Janga Varun

[Damn. @Theonenameddamn]

We criticised the Godi media for what they did during the protests, but now let's take a moment to appreciate the journalists who stood with the students through thick and thin.

>Abinav Pandey – News Pinch

>Sarthak Goswami – Independent Journalist

>Samdish Bhatia – Independent Journalist

>Kavya Karnatac – KK Creates

>Saurabh Dwivedi – Indian Express

>Siddhant Mohan – The Lallantop

>Priyanshi Sharma – Peek TV

>Tanushree Pandey – Independent Journalist

>Bablu Saini – Independent Journalist

>Medha Yadav – Jist News

>Ajit Anjum – Independent Journalist

>Harsh Yadav – Independent Journalist

>Aaryan Mishra – The Red Mike

>Sharad Sharma – Independent Journalist

>Gajendra Singh – Independent Journalist

>The Unedited Media – Independent Journalists

>Shyam Meera Singh – Strike Originals

[Deedy @deedydas]

The International Math Olympiad (IMO) 2026, the hardest math contest for high schoolers, just ended.

I ran Fable (high), Sol (xhigh), K3 (max) and Axiom against it and all got a perfect score of 42/42 (repo below if you want to check their solutions):
— Claude Fable 5 was the solved it in 1 attempt, and was the fastest.
— GPT 5.6 Sol took 1 more attempts, and was cheapest.
— Kimi K3 did it but took 4 more attempts, and took a LOT of tokens.
— Axiom Math actually proved everything in Lean.

P3 and P6 were the hardest followed by P2, judging by attempts + num tokens.

Students had 9hrs to solve these 6 problems, and Fable and Sol were under 4hrs.

The frontier of AI has officially moved well past IMO math.

[Andrej Karpathy @karpathy]

I wrote a quick new post on "Digital Hygiene".

Basically there are some no-brainer decisions you can make in your life to dramatically improve the privacy and security of your computing and this post goes over some of them. Blog post link in the reply, but copy pasting below too.

Every now and then I get reminded about the vast fraud apparatus of the internet, re-invigorating my pursuit of basic digital hygiene around privacy/security of day to day computing. The sketchiness starts with major tech companies who are incentivized to build comprehensive profiles of you, to monetize it directly for advertising, or sell it off to professional data broker companies who further enrich, de-anonymize, cross-reference and resell it further. Inevitable and regular data breaches eventually runoff and collect your information into dark web archives, feeding into a whole underground spammer / scammer industry of hacks, phishing, ransomware, credit card fraud, identity theft, etc. This guide is a collection of the most basic digital hygiene tips, starting with the most basic to a bit more niche.

Password manager. Your passwords are your "first factor", i.e. "something you know". Do not be a noob and mint new, unique, hard passwords for every website or service that you sign up with. Combine this with a browser extension to create and Autofill them super fast. For example, I use and like 1Password. This prevents your passwords from 1) being easy to guess or crack, and 2) leaking one single time, and opening doors to many other services. In return, we now have a central location for all your 1st factors (passwords), so we must make sure to secure it thoroughly, which brings us to...

Hardware security key. The most critical services in your life (e.g. Google, or 1Password) must be additionally secured with a "2nd factor", i.e. "something you have". An attacker would have to be in possession of both factors to gain access to these services. The most common 2nd factor implemented by many services is a phone number, the idea being that you get a text message with a pin code to enter in addition to your password. Clearly, this is much better than having no 2nd factor at all, but the use of a phone number is known to be extremely insecure due to the SIM swap attack. Basically, it turns out to be surprisingly easy for an attacker to call your phone company, pretend they are you, and get them to switch your phone number over to a new phone that they control. I know this sounds totally crazy but it is true, and I have many friends who are victims of this attack. Therefore, purchase and set up hardware security keys - the industrial strength protection standard. In particular, I like and use YubiKey. These devices generate and store a private key on the device secure element itself, so the private key is never materialized on a suspiciously general purpose computing device like your laptop. Once you set these up, an attacker will not only need to know your password, but have physical possession of your security key to log in to a service. Your risk of getting pwned has just decreased by about 1000X. Purchase and set up 2-3 keys and store them in different physical locations to prevent lockout should you physically lose one of the keys. The security keys support a few authentication methods. Look for "U2F" in the 2nd factor settings of your service as the strongest protection. E.g. Google and 1Password support it. Fallback on "TOTP" if you have to, and note that your YubiKeys can store TOTP private keys, so you can use the YubiKey Authenticator app to access them easily through NFC by touching your key to the phone to get your pin when logging in. This is significantly better than storing TOTP private keys on other (software) authenticator apps, because again you should not trust general purpose computing devices. It is beyond the scope of this post to go into full detail, but basically I strongly recommend the use of 2-3 YubiKeys to dramatically strengthen your digital security.

