Martín Pérez

Remando en

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Tinybird @tinybird]

We built Learn ClickHouse. 80+ lessons covering ingestion, querying, optimization, and distributed architectures.

Not just tutorials. Production-ready patterns from teams running ClickHouse at scale.

Free. No fluff.

👉 https://t.co/IoKL5t6vGT

[Martín Pérez @mpbrenlla]

Si estás usando opencode y has sufrido el bloqueo de Anthropic sobre tu suscripción Pro/Max te recomiendo 2 modelos open source muy resultones:
M2.1 de @MiniMax_AI y GLM 4.7 de @Zai_org

[Martín Pérez @mpbrenlla]

Por favor, dejad ya de hacer tuits que empiecen por "This guy literally explains ..." #manliterallysplaining

[Daily Dose of Data Science @DailyDoseOfDS_]

Neural network visualized!

[Martín Pérez @mpbrenlla]

@ggdaniel ¿has probado Discord? Puedes segmentar a tus clientes en canales privados dentro de tu propio servidor

[Khan Academy @khanacademy]

Did you hear? @OpenAI's newest model can reason across audio, vision, and text in real time.

How does GPT-4o do with math tutoring?🤔

@salkhanacademy and his son test it on a Khan Academy math problem.

You can get AI-powered math tutoring right now with Khanmigo: https://t.co/bPyjkvll4h

[éutika @somoseutika]

Os explicamos en un pequeño vídeo algunas de las funcionalidades básicas de eugenIA:

- subir documentos y elaborar resúmenes guiados por la IA
- obtener citas del documento que responden a preguntas sobre el documento

[David Ding @DavidDingAI]

Definitely did not intend to create a standup comedy model!

[Thoughtworks @thoughtworks]

The latest edition of the radar — volume 30 — is out!

Check it out: https://t.co/YQrLhMes5Q

#TWTechRadar

[Martín Pérez @mpbrenlla]

@dalareo @andresaco allí te esperamos

[Martín Pérez @mpbrenlla]

@ivanguardado Y además tenemos el dominio libre ...

[LlamaIndex 🦙 @llama_index]

Introducing LlamaCloud 🦙🌤️

Today we’re thrilled to introduce LlamaCloud, a managed service designed to bring production-grade data for your LLM and RAG app.

Spend less time data wrangling and more time on application logic. Launching with the following components:

1️⃣ LlamaParse 📑: a proprietary parser designed to be really really good at complex documents with embedded tables. Build advanced RAG over semi-structured PDFs, and ask questions that simply aren’t possible with the naive stack. Available publicly day 1 🔥

2️⃣ Managed Ingestion/Retrieval API ⚙️: An API letting you easily ingest/retrieve data from data sources. Opening up in private beta to select enterprises.

We’re excited to be joined by launch users, partners, and collaborators:
@mendableai
@DataStax
@MongoDB
@qdrant_engine
@nvidia
+ some awesome hackathon projects at the @llama_index hackathon

Check out our FULL blog post on LlamaCloud and LlamaParse: https://t.co/FGI99qC3lk
LlamaParse Client Repo: https://t.co/NldQN580hl
Signup for a LlamaCloud account to use LlamaParse: https://t.co/yQGTiRSNvj
Interested in the broader LlamaCloud offering? Come talk to us: https://t.co/ek65coieav
Also we have a slick new website 🌐: https://t.co/9HrriBpDJj

[OpenAI @OpenAI]

Introducing Sora, our text-to-video model.

Sora can create videos of up to 60 seconds featuring highly detailed scenes, complex camera motion, and multiple characters with vibrant emotions.

https://t.co/YYpOAcrXQ3

Prompt: “Beautiful, snowy Tokyo city is bustling. The camera moves through the bustling city street, following several people enjoying the beautiful snowy weather and shopping at nearby stalls. Gorgeous sakura petals are flying through the wind along with snowflakes.”

[éutika @somoseutika]

Hoy se publica un podcast que hace semanas grabó nuestro querido @dalareo y @psanxiao sobre #educacion #softwarelibre #edtech e #ia

[Martín Pérez @mpbrenlla]

"Betting on an idea — and seeing it through — is enormously fulfilling. The creative and intellectual stimulation is beyond compare. Especially when you're the first customer for anything you make"

[Jason Fried @jasonfried]

I've consulted. I've advised. I've served on boards. I've done client work. I've written books. I've spoken on the circuit. I've blogged for years.

I have to say, I've found no greater professional joy than working with a tight group of people to ship and support our own products. And for those products to find people willing to trade their own hard earned treasure for a little bit of ours.

Betting on an idea — and seeing it through — is enormously fulfilling. The creative and intellectual stimulation is beyond compare. Especially when you're the first customer for anything you make.

When I was a consultant doing work for hire I thought it was the peak. I got to bounce from client to client, sign big contracts, do a lot of work, cash large checks, etc. But then you realize most of what you do is never implemented. Yes, you got paid for it, but it was just advice, recommendations, and suggestions. Words on pages that were received, but not really read. Designs in files that were delivered, but never really deployed. There was nothing there in the end. You didn't get to make any bets, you just played with someone else's chips.

You thought you were changing things. Changing them. But it wasn't change, it was an exchange. You handed it over, they handed you something in return, and that was that.

I'm glad I went through it, otherwise I wouldn't have known it.

Been giving other people advice for years? Give yourself the advice and see if it's any good. Meet the market.

Go make something. Join a team that's making something. Put your fingerprint on something that won't just sit on the shelf somewhere.

[Martín Pérez @mpbrenlla]

Primer día de entreno después de una semana de gripe

[Martín Pérez @mpbrenlla]

¿Ya es 2024?

[Martín Pérez @mpbrenlla]

@ivanguardado Un café mañana? 😂

[Martín Pérez @mpbrenlla]

@ivanguardado Chegoume o welcome pack