Zane Starr 🌠

NFTs @1o1art, Founder of lvls, co-founder of @open_rpc, prev: @etc_core, @consensys, @cellarius2084 and others... | Open Source acolyte

[Zane Starr 🌠 @zanecstarr]

@danfinlay Best of luck on your next journey, you materially moved the entire ecosystem forward, enjoy the rest and reset!

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Zane Starr 🌠 @zanecstarr]

Privacy is much needed indeed! Check out this open call.

[gccofficial @GCCofCommons]

https://t.co/hZMs9manVC

[Zane Starr 🌠 @zanecstarr]

This is an interesting take on the various crypto legislation being passed and how the future of the dollar is changing

[Crypto Zach @CryptoZach]

The secret fight over Dollar 3.0 is happening RIGHT NOW in Congress.
Most people will sleep through it…
and wake up in 2035 wondering why their money works completely differently.
Here’s exactly what’s on the table. ↓
Dollar 1.0 = gold & silver
Dollar 2.0 = bank IOUs (your checking account)
Dollar 3.0 = tokenized, always-on, borderless USD
We’re deciding its final shape in the next 6–12 months.
This is bigger than the entire @federalreserve put together.
1/10 🧵

[EF Ecosystem Support Program @EF_ESP]

1/ 🎊 Grant Announcement: OpenRPC!

Co-funding a 6-month sprint to update @open_rpc, making it easier for developers, tooling, and infrastructure providers to build on Ethereum with consistent, open standards.

https://t.co/XpMnH5LOwS

[Zane Starr 🌠 @zanecstarr]

I think this 💯 , I think crypto stays insular and doesn't reach, because of the culture and this docuseries can help change that. I'd be excited to watch it!

[Nataliecrue.eth @NatalieCrue]

If we are to onboard and welcome the next billion participants to @ethereum, we need to produce content that is 👉🏾
free of jargon
amplifies diverse voices/experiences
meets ppl where they’re at
moves away from hype x pseudo celeb driven content
is entertaining and
accessible

[Nataliecrue.eth @NatalieCrue]

@OctantApp opened its allocation window for epoch 9 last week

Please consider allocating to projects like mine that will interface with local communities, amplify builders, and tell the story of Ethereum’s communities across the globe

Learn more here: https://t.co/rVCxbjxivP

[Zane Starr 🌠 @zanecstarr]

Creating benchmarks for multiturn data is a bit tricky, I find myself thinking about data in ⏪, working from the result to question or entrypoint, to then try and train the llm to go in the forward direction 😃

[Zane Starr 🌠 @zanecstarr]

@AdamClery just didn't age well T_T . I cann't believe how open PSG are

[Zane Starr 🌠 @zanecstarr]

@jxnlco It seems like static code analysis essentially does what rag would do but better, bc the context is more precise like you can walk a dependency tree and chuck that into your context. I think RAG is like you mentioned is good when you can't exploit code structure

[Zane Starr 🌠 @zanecstarr]

⚡️when we gen. code w/ prompts we're, really creating iterative prompts that work around the limits of transformer attention, by storing context out of band in the form of code edits. Then we prompt again with a fresh improved context via static analysis.

[Zane Starr 🌠 @zanecstarr]

Waging "war" on our own people in LA and other cities with ICE, and then bombing Iran without cause, this administration can do better, the US and world deserve better than this.

[Zane Starr 🌠 @zanecstarr]

I like the idea of this but for code, and maybe you could take incremental commits to build a world model for code. Then we wouldn't need to bootleg it each time as we prompt in claude/gpt etc... . It would be able to predict the future impact of code changes aka architect

[AI at Meta @AIatMeta]

Introducing V-JEPA 2, a new world model with state-of-the-art performance in visual understanding and prediction.

V-JEPA 2 can enable zero-shot planning in robots—allowing them to plan and execute tasks in unfamiliar environments.

Download V-JEPA 2 and read our research paper ➡️ https://t.co/E61VLtKgZT

[Zane Starr 🌠 @zanecstarr]

@Yuchenj_UW Not quite doesn’t scale hire contractors to fill in expert knowledge gaps to produce higher quality data points that are hard to get, also the fine tuning api is actually quiet good, it’s not a consumer facing acquisition imho

[Zane Starr 🌠 @zanecstarr]

😎Super cool donation opportunity, a friend of mine is going to the Derby World Cup with an Indigenous Rising, a flat track roller derby team representing Native America, First Nations, and Polynesia https://t.co/w3v3mMmUFm

[Zane Starr 🌠 @zanecstarr]

@ziv_ravid @ChenShani2 @ylecun @jurafsky That perhaps what is typical from the 70s US based study is not a typical bird in say India or the UK, which the llm presumably would have a broader base of data that would compose its possible set of embeddings 🤔

[Zane Starr 🌠 @zanecstarr]

@ziv_ravid @ChenShani2 @ylecun @jurafsky This was interesting, but it feels like for the original studies that measure typicality, that you'd have so bias in what is typical, that there'd be non-stationarity in the data that the distribution of typical for the llm might be different is this accounted for?

[Zane Starr 🌠 @zanecstarr]

@AustinBeaulier this is sick 🔥

[Zane Starr 🌠 @zanecstarr]

👀 check it out pretty dope, could use it to preload an execution env. so an llm can generate code to interact in it. Offhand it could do interesting things in a custom user based env. A way to give llms async worker lvl access in a sandbox, it could read s3 direct even...

[Shane Jonas @shanejonas]

I made an Open Source MCP Server to run javascript inside a sandbox .

It uses SES (Secure Ecmascript) you haven't seen it, an Apache 2.0 licensed javascript sandbox from agoric.

It is also the underlying tech to securely sandbox metamask snaps.

https://t.co/uEYEu9OKd7

[Zane Starr 🌠 @zanecstarr]

@joodalooped exact same thoughts, plus the still frame opener looks ai generated