Dennis 🇺🇦

Site Reliability Engineer

[Sam Hogan 🇺🇸 @samhogan]

Fun fact: GitHub exposes pub keys at github .com/${username}.keys

[Annie Yang @annieqyang]

The most dangerous person in the age of AI is someone who was mediocre at coding but has taste, and can now build anything

[Daniel @growing_daniel]

remember that time the guy who invented homebrew was furious he got turned down for an eng job so he posted about how this company turned down the guy who invented homebrew, then everyone was like dude homebrew sucks

[amy @amypretzel]

sf this week (free unless noted):
full map: https://t.co/j4D8U0Iu4K

‣ 6/19 fri - fort mason night market 🌙
https://t.co/6qyQBIshfI

‣ 6/20-21 sat/sun - north beach festival (11 blocks!)
https://t.co/xmdBAxaVyP

‣ 6/20 sat - secondhand saturdays outer sunset
https://t.co/QId6C4Sunq

‣ 6/20 sat - dachshund bbq at crissy field 🌭🐕
https://t.co/HB3uYfb0LU

maker classes:

‣ 6/22 mon - polymer clay earrings $54
https://t.co/H0bgrpifxV

‣ 6/23 tue - block printing $58
https://t.co/cvu9eX9zjw

‣ 6/24 wed - needle felting woodland creatures $54
https://t.co/zaGs5Cjhpf

[Dennis 🇺🇦 @daodennis]

@amypretzel You’re doing god’s work @amypretzel

[Dennis 🇺🇦 @daodennis]

I just learned the best time to text some of my friends and send them tweets or reels is at 10 PM because Tesla charging is cheaper at the supercharger

[ar0cket1 @ar0cket1]

Has anyone tried a mixture of idiots instead of mixture of experts.

[Dennis 🇺🇦 @daodennis]

My friend told me to chill out but I’m already a chill guy

[Dennis 🇺🇦 @daodennis]

If you have eyes, you should read this

[SemiAnalysis @SemiAnalysis_]

Ever wonder what L11 diags means? Let's break it into two components: L11 and diags. (1/5)

[Kristof @CoastalFuturist]

BREAKING NEWS: God joins Anthropic as member of technical staff

[adel 🌟 @adelwu_]

ideal tech couple:

vertical saas ai boyfriend, frontier lab girlfriend

gotta hedge your career bets in case one eats the other

[Dennis 🇺🇦 @daodennis]

In today’s episode of unexpected company pivots, “Prego said why CANT a sauce brand get into the surveillance game?”

[Dennis 🇺🇦 @daodennis]

Let’s all as a species make a pact together:
“I promise to never call “live concerts” “irl live streams,” unironically.”

[Aakash Gupta @aakashgupta]

North Korean intelligence agents built an entire fake company to compromise one JavaScript developer. And it worked.

UNC1069 didn't hack Axios. They befriended its maintainer. They cloned a real company founder's identity, built a branded Slack workspace with fake employee profiles and LinkedIn post channels, then scheduled a Microsoft Teams call with what appeared to be a full team. During the call, a fake error message said his system needed an update. He installed it. That update was the RAT.

From one developer's laptop, they had everything: npm credentials, publishing access, the keys to a package installed in 80% of cloud environments. Axios gets 100 million downloads per week. The attackers published two poisoned versions at 12:21 AM UTC on a Sunday night, tagging both the latest and legacy branches within 39 minutes. The malicious dependency had been pre-staged 18 hours earlier with a clean decoy version to build registry history. Three separate RAT payloads were pre-built for macOS, Windows, and Linux. The malware self-deleted after execution to erase forensic evidence.

The poisoned versions were live for about three hours before npm pulled them. Huntress observed 135 endpoints across all operating systems calling the attacker's command-and-control server during that window. Wiz found the malicious versions in roughly 3% of environments scanned. Every affected machine needs full credential rotation: npm tokens, AWS keys, SSH keys, CI/CD secrets, everything in .env files.

The part that keeps getting worse: this isn't isolated. The same threat cluster compromised Trivy (a security scanner), KICS, LiteLLM, and multiple GitHub Actions in the two weeks before Axios. Google estimates hundreds of thousands of stolen secrets are now circulating from these combined attacks. The maintainer had 2FA enabled. He said himself: "I have 2FA/MFA on practically everything." The exact method of token compromise is still undetermined.

One person. One fake Teams call. 100 million weekly downloads weaponized in under three hours. The npm ecosystem runs on mass trust in individual maintainers who volunteer their time, and North Korean intelligence now has a repeatable playbook for turning that trust into a delivery mechanism.

[David J Phillips @davj]

"Make no mistakes DO NOT HALLUCINATE. YOU ARE AN EXPERT SOFTWARE ENGINEER"

[jenny ☀️ @jennsun]

overheard a new insult: you have a short context window 💀

[Andrej Karpathy @karpathy]

- Drafted a blog post
- Used an LLM to meticulously improve the argument over 4 hours.
- Wow, feeling great, it’s so convincing!
- Fun idea let’s ask it to argue the opposite.
- LLM demolishes the entire argument and convinces me that the opposite is in fact true.
- lol

The LLMs may elicit an opinion when asked but are extremely competent in arguing almost any direction. This is actually super useful as a tool for forming your own opinions, just make sure to ask different directions and be careful with the sycophancy.

[shivani @shivanijpatel]

men used to go to war, now they go to San Jose for GTC

[Ethan W. Anderson @Ethan_is_online]

I've plotted the most expensive McDonald's burger and the least expensive MacBook over time. This analysis projects that the most expensive burger will be more expensive than the cheapest laptop as soon as 2081