Biometrics. Biometrics are the third common authentication factor ("something you are"). E.g. if you're on iOS I recommend setting up FaceID basically everywhere, e.g. to access the 1Password app and such.

Security questions. Dinosaur businesses are obsessed with the idea of security questions like "what is your mother's maidan name?", and force you to set them up from time to time. Clearly, these are in the category of "something you know" so they are basically passwords, but conveniently for scammers, they are easy to research out on the open internet and you should refuse any prompts to participate in this ridiculous "security" exercise. Instead, treat security questions like passwords, generate random answers to random questions, and store them in your 1Password along with your passwords.

Disk encryption. Always ensure that your computers use disk encryption. For example, on Macs this total no-brainer feature is called "File Vault". This feature ensures that if your computer gets stolen, an attacker won't be able to get the hard disk and go to town on all your data.

Internet of Things. More like @internetofshit. Whenever possible, avoid "smart" devices, which are essentially incredibly insecure, internet-connected computers that gather tons of data, get hacked all the time, and that people willingly place into their homes. These things have microphones, and they routinely send data back to the mothership for analytics and to "improve customer experience" lol ok. As an example, in my younger and naive years I once purchased a CO2 monitor from China that demanded to know everything about me and my precise physical location before it would tell me the amount of CO2 in my room. These devices are a huge and very common attack surface on your privacy and security and should be avoided.

Messaging. I recommend Signal instead of text messages because it end-to-end encrypts all your communications. In addition, it does not store metadata like many other apps do (e.g. iMessage, WhatsApp). Turn on disappearing messages (e.g. 90 days default is good). In my experience they are an information vulnerability with no significant upside.

Browser. I recommend Brave browser, which is a privacy-first browser based on Chromium. That means that basically all Chrome extensions work out of the box and the browser feels like Chrome, but without Google having front row seats to your entire digital life.

Search engine. I recommend Brave search, which you can set up as your default in the browser settings. Brave Search is a privacy-first search engine with its own index, unlike e.g. Duck Duck Go which basically a nice skin for Bing, and is forced into weird partnerships with Microsoft that compromise user privacy. As with all services on this list, I pay $3/mo for Brave Premium because I prefer to be the customer, not the product in my digital life. I find that empirically, about 95% of my search engine queries are super simple website lookups, with the search engine basically acting as a tiny DNS. And if you're not finding what you're looking for, fallback to Google by just prepending "!g" to your search query, which will redirect it to Google.

Credit cards. Mint new, unique credit cards per merchant. There is no need to use one credit card on many services. This allows them to "link up" your purchasing across different services, and additionally it opens you up to credit card fraud because the services might leak your credit card number. I like and use privacy dot com to mint new credit cards for every single transaction or merchant. You get a nice interface for all your spending and notifications for each swipe. You can also set limits on each credit card (e.g. $50/month etc.), which dramatically decreases the risk of being charged more than you expect. Additionally, with a privacy dot com card you get to enter totally random information for your name and address when filling out billing information. This is huge, because there is simply no need and totally crazy that random internet merchants should be given your physical address. Which brings me to...

