización de Flujos de Trabajo de API Security https://t.co/ehuNLjgDq3ón de Flujos de Trabajo de API Security&via=BrightTALK

[AC @chimpinano]

https://t.co/rdjt2zcWOg

[AC @chimpinano]

https://t.co/u1sDcbmMnD

[.NET Foundation @dotnetfdn]

Veritas API Gateway release of version 5.0 supports .NET 9 now!!

https://t.co/Fh78oQPEWU

[AC @chimpinano]

El auge de los ataques a aplicaciones y API,El auge de los ataques a aplicaciones y API https://t.co/6ZONwDUCrE auge de los ataques a aplicaciones y API&via=BrightTALK,https://t.co/6ZONwDUCrE auge de los ataques a aplicaciones y API&via=BrightTALK

[Apache Hop @ApacheHop]

some stats for #ApacheHop in 2023:

💫 5 releases (2.3, 2.4, 2.5, 2.6, 2.7)
💫 1.263 commits
💫 38 committers
💫 225.526 lines of code changed
💫 374 tickets closed
💫 517 pull requests merged

A huge thank you to everyone involved!

#apachehop #dataengineering #community

[AC @chimpinano]

@elhackernet @blindma1den @S4vitar @ItsJoshDesign

[The Debian Project @debian]

Debian 12.2 image release available for download! https://t.co/InIiUA5so7 https://t.co/MuFrXadmds

[AC @chimpinano]

@mauriciopedroza Diay pero puro suplentes en la alineación, en realidad no vistes jugar al equipo titular!

[Deno @deno_land]

The biggest updates in 1.30 👀

[AC @chimpinano]

@metadevskills @MoureDev