Max Conradt

Hierarchical discrete state transition engineer / enthusiast. Making money move at the speed of light.

[Max Conradt @max_conradt]

PSA: Virtually no software written in SF should run directly on any machine / process with access to sensitive credentials.
Always run it in a VM, Docker container, web browser, etc.
People here care about "shipping" — not InfoSec — until it's too late.
Sorry Guys, It's Over 🫡

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Max Conradt @max_conradt]

@jacobvcreech

[Max Conradt @max_conradt]

Fable 5 sounds like the name of a spaceship or solar system

[Max Conradt @max_conradt]

SF Bay Area and LessWrong coded

[Yekyung Kim @YekyungKim]

Qualitatively, humans tend to use more specific and concrete sub-arguments, while LLMs more often reuse generic evidence, abstract reasoning, and hedged claims.

[Max Conradt @max_conradt]

San Francisco and South Korea becoming increasingly alike

[Max Conradt @max_conradt]

@acuriocabinet @pangram ai?

[Max Conradt @max_conradt]

Deprecate your JSON RPC today!

[Max Conradt @max_conradt]

Crypto traders launch new memecoins called "crypto" every week or two to figure out how they collectively feel about crypto

[Max Conradt @max_conradt]

Billboard on the 101 into SF: Get paid or get the fuck out

[Max Conradt @max_conradt]

Has anyone left Anthropic to OpenAI?

[Max Conradt @max_conradt]

@willdepue @shakoistsLog Relevant reading: https://t.co/b7cKIjxcua

[Dirty Texas Hedge @HedgeDirty]

A GENTLEMAN’S PRIMER ON SHORTING INSOLVENT SHITCOS

So you’ve found a ShitCo. It’s such an ugly zombie it couldn’t be an extra in season 19 of The Walking Dead
But it’s still got a $185m cap
And you want to be the one to mung the last rancid, putrefying drops out of that corpse

[Max Conradt @max_conradt]

@willdepue Do you think that's why crypto prices have fallen?
I think the answer is "no" and you shouldn't feel stupid for not betting on a move that hasn't happened yet.
If this risk materializes, crypto will decline further.

[Max Conradt @max_conradt]

We're currently living in a hyper-Girardian moment

[Max Conradt @max_conradt]

In SF there are a few thousand people with >$10B in collective total compensation who are all building agent harnesses and productivity software for themselves right now. These are probably the easiest forms of software to build using AI.

[Max Conradt @max_conradt]

How do you make a market here?

[Max Conradt @max_conradt]

What the fuck

[Max Conradt @max_conradt]

At >5x this might be a share class difference but people can make financial mistakes (like unknowingly buying SpaceX at $10T). First issuance was around $240 9 months ago, the rest has been at around $700 over the past 3-4 months, $5M total.

[Max Conradt @max_conradt]

A lot of people on here really like levered beta

[Max Conradt @max_conradt]

Time to get insured so I can take maximum risk

[Max Conradt @max_conradt]

@kc_srk Neat, thank you!