Johnson Lee

[Johnson Lee @johnson0407]

@huang47 ouch, did you find out why it did the changes? I've regularly run review agents and no issues so far *knock on wood*

[ClaudeDevs @ClaudeDevs]

We’ve shipped a security-guidance plugin for Claude Code that helps identify and fix vulnerabilities as you’re writing code.

Available for all Claude Code users. Install from the plugin marketplace (/plugins).

[JoshWest247 ⚡️ @JoshWest247]

My friend in the exotic automotive space just sent me this regarding the Ferrari Luce and Mercedes GT:

“I was chatting with some Mercedes people at their event last week and journalists about why manufacturers keep dropping these electric cars that nobody asked for — and it actually makes a lot of sense once you hear it.

The EU has this rule where every car brand’s ENTIRE lineup has to average below a certain emissions number. Not per car — the whole fleet. And if they miss it, they get fined like €95 for every single gram they’re over, multiplied by every car they sold that year. We’re talking hundreds of millions.

So every EV they sell pulls that average down. Which means they can keep making the V8s and AMGs and ICE cars we actually love without getting destroyed by regulators.

So that MB electric GT 4-Door and the Ferrari Luce? Those aren’t passion projects. That’s compliance math. The irony is those EVs you hate might literally be the reason your favorite ICE cars still exist.

Mind-bending but that’s the game right now.”

[Graham Stephan @GrahamStephan]

This is Ferrari's new humiliation ritual.

They'll make you buy this $640k EV (that looks like a melted Cybertruck had a baby with an iPad) before you can get on the list for the real Ferraris you actually want.

Welcome to the new 'pay to play' era at Maranello.

[Lex Fridman @lexfridman]

Here's my conversation all about @FFmpeg, the legendary open-source software powering most video on the Internet. In the episode, I talk with Jean-Baptiste Kempf and Kieran Kunhya. JB is lead developer of VLC and Kieran is FFmpeg contributor, codec engineer, and the person behind the now-infamous @FFmpeg account on X.

VLC (@videolan), by the way, is also a legendary piece of open-source software: it's a video player that can open basically anything & has been downloaded over 6 billion times.

I think both FFmpeg and VLC are two of the most important and impactful software systems ever created, both open source, and both created & maintained by volunteers: brilliant engineers from all walks of life.

Thank you to everyone who contributed to FFmpeg and VLC, and in general to all engineers giving their heart & soul to building systems used by millions (or billions) of people, and often doing so not for money, status, or fame, but purely for the love of building great software and doing good for the world.

Thank you to the builders! 🙏❤️

Shoutouts in this chat to @ID_AA_Carmack @karpathy @elonmusk @TimSweeneyEpic and everyone who is a contributor & fan of open source!

It's here on X in full and is up everywhere else (see comment).

Timestamps:
0:00 - Episode highlight
2:17 - Introduction
5:35 - Weirdest things VLC opens
9:59 - How video playback works
19:20 - Video codecs and containers
30:07 - FFmpeg explained
51:07 - Linus Torvalds
55:46 - Turning down millions to keep VLC ad-free
1:10:04 - FFmpeg & Google drama
1:29:18 - FFmpeg developers
1:35:55 - VLC and FFmpeg
1:40:29 - History of FFmpeg
1:43:46 - Reverse engineering codecs
1:57:01 - FFmpeg testing
2:01:08 - Assembly code (handwritten)
2:25:26 - Rust programming language
2:34:42 - FFmpeg and Libav fork
2:43:04 - Open source burnout
2:50:51 - x264 and internet video
3:04:07 - Video compression basics
3:11:04 - CIA and fake VLC
3:21:39 - Ultra low latency streaming
3:39:07 - AV2 codec and video patents
3:48:59 - VLC backdoors
3:59:14 - Video archiving
4:05:51 - Future of FFmpeg and VLC

[Mitchell Hashimoto @mitchellh]

Ghostty is leaving GitHub. I'm GitHub user 1299, joined Feb 2008. I've visited GitHub almost every single day for over 18 years. It's never been a question for me where I'd put my projects: always GitHub. I'm super sad to say this, but its time to go. https://t.co/DQDemHdytV

[Sanctimonious Nidgey 🙏🏻 @NidgeHattersSK]

For context, that Marathon fella ran the equivalent of -

440 x 100m.

He averaged each 100m at 17 seconds.

😂 Mental.

[Steak 'n Shake @SteaknShake]

Starting June 1, all our Steakburgers will be made with 100% grass-fed, grass-finished beef.

America deserves the best!

We see it as our job to try to give you the best.

It is up to our customers to decide what's healthy for them.

We believe in freedom — the freedom to choose. 🇺🇸

[Elon Musk @elonmusk]

Cybercab has started production

[Thrilla the Gorilla @ThrillaRilla369]

If we don’t let athletes bet on games they can influence, why in the hell do we let Congress invest in the companies they regulate?

[The Minimalists @TheMinimalists]

What looks like wealth is often just well-decorated debt.

[Jason Robertson @JRobFromMN]

Minnesota is so retarded

We give hundreds of Billions of dollars to daycares and autism centers and they don’t verify they are an actual business or have kids or clients there

Meanwhile,
I’m getting my kitchen remodeled.

My licensed and insured contractor had to get a permit to unhook and rehook my sink

Then we had to have a city inspector verify the work

The Government literally does more auditing on a citizen installing a sink than they do to verify that learing centers getting Millions actually have kids there

[Elon Musk @elonmusk]

California legislators are trying to make investigating fraud illegal

[flavio @flaviocopes]

How Axios was compromised 🤯

[Tom Nash @iamtomnash]

Investing is the only game where doing nothing is actually a skill.

[JAN3 @JAN3com]

🇹🇼 Taiwan currently holds 210 seized Bitcoin, and the conversation around building a larger reserve is growing.

@Excellion presented a plan to the Legislative Yuan detailing how Taiwan could secure a strategic reserve of 83,000 BTC.

Read the full report by @BlockTempo below. 👇

[Yun-Ta Tsai @yunta_tsai]

Of all living things, our trajectories are tightly held by two endpoints—birth and death—like strings.

It’s the vibration of the strings that makes lasting echoes in the universe, like the Big Bang.

[Andrej Karpathy @karpathy]

- Drafted a blog post
- Used an LLM to meticulously improve the argument over 4 hours.
- Wow, feeling great, it’s so convincing!
- Fun idea let’s ask it to argue the opposite.
- LLM demolishes the entire argument and convinces me that the opposite is in fact true.
- lol

The LLMs may elicit an opinion when asked but are extremely competent in arguing almost any direction. This is actually super useful as a tool for forming your own opinions, just make sure to ask different directions and be careful with the sycophancy.

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.