Rohit Kumawat

[Abhinav Sharma @Abhinavs1920]

@CloudflareDev @Cloudflare

[Abhinav Sharma @Abhinavs1920]

Sorry @GeminiApp , but it's the TRUTH.

[Sonam Wangchuk @Wangchuk66]

I’m Not in good shape but not so bad either...
Rather than asking me to break my fast please join me on 20th July... Peaceful March to the Parliament.

#cockroachjanataparty #jantarmantar #cjpprotest #chalosansad

[Justine Moore @venturetwins]

Me using Claude Opus 4.8 to rename a file

[starmex @starmexxx]

NVIDIA QUIETLY DROPPED A $249 BOX THAT REPLACES YOUR $200/MONTH OPENAI SUBSCRIPTION WITH $2 IN ELECTRICITY

it's called the jetson orin nano super. smaller than a wallet, runs at 25 watts, does 70 trillion ai operations per second. runs llama 3, mistral, gemma and deepseek locally with no api fees and no data leaving your house

a developer running automations and coding assistants pays $200 a month to openai. the same workload on this box costs $2 a month in electricity and breaks even in 10 weeks

install ollama with one command. change one line in your code. point it at localhost instead of openai. everything else works identically

7 billion parameter models handle 80% of what people use chatgpt for. summarization, drafting, coding, document q&a, automation pipelines. total monthly cost drops from $200 to $22

cloud subscriptions keep getting more expensive and rate limits keep getting tighter. the people who set this up in 2025 are going to look very smart in 2027

bookmark this and read the article below

[Anatoli Kopadze @AnatoliKopadze]

the engineer who built Claude Code just dropped a 28-minute video on how to write prompts that actually work

I've seen $300 courses that don't cover what he shows in the first 10 minutes

CLAUDE.md files, memory shortcuts, parallel sessions, prompting patterns

all in one video and completely free

works whether you're a developer, a beginner, or someone who's been using Claude for months

based on this, I put together 18 things you can copy and use in Claude today

full guide in the article below

[Shikhar @shekhu04]

Wait… cartoons were NOT lying about this effect 😳😂

coolest shit I saw today

[Tuki @TukiFromKL]

🚨 Andrej Karpathy just explained the scariest thing happening in software right now..

someone poisoned a Python package that gets 97 million downloads a month.. and a simple pip install was enough to steal everything on your machine..

SSH keys.. AWS credentials.. crypto wallets.. database passwords.. git credentials.. shell history.. SSL private keys.. everything..

and here's the part that should terrify every developer alive..

the attack was only discovered because the attacker wrote sloppy code.. the malware used so much RAM that it crashed someone's computer.. if the attacker had been better at coding.. nobody would have noticed for weeks..

one developer.. using Cursor with an MCP plugin.. had litellm pulled in as a dependency they didn't even know about.. their machine crashed.. and that crash saved thousands of companies from getting their entire infrastructure stolen..

Karpathy's take is the real wake up call.. every time you install any package you're trusting every single dependency in its tree.. and any one of them could be poisoned..

vibe coding saved us this time.. the attacker vibe coded the attack and it was too sloppy to work quietly.. next time they won't make that mistake.

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[codemuggle @monatwt_]

it’s actually crazy how this works

a contract lets you withdraw…

but before it updates your balance, you just call it again
and again
and again
and it keeps sending you money like nothing’s wrong

that’s literally a reentrancy attack!

what messed with me is how normal the code looks at first glance
you don’t see the bug until you really trace the flow

finally understood it properly while going through @CyfrinUpdraft, so I made a quick breakdown:

https://t.co/kvZRyV52Au

would you have caught this?

#Web3 #SmartContracts

[Vaishnavi @_vmlops]

The only system design repo you really need

https://t.co/wQwFXKzl2i

[codemuggle @monatwt_]

If you're learning Solidity in 2026 and not studying smart contract security, you're doing it wrong.

Exploits don't happen because devs are bad.

They happen because devs don’t think like attackers.

Cyfrin’s Updraft platform has some great material on this.

Security must be 1