Gaurav Sehrawat @Root3d

Actually - no. This is why every and any sane software engineer uses 1) Utc timestamps (no daylight savings) or Epoch time (timezone independent) 2) Date libraries to render dates that take care of local conversion and pesky things like daylight savings

Rhys @RhysSullivan

2 weeks ago

a million software engineers just felt a disturbance in the force

41 22 999 226K 50

Sad to see #netherlands out of world cup.

"what if we spent our marketing budget on musicians instead"

Gave google omni a sketched camera path and asked it to generate drone POV footage.

I have shut down my 100 crores course business. And converted it into a subscription! Between making more money and helping more people - the choice was super clear to me! WebVeda now gives access to ALL courses, for the price of one course. As a WebVeda member you will get: - ALL courses, present and future (we add a course every day, every week, every month) - An exclusive members-only community - Personalized jobs based on your skills
 100% refund policy, as always. Skills. Community. Jobs. Growth as a subscription.

All 5 lakh existing WebVeda students have been upgraded to the membership for FREE. I want every person in this country with a phone and an internet connection to have the same learning, networking and job opportunities in life as someone born into privilege. Where they were born, how much they earn, what language they speak - none of such things should ever matter.

My mom called. Apparently the neighbor’s son just launched a context company. She wanted to know: if everyone is saying they do context now, what makes ours different? Fair question. This is my answer. 👇 On April 29, we're not just explaining the context layer. We're building one live. No slides. The real thing.

Claude Code is absolutely incredible but have you tried going outside?

keyboard_arrow_left Previous keyboard_arrow_right Next

Introducing Claude Managed Agents: everything you need to build and deploy agents at scale. It pairs an agent harness tuned for performance with production infrastructure, so you can go from prototype to launch in days. Now in public beta on the Claude Platform.

Bangalore has better landscape than Delhi!!

If you use GitHub (especially if you pay for it!!) consider doing this *immediately* Settings -> Privacy -> Disallow GitHub to train their models on your code. GitHub opted *everyone* into training. No matter if you pay for the service (like I do). WTH github.com/settings/copil…

Someone just poisoned the Python package that manages AI API keys for NASA, Netflix, Stripe, and NVIDIA.. 97 million downloads a month.. and a simple pip install was enough to steal everything on your machine. The attacker picked the one package whose entire job is holding every AI credential in the organization in one place. OpenAI keys, Anthropic keys, Google keys, Amazon keys… all routed through one proxy. All compromised at once. The poisoned version was published straight to PyPI.. no code on GitHub.. no release tag.. no review. Just a file that Python runs automatically on startup. You didn’t need to import it. You didn’t need to call it. The malware fired the second the package existed on your machine. The attacker vibe coded it… the malware was so sloppy it crashed computers.. used so much RAM a developer noticed their machine dying and investigated. They found LiteLLM had been pulled in through a Cursor MCP plugin they didn’t even know they had. That crash is the only reason thousands of companies aren’t fully exfiltrated right now. If the code had been cleaner nobody notices for weeks. Maybe months. The attack chain is the part that gets worse every sentence. TeamPCP compromised Trivy first. A security scanning tool. On March 19. LiteLLM used Trivy in its own CI pipeline… so the credentials stolen from the SECURITY product were used to hijack the AI product that holds all your other credentials. Then they hit GitHub Actions. Then Docker Hub. Then npm. Then Open VSX. Five package ecosystems in two weeks. Each breach giving them the credentials to unlock the next one. The payload was three stages.. harvest every SSH key, cloud token, Kubernetes secret, crypto wallet, and .env file on the machine.. deploy privileged containers across every node in the cluster.. install a persistent backdoor waiting for new instructions. TeamPCP posted on Telegram after: “Many of your favourite security tools and open-source projects will be targeted in the months to come.. stay tuned.” Every AI agent, copilot, and internal tool your company shipped this year runs on hundreds of packages exactly like this one… nobody chose to install LiteLLM on that developer’s machine. It came in as a dependency of a dependency of a plugin. One compromised maintainer account turned the entire trust chain into a credential harvesting operation across thousands of production environments in hours. The companies deploying AI the fastest right now have the least visibility into what’s underneath it.

Andrej Karpathy @karpathy

4 months ago

Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database

1K 5K 28K 66.6M 14K

Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

Daniel Hnyk @hnykda

4 months ago

LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below

305 2K 9K 5.9M 3K

This is why vintage engineering still scares modern tech

People are the big assets in this AI world, company's low performance/low performance is because of past choices and firing people won't fix it.

The Maps driving experience is also evolving with Immersive Navigation, featuring clearer visuals and intuitive guidance. You’ll be able to see the buildings, overpasses and terrain around you in a vivid 3D view, made possible with help from Gemini models. You’ll also be able to: 👀 See more of your route to prepare for what’s next. 🤔 Understand tradeoffs for alternate routes to pick what works best for you. 🛣️ Arrive easily with helpful details like parking and entrance information. Immersive Navigation starts rolling out today across the U.S. and will expand in coming months to eligible iOS and Android devices, CarPlay, Android Auto and cars with Google built-in.

I come back to this video every once in a while...

We just demoed fully working pull payments on @SUPRA_Labs . One-time. Subscriptions. On-chain. No UX hacks. Here’s what we built → Users connect once, set a mandate → Merchants define charge intervals daily, weekly, monthly, custom → Users see every active mandate in one dashboard → Cancel anytime. No contract. No custody risk. Web3 has had push payments forever. Pull payments, which power every SaaS, every subscription, every recurring bill, have been basically unsolved. Until now. We’re already integrating with 3 projects inside the Supra ecosystem. EVM, Solana, and multi-chain support is coming. We’ve abstracted away wallet connection friction, gas complexity, and the web3 UX nightmare, now merchants just ship, and users just pay. This is what Stripe + Visa/Master infrastructure looks like for stablecoins. Kudos to the team @RibbitWallet @nkaushal02 @Chatterjee_arn @RidhiOnChain @AdityaJyoti02

Today is my ONE month anniversary of me being on break, tinkering and being with family, friends and with myself. I had written an exit post, but then I converted that to blog, edited it, and finally published it here. Here is what it feels like. ajeygore.in/content/the-sp…

Every 6 months there is some major AI disruption! More to come infinitely.

@amitiitbhu Interested! And looking forward.