therealpatrón

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Not Jerome Powell @alifarhat79]

Democrats watching Elon and Trump fighting right now

[Geiger Capital @Geiger_Capital]

Watching the richest man alive and the most powerful man in the world go head-to-head

[therealpatrón @therealpatron]

@0xJsum Certified scammer.

[Andrew 10 GWEI @Andrey_10gwei]

The @solayer_labs team wallets received at least a 6-figure amount of the $Layer airdrop.
Solayer = ScrollScam 2.0?

Team wallets holding hundreds of thousands of $Layer from the airdrop, tokens worth millions of dollars sold on the market by the team, and deception in tokenomics (3.6% instead of the promised 12% for the Genesis Airdrop).

How did the project team, backed by @yzilabs and @polychain , deceive everyone?

This will be a long thread with all the evidence. ->>

@lxjhk @0xJsum @SolayerFdn

[therealpatrón @therealpatron]

@open4profit It’s a scam.

[Andrew 10 GWEI @Andrey_10gwei]

The @solayer_labs team wallets received at least a 6-figure amount of the $Layer airdrop.
Solayer = ScrollScam 2.0?

Team wallets holding hundreds of thousands of $Layer from the airdrop, tokens worth millions of dollars sold on the market by the team, and deception in tokenomics (3.6% instead of the promised 12% for the Genesis Airdrop).

How did the project team, backed by @yzilabs and @polychain , deceive everyone?

This will be a long thread with all the evidence. ->>

@lxjhk @0xJsum @SolayerFdn

[Nik Stankovic @nikstankovic_]

I'm dying

[Joe Rogan @joerogan]

@elonmusk If you buy MSNBC I would like Rachael Maddow’s job. I will wear the same outfit and glasses, and I will tell the same lies.

[Elon Musk @elonmusk]

Deregulation and reducing government spending leads to prosperity

[Elon Musk @elonmusk]

Last night with @realDonaldTrump & @JMilei

[Arnaud Dyevre @ArnaudDyevre]

I just read the paper in full; it is even more spectacular than I initially thought.
A short thread about the results and their significance.

[Elon Musk @elonmusk]

Great speech by @nayibbukele!

[Raoul Pal @RaoulGMI]

Holy shit.

[Sahil Bloom @SahilBloom]

In 2009, Stanford business professor Tina Seelig split her class into groups and issued a challenge:

Each group had $5 and 2 hours to make the highest return on the initial money.

At the end, they'd give a short presentation on their strategy.

The results were fascinating...

Most of the groups followed a basic approach:

• Use the $5 to buy a few items.
• Barter or resell those items.
• Repeat
• Sell final items for (hopefully) more than $5.

These groups made a modest return on their initial $5.

A few groups ignored the $5.

They thought up ways to make the most money in the 2 hours of allotted time:

• Made and sold reservations at hot restaurants.
• Refilled bike tires on campus for $1 each.

These groups made a better return on their initial $5.

The winning group took an entirely different approach.

They had three core realizations:

1. The $5 was nothing more than a distraction.

2. The 2 hours of time was not enough to make an attractive, outsized return with a mini-business (like selling restaurant reservations or filling bike tires).

3. The most valuable "asset" was actually the presentation time in front of a class of Stanford students.

Realizing the value of this hidden asset, they offered the presentation time to companies looking to recruit Stanford students.

They struck a deal to sell the time slot for $650, netting a monstrous return on the $5 of initial capital.

The losing groups thought in linear, logical terms and achieved a linear, logical outcome.

The winning group thought differently.

So, what can we learn from this story?

There are two types of problems:

1. Low-Stakes: Lower potential, linear rewards. Decisions are easily reversible.

2. High-Stakes: Higher potential, asymmetric rewards. Decisions are not easily reversible.

With low-stakes problems, given the reward potential is low and the decisions are easily reversible, we can use shortcuts and heuristics to choose our path. We can take a logical, linear approach.

With high-stakes problems, the high, asymmetric reward potential means we need to think differently. We want to take a creative, non-linear approach.

Three steps to start thinking differently:

Step 1: Avoid the Distraction

There will always be an "obvious" solution that is simple, clear, and entirely wrong.

