j0hnh

Posts are my own and not that of my Org

[Sam Altman @sama]

codex is the best AI coding product and we want to make it easy to try.

for the next 30 days, we are giving companies that want to try switching over two months of free codex usage.

[j0hnh @johthn]

@thomasauros Nice one Tomaso ! I'm sure the heart is full. Enjoy it !

[Andrej Karpathy @karpathy]

New supply chain attack this time for npm axios, the most popular HTTP client library with 300M weekly downloads.

Scanning my system I found a use imported from googleworkspace/cli from a few days ago when I was experimenting with gmail/gcal cli. The installed version (luckily) resolved to an unaffected 1.13.5, but the project dependency is not pinned, meaning that if I did this earlier today the code would have resolved to latest and I'd be pwned.

It's possible to personally defend against these to some extent with local settings e.g. release-age constraints, or containers or etc, but I think ultimately the defaults of package management projects (pip, npm etc) have to change so that a single infection (usually luckily fairly temporary in nature due to security scanning) does not spread through users at random and at scale via unpinned dependencies.

More comprehensive article:
https://t.co/EJAZbqAPIQ

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[whoisli.am @LiamPTFarrelly]

Proud of the team today as we announce our Series B.

We’re hiring across GTM & Engineering. If you want to be part of a team that’s rethinking the problem, not just the solution, join us 👉 https://t.co/ak40EKKIWQ

[Shane Curran @arcurn]

Today, we’re excited to announce @Evervault's $25M Series B, led by Ribbit Capital with continued support from @sequoia, @IndexVentures, @kleinerperkins, and @nextplayVC.

This round comes at a time when sensitive data exchange on the web is going parabolic. Since 2019, we’ve been focused on building durable infrastructure for engineering teams to collect, process, share, and enrich sensitive data -- while keeping it encrypted at all times.

We thought we were making good progress in encrypting the web, helping customers like @tryramp, @Rippling, @finix, @TheOverwolf, @Uniswap, @CarTrawler, and hundreds of others secure more than $5bn/year in payment flows and 100m+ unique tokens per month. But the past year has shown that our enemy -- plaintext data -- is getting stronger and more pervasive.

Our vision is to build the clearinghouse for sensitive data, helping companies exchange sensitive data in a secure and encrypted way. This round helps us encrypt more of the web by further refining our developer experience, building deeper integrations with trusted third-parties, and increasing the value we can offer our customers for more data types.

First and foremost, thank you to our customers. You trusted Evervault to sit directly in the flow of your most sensitive data (payments, identity, financial information, and more) and that trust is not something we take lightly. Your feedback, your requirements, and the problems you bring to us every day are what shape the product and push us forward.

Thank you to the Evervault team. What you’ve built is genuinely special: infrastructure that lets developers process sensitive data without ever having to see it in plaintext. The pace, craft, care, and ambition you bring to work every day are what makes this company what it is.

And thank you to our new investors for believing in the vision of making security architectural rather than procedural. We’re grateful to have partners who understand both the scale of the problem and the opportunity ahead.

The internet still assumes that sensitive data must exist in plaintext somewhere. We’re building the infrastructure to change that.

Onwards!

More here 👉 https://t.co/djNIWoQbGM

[Evervault @evervault]

Skimmers are evolving. So should your defenses. Evervault Page Protection prevents card data breaches at the source—right in your checkout.

+ It covers PCI DSS 4.0 requirements 6.4.3 and 11.6.1. So you can sleep—and audit—better. Sign up for free today.

https://t.co/StUmZ6lp4t

[j0hnh @johthn]

Sweet 👌 with EPSS and Known Exploited tags already built in - https://t.co/KTwH1AAJH8 @enisa_eu

[j0hnh @johthn]

@IrishRail @TFIupdates Are darts still running to Malahide.

[Shane Curran @arcurn]

In the past few months, we've hosted a few dinners & table talks on network tokens.

The common theme is that they're interesting, but the value and implementation details are 𝘷𝘦𝘳𝘺 unclear. Join our webinar on December 4 to hear some practical tips!

https://t.co/7leHBGaHZN

[Evervault @evervault]

https://t.co/Ubk5XTw59O

[Evervault @evervault]

🥁🥁🥁🥁

Introducing Evervault 3D-Secure, refreshingly modular and performant

[j0hnh @johthn]

@GRtweets7 @IrishRail Which in turn screws up all the darts southbound during peak rush hour... I hope someone is analysing the knock on effects of the changes. E.g. Darts are inaccessible by the time they get to Raheny.

[Mike Hudack @mhudack]

These guys helped us solve a really fundamental problem in building @SlingMoney and we're grateful for it. Evervault is a great product, a great service, a great company.

[Shane Curran @arcurn]

Excited to announce @Evervault's new payments security platform!

We're letting companies control their own payment data without the security and compliance headaches, so they're not locked in and can avail of the huge range of processing choices.

https://t.co/HRRYzHoR1g

[j0hnh @johthn]

@markofu @evervault We're two for two :D (don't mind those little grey lads, burn off in no time )

[j0hnh @johthn]

Summer's back @evervault

[j0hnh @johthn]

@tonyohalloran @evervault Certainly was - hope all is well !

[j0hnh @johthn]

@HazelConway17 @evervault He came by 5 mins later. #shutswindow

[j0hnh @johthn]

@markofu @jaycee001 Christ it's been bad recently.