Cesar Ramirez

full-time sloth
interests: entrepreneurship, smb m&a, personal finance, real estate, SaaS and tech.

[ElektroKill @elektrokilldev]

#dnSpyEx 6.6.0 has been released. After 2 years, finally a new stable release :D

https://t.co/Fd3I8eXG8G

[Zion Leonahenahe Basque @mahal0z]

Agents need better tools for reversing! I'm releasing declib (previously libbs), with a new CLI today that gives agents CLI access to 4 decompilers (IDA, Ghidra, Binja, angr), parity feature support to most MCP (12 features), and the ability to sync those changes across decs!

[Cesar Ramirez @cramir4]

@mitchellh Congrats 🎉 🥳

[Turshija @turshija]

I got completely owned by the most sophisticated hack I've ever encountered.

I'm a developer. I know what scams look like.
This didn't look like one.

🧵

[Cesar Ramirez @cramir4]

@savedotday When is Android app coming back? 🙂

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Cesar Ramirez @cramir4]

@big_duca I feel seen 🤣

[Cesar Ramirez @cramir4]

@steipete Pretty cool. Is the code available? Definitely useful to have a filtered view

[Cesar Ramirez @cramir4]

@Verizon @VerizonSupport. can someone reach out to me. I've tried calling and keep getting automated answering machine that just keeps saying it is having trouble understanding. no option to request a call back through the app for billing, account, or plans.

[Cesar Ramirez @cramir4]

I wonder what goes through the minds of people who create a pricing page that essentially just says "contact us"

[Cesar Ramirez @cramir4]

accidentally just stopped and pruned all docker including volumes on the wrong server 🤦‍♂️. has anyone screwed up this bad?

[Cesar Ramirez @cramir4]

@OfficialLoganK Have you tried Mai?

[Cesar Ramirez @cramir4]

Hey, by trying to fix feature x you broke feature y. (proceeds to fix feature y and break feature x).
uhh.. okay you now broke feature y. " you are absolutely right." ( breaks feature y and doesn't fix feature ex.

my personal experience with AI currently.

[Cesar Ramirez @cramir4]

@catalinmpit @levelsio "For the love of money is the root of all evil " so not money itself

[Cesar Ramirez @cramir4]

@signulll system design and other interview areas. I ended up having to take a lower IC role at ~60% reduced pay for the interim.

[Cesar Ramirez @cramir4]

@signulll This is also my experience, move to management to move up, 5 years later get laid off, now I can't get IC roles as I've been in management too long.

Roles at well paying companies still expect you to ace hands on coding interviews regardless of how well you do on

[Pieces @getpieces]

🚨PIECES AI AMBASSADOR GIVEAWAY🚨

Want to win $250 and a Pieces hat? 🧢

Here’s your chance! Whoever gets the most downloads from their affiliate link in December takes the prize!

To join the Pieces AI Ambassador Program:
1️⃣ Like & RT this post (+1 bonus point)
2️⃣ Apply here: https://t.co/emxjyFrAJ9

Start sharing your link and good luck! 🚀

⏰ Contest ends December 31, 2024

[Cesar Ramirez @cramir4]

@getpieces Someone had asked what the best way to get started is and Sam had some good ideas for teams getting started. The way I got started was with the co-pilot in VS code and now I use pieces for nearly everything. Would highly recommend people to start with the copilot extension.

[Cesar Ramirez @cramir4]

@getpieces Didn't get a chance to speak, but when it comes to what AI to use I'd say just use whichever one you have access to until you have very specific use cases. if you take a look at the amount of models available on openrouter and hugging face it's a never ending rabit hole.

[Cesar Ramirez @cramir4]

@blueavee @theo --turbopack helps
https://t.co/q7Z4o8FIni