Deepak

[Deepak @deepsnapater]

@t3ssiee Is this a trick or bug in your engineering @Swiggy please look into this.

[Deepak @deepsnapater]

@Ayussheth Love to join

[Daniel Hnyk @hnykda]

My awesome colleague Callum McMahon, who discovered this, wrote an explainer and postmortem going into greater detail: https://t.co/oc2Dfspvxu

[Deepak @deepsnapater]

Rumour about fuel shortage triggers huge traffic blocks in Hyderabad

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Deepak @deepsnapater]

At hyderabad for Gemini API sprints.

[Deepak @deepsnapater]

@sajithamma Return of terminal and tmux been a reality. Some people are even reimagining the whole terminal UI, I found few tweets few days back regarding this trend.

[Deepak @deepsnapater]

@bhash @OlaElectric Happy to see you are even thinking about customer service 🤣

[Deepak @deepsnapater]

Seeing such code gives me some assurance of job safety, not sure how long though. May be the problem is that such an engineer not finding the mistakes of their own newfound assistant. (3.)

[Deepak @deepsnapater]

Today I noticed one of my engineer used Claude to implement some key feature, the implementation was nice and working. But when I asked some simple questions about it the engineer said she doesn’t know how it worked “it was done by Claude” this was the answer. (1/2)

[Deepak @deepsnapater]

When I looked at the code for review I have noticed some major issues which won’t surface very easily. For example a user could technically update someone else’s email or phone there are no guardrails. One method is simply a duplicate function with some name changes. (2..)

[Deepak @deepsnapater]

I was really happy to track down the problem and fix it this time with the help of ChatGPT instead of Google. It felt surprisingly refreshing. (2/2)

[Deepak @deepsnapater]

After many years of using a Mac, I’ve recently been working on a Linux desktop again. Yesterday a system update broke my GDM, and it took me back to the old days of troubleshooting Linux issues. (1/2)

[Deepak @deepsnapater]

Lapse in govt funding

[Deepak @deepsnapater]

Looks like belly dance is better when performed by men.

[Deepak @deepsnapater]

Ola is coming up with a lot of features and the stock price is picking too. Great, but do they care about existing customers ? the number of dusty scooters in front of a service station near my home tells a different story.

[Deepak @deepsnapater]

Some of those YouTube journalists are revealing their true colours these days. They were masquerading as pundits and were spreading their propaganda all these years. Suddenly the #VoteChori campaign made them all at defensive position which they never had to face in last 10 years

[Deepak @deepsnapater]

@anubhavgupta_ji Castes who were enjoying unofficial reservation in all social domains for thousands of years are now crying when the system try to balance the equation for the last 79 years.

[Deepak @deepsnapater]

I am not really sure the waste management is taught in schools in Kerala yet. I don’t see different coloured waste boxes in schools yet but there is some sort of awareness now in people.

[Deepak @deepsnapater]

Cleanliness is something I notice unlike before in my panchayat and nearby panchayath. There are few corners where few people still throw waste but still very few compared to 5 years back. The kitchen & plastic waste management is excellent these days. (1/2)

[Deepak @deepsnapater]

I have gone to Varappuzha church fest last week and I couldn’t see any trace of papers or plastics around in spite of overwhelming number of food corners. Few years back the whole place you could spot paper or plastics around wastes being thrown around while you walk. (2/2)

[Deepak @deepsnapater]

I think there is a fundamental shift towards waste management in the general population now. Waste collection plus fines plus awareness contributed heavily to the newfound attitude.