Address. There is no need to give out your physical address to the majority of random services and merchants on the internet. Use a virtual mail service. I currently use Earth Class Mail but tbh I'm a bit embarrassed by that and I'm looking to switch to Virtual Post Mail due to its much strong commitments to privacy, security, and its ownership structure and reputation. In any case, you get an address you can give out, they receive your mail, they scan it and digitize it, they have an app for you to quickly see it, and you can decide what to do with it (e.g. shred, forward, etc.). Not only do you gain security and privacy but also quite a bit of convenience.

Email. I still use gmail just due to sheer convenience, but I've started to partially use Proton Mail as well. And while we're on email, a few more thoughts. Never click on any link inside any email you receive. Email addresses are extremely easy to spoof and you can never be guaranteed that the email you got is a phishing email from a scammer. Instead, I manually navigate to any service of interest and log in from there. In addition, disable image loading by default in your email's settings. If you get an email that requires you to see images, you can click on "show images" to see them and it's not a big deal at all. This is important because many services use embedded images to track you - they hide information inside the image URL you get, so when your email client loads the image, they can see that you opened the email. There's just no need for that. Additionally, confusing images are one way scammers hide information to avoid being filtered by email servers as scam / spam.

VPN. If you wish to hide your IP/location to services, you can do so via VPN indirection. I recommend Mullvad VPN. I keep VPN off by default, but enable it selectively when I'm dealing with services I trust less and want more protection from.

DNS-based blocker. You can block ads by blocking entire domains at the DNS level. I like and use NextDNS, which blocks all kinds of ads and trackers. For more advanced users who like to tinker, pi-hole is the physical alternative.

Network monitor. I like and use The Little Snitch, which I have installed and running on my MacBook. This lets you see which apps are communicating, how much data and when, so you can keep track of what apps on your computer "call home" and how often. Any app that communicates too much is sus, and should potentially be uninstalled if you don't expect the traffic.

I just want to live a secure digital life and establish harmonious relationships with products and services that leak only the necessary information. And I wish to pay for the software I use so that incentives are aligned and so that I am the customer. This is not trivial, but it is possible to approach with some determination and discipline.

Finally, what's not on the list. I mostly still use Gmail + Gsuite because it's just too convenient and pervasive. I also use 𝕏 instead of something exotic (e.g. Mastodon), trading off sovereignty for convenience. I don't use a VoIP burner phone service (e.g. MySudo) but I am interested in it. I don't really mint new/unique email addresses but I want to. The journey continues. Let me know if there are other digital hygiene tips and tricks that should be on this list.

Link to blog post version in the reply, on my brand new Bear ʕ•ᴥ•ʔ blog cute 👇

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[TheLiverDoc™ @theliverdoc]

I may not like Elon, but I'm starting to like Grok.

[Boyan Slat @BoyanSlat]

Pending the securing of funding, we aim to deploy our first Interceptors in Mumbai this year.

[Gukesh D @DGukesh]

18th @ 18!

[TheLiverDoc™ @theliverdoc]

A good way to start the day? A healthy breakfast.

No doubt. But Herbalife has no role in it.

Herbalife is a multilevel marketing pyramid scheme company which manufactures low quality mixed protein made from pea and soy and includes other dangerous botanicals, all the while charging consumers like they're selling Swarovski diamonds.

There are far more, better protein supplements in the market that consumers can spend money on, definitely not Herbalife...

Because Herbalife products are also, infamously associated with the highest documented liver injury and liver failure cases in the world among all protein supplements. No other BS company has even come close to what Herbalife products have achieved when it comes to harming consumers.

Ronaldo may or may not know this, but his breakfast definitely DOES NOT involve Herbalife products and this is just a paid (I wonder how much!) promotion for the company...

Because even the people you place high on a high pedestal are sometimes deprived of ethics and morality when it comes to healthcare and health literacy when money talks.