In the challenge, the $5 was nothing more than a distraction. It was a trap.

To find the best path, you have to avoid the distraction.

Step 2: Ask Foundational Questions

Ask and answer questions that expose and vet underlying assumptions and logic.

• What's the real problem you are trying to solve?
• What's your hypothesis? Why?
• What are your core assumptions? Why?
• What evidence do you have?
• What are your core options?
• What alternatives exist?

This takes time, but it's an essential exercise when facing a problem with the potential for non-linear rewards.

Step 3: Select the High Leverage Approach

Slow down and evaluate the options on the table.

Select the path most likely to generate the asymmetric, attractive risk-adjusted returns.

If the story teaches us one thing, it's this:

Creative, non-linear, asymmetric thinking generates creative, non-linear, asymmetric outcomes.

If you enjoyed this or learned something, follow me @SahilBloom for more in future.

[Alex Cohen @anothercohen]

Lead engineer joining the sales rep on a client pitch

[Not Elon Musk @ElonMuskAOC]

I spent $44 billion for this app and now Lizard boy just decided to hit copy and paste.

It’s personal now.

See you in the cage, Zuck.

[Bill Ackman @BillAckman]

I have learned from experience that the experts, the government, and conventional wisdom are often wrong. ‘Inflation is transitory.” “C19 did not escape from the Wuhan lab.” “@Ukraine will fall in less than a week.” “Its not possible because it hasn’t been done before or because it hasn’t happened before.”

It is often the outlier with no experience in a field that challenges the status quo, that makes the important discovery, that has the unique insight, or creates the transformational innovation.

@elonmusk was not an expert in payments, electric cars or rockets. The ‘experts’ were at Visa, GM and NASA.

When you are part of the establishment, it is hard to challenge the conventional wisdom. You are incentivized not to. And when your economic livelihood can be threatened by an alternative point of view or a new innovation, you are less likely to believe it or its viability.

The greatest opportunities for discovery, innovation, understanding, and profits often exist in the unexplored paths, the unasked and unanswered questions, and in the improbable possibilities.

Our best investments have been: (1) in the stock of a real estate company going bankrupt, (2) from betting that a triple-A rated company was insolvent, and (3) betting that a virus in China would cause a global economic shutdown.

Each of these investments were met with extreme skepticism at the time they were made. In each case, we were the naive ones when we made these investments. We were not bankruptcy investors, experts in bond insurers or credit default swaps, nor did we know anything about viruses or pandemics.

From my experience, knowledge is advanced and insights are gleaned by studying alternative points of view from conventional and unconventional sources of information, and by not discrediting a point of view simply because it comes from someone who is not an accredited member of the relevant establishment, who does not have an advanced degree in the subject at hand, and/or someone whom has been criticized in the media.

In an effort to get to the truth, I try to keep my mind open to alternative possibilities and weigh them against each other. I often find that truth can emerge when two or more articulate and intelligent individuals in an open forum discuss and debate a controversial subject and are required to address unscripted questions from a knowledgeable audience or moderator.

The above is why I added to the pot in attempting to convince @PeterHotez to discuss vaccines with @RobertKennedyJr on @joerogan. I think knowledge will emerge from the discussion that will catalyze further explorations or investigations that will bring us closer to the truth and help us answer questions about vaccine efficacy and safety that remain unsettled for many. And if @PeterHotez is not the best or most knowledgeable advocate for vaccines, then we should find another one.

In getting to the truth, I want to hear from the greatest skeptics and advocates. Both deserve a platform on the path to truth.

And no, I am not an anti-vaxxer.

[Fabrizio Romano @FabrizioRomano]

Messi: “If it had been a matter of money, I’d have gone to Arabia or elsewhere. It seemed like a lot of money to me”, told MD. 🚨🇦🇷 #Messi

“The truth is that my final decision goes elsewhere and not because of money”.

[Balaji @balajis]

This is what people don’t get.

The unfortunate truth is that China is the #1 trade partner for most of the world.

So the US is not negotiating from a position of strength.

If forced to choose, countries may decouple all right…but from the US!

[Mario Nawfal @MarioNawfal]

Trump just posted this video making fun of DeSantis. I have to admit, I couldn't stop laughing😂

Trump spaces soon?