Henry AT

Software Engineer, interested in Mobile Applications, IoT and ML

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Mayor @mayorxbt]

https://t.co/CeVnTfHA7B

[Dhairya @dkare1009]

MIT offers 12 Books on AI & ML (FREE TO DOWNLOAD):

1. Foundations of Machine Learning
https://t.co/VjLctBgzJ7

2. Understanding Deep Learning
https://t.co/93yQadAkyi

3. Algorithms for ML
https://t.co/FdyVDGVuEG

4. Reinforcement Learning
https://t.co/ISdcSdKu0V...

5. Introduction to Machine Learning Systems
https://t.co/0lWm6uHRUM…

6. Deep Learning
https://t.co/tOUkNlN75w

7. Distributional Reinforcement Learning
https://t.co/ixgPQJdbp1…

8. Multi Agent Reinforcement Learning
https://t.co/LtCdPLjUd4

9. Agents in the Long Game of AI
https://t.co/ixgPQJdbp1…

10. Fairness and Machine Learning
https://t.co/Ynuat7qxSX

11. Probabilistic Machine Learning

❯ Part 1 : https://t.co/rO5pFBf8Ek…
❯ Part 2 : https://t.co/dfHX0VHY28…

[Henry AT @yiperu]

@Frospigliosi Jajajaja, pasaras a la historia como el personaje mas Incongruente, incoherente, discordante, inconsistente, disonante mejor ser disparatado 😂 🤣.

[Alex Febrero @AlexFebrero_]

Mientras nosotros dormíamos muy cómodos, los familiares de las víctimas de la represión de Dina Boluarte, han hecho vigilia frente al Palacio de Justicia durante 2 días seguidos en el suelo. Aguantaron el frío, el maltrato, la injusticia y siguen luchando.

¡Ni olvido, ni perdón!

[Henry AT @yiperu]

segundo 25, Amelancolizar 🥹

[Henry AT @yiperu]

LOL, using the tongue for other things.

[Augmental @augmentaltech]

Today, we unveil the first public demo of the MouthPad^: smart mouthware for hands-free computer control.

Witness Corbin swiftly navigate Google Maps on his phone using only subtle tongue movements.

Cursor control, clicks, and swipes: full access.

[Víctor García Guerrero @VictorGGuerrero]

El niño carga agua en un carrito de bebé. Alguien grita entre las ruinas, el gato escapa y los drones acechan. El apocalipsis en Gaza no es una película.

[Henry AT @yiperu]

Ray-Ban Meta Smart Glasses look great, new forms of interaction are going to be consolidated

[Marques Brownlee @MKBHD]

I've been trying Meta smart glasses' new multimodal AI - while it's pretty basic right now, it's still sick to see it combine what it sees from the camera with the language model to describe what it's seeing! Already solid for accessibility

Full episode: https://t.co/f8zFYUbZ9T

[Henry AT @yiperu]

@Ojo_Publico @arivme Ojala se haga justicia algún día. R.I.P.

[Henry AT @yiperu]

Huaoooo 😱

[Sundar Pichai @sundarpichai]

Seeing some qs on what Gemini *is* (beyond the zodiac :). Best way to understand Gemini’s underlying amazing capabilities is to see them in action, take a look ⬇️

[Henry AT @yiperu]

This is going to revolutionize the way we interact with the world. With you "AI Pin"

[Daily Loud @DailyLoud]

UPDATE: Jay-Z is officially back on Instagram. Both him and his wife Beyoncé only follow each other 👀❤️

[Henry AT @yiperu]

@LearningToan @Stanford learn

[Charly Wargnier @DataChaz]

Here are the 10 #ChatGPT plugins currently available in the @OpenAI Plugin Store:

1 - Speak
2 - Shop
3 - Expedia
4 - Zapier
5 - Wolfram
6 - Milo Family AI
7 - Instacart
8 - Klarna Shopping
9 - Kayak
10 - OpenTable

↓

[Henry AT @yiperu]

@marquitus_dev @jcfmunoz 🤣🤣🤣🤣🤣

[Ben Phillips @benphillips76]

A clip from Don’t Look Up, and then a real TV interview that just happened

[Paul Hudson @twostraws]

What's new in Swift 5.6? Existential any, type placeholders, CodingKeyRepresentable, #unavailable, and more!

- Read the full article here: https://t.co/QbpD54FCqj
- Try the Xcode playground: https://t.co/c1moDoi9XY
- Compare all Swift versions: https://t.co/fCyhWJgMuI