Sources:

[1] Herbalife agrees to pay over $122M to resolve fraud and corruption: https://t.co/IDWlpJRCsK [2] Federal Trade Commission sense third payment to people who lost money via Herbalife pyramid scheme: https://t.co/CVUMvkNYVq [3] Herbalife pays $123M in bribery fine in China: https://t.co/LwsJUIv0iF [4] Herbalife liver toxicity (> 50 cases) from LiverTox: https://t.co/XpBmReRDRc [5] Herbalife Supplements and Liver Toxicity: https://t.co/ZFakoVLi1l [7] Herbalife removes paper on death due to Herbalife through legal threats: https://t.co/GMqHugVgIi [6] Slimming to the Death: https://t.co/YBReOKq2IO

[Hikaru Nakamura @GMHikaru]

It is truly unfathomable how this kid would come from a country with no chess culture and not only become World Champion, but inspire generations of Indian kids to push chess forward. The legend, @vishy64theking! Huge congratulations to India for winning the @ChessOlympiad!

[The Spectator Index @spectatorindex]

BREAKING: Passenger has died and over 30 injured due to severe turbulence on Singapore Airlines Boeing 777 flight from London to Singapore

[Sasank Chilamkurthy @sasank51]

I unveiled (literally) my new product JOHNAIC, your personal AI server at @PeoplePlusAI's Adbhut India event!

I shared the stage with my hero🦸 @NandanNilekani and met him too!

Read more: https://t.co/cqretDGXCB

[Pramod RPS @pramodrps]

@Furlenco, is there a genuine commitment to stay long-term? Recently, it appears that Furlenco is the only company demonstrating minimal effort in optimizing its operations and troubling the customers.

We receive 20+ automated calls every day for your team's operation errors.

[Sasank Chilamkurthy @sasank51]

Recently UXL foundation formed by @GoogleAI, @Samsung, @intel and @Qualcomm made big news. It was formed to break Nvidia's monopoly in AI hardware. Primary tool for this is SYCL standard. I built two implementations of SYCL from source. Check it out:

https://t.co/xSVf5fO82S

[Dr. Nicole LePera @Theholisticpsyc]

Depression is a symptom of life in survival mode. We treat depression like there’s something wrong with the person. When it’s actually a natural response to an unhealthy environment.

[Dr. Nicole LePera @Theholisticpsyc]

Good communicators don't put people on the defensive.

They do this by avoiding ONE WORD:

[TheLiverDoc™ @theliverdoc]

What people do not realize is that even a "healthy probiotic drink" like Yakult has total carbohydrates 11.5g of which 11.2g is added sugars. Even the light version is not sugar free.

Think about it - with all that "whatever little good bacteria" you are having, the added sugars just kill the purpose, because sugar has been shown to cause and worsen a condition called "dysbiosis" in the intestines, where bad bacteria overwhelm the good ones leading to new onset or worsening of many metabolic diseases and systemic inflammation.

High-fat or high-sugar diets as trigger inflammation in the microbiota-gut-brain axis
https://t.co/IzFOnN5mKF

Sugar Fructose Triggers Gut Dysbiosis and Metabolic Inflammation with Cardiac Arrhythmogenesis
https://t.co/eAHMZCNusJ

Diet Rich in Simple Sugars Promotes Pro-Inflammatory Response via Gut Microbiota Alteration and TLR4 Signaling
https://t.co/mNEbe7b5nq

So what is the whole? point?

These products are perfect examples of cashing in on ignorance, lack of scientific temperament and stupidity and gullibility of humans.

[TheLiverDoc™ @theliverdoc]

Received call from Karnataka colleague abt a man with severe liver failure

For weight loss & fatty liver disease, he paid 6000Rs and tuk these #Herbalife products, for 2 months

Now he is critically ill, may need a new liver

Shutting eyes in broad daylight doesnt make it night

[Indian Medical Association @IMAIndiaOrg]

Fever cases on rise - Avoid Antibiotics

[Andrew D. Huberman, Ph.D. @hubermanlab]

The mere repetition of a behavior causes our nervous system to believe that the specific actions involved, and the context in which they are embedded are important, for better or for worse. Choose what you repeat wisely.

[Judit Polgar @GMJuditPolgar]

We are all deeply devastated with the humanitarian crisis in Ukraine. This week, @chess24com, @ChampChessTour: Charity Cup tournament is dedicated to raising funds for @UNICEF helping families and children in and around Ukraine.
https://t.co/NJQRJH0G9D

#UNICEF #ChessChamps