@mitsuhiko just pin to whatever is tested and works. can always do another release when a new version comes out and you test with it
English
dimd00d
1.6K posts
Once again I will point out that it was a massive mistake to not go with min-ver but go with latest semver compatible instead. People argued that you cannot do minver because users would lose out on important security updates. Now we have people upgrade to security issues instead
Andrej Karpathy@karpathy
Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.
English
@jordan @angryinvesting @PythiaR well, technically, it would be x*(1.3)^26 for half an year, if Dario doesnt take any vacation.
English
“Anthropic is growing 30% week over week. I’m invested in them so I get their financials. The public markets don’t get it because they can’t see it.” Mark Schmehl (Fidelity PM).
English
Guess what, Codex also messed up my slope-based bilateral blur when it ported shaders from GLSL->WGSL.
Left = codex version
Right = restored my intention
English
opencode is a twitch game show company now
m.twitch.tv/ryandavogel?de…
English
@leetllm @mitsuhiko yeah, when the sev0 hits it would be "boy, am I happy that we were so productive". the reviews are there for a reason - someone needs to be responsible and accountable for the code.
English
@mitsuhiko our review processes are the real issue here. they were designed for humans writing maybe 50 lines a day, not agents dumping 500-line PRs every hour. the bottleneck just shifted.
English
There will be more of this. And as much as we're joking about it, we're seeing a massive degradation of code quality right now and we're increasingly only catching it way too late.
English
@zeeg @mitsuhiko im really grateful and happy that all of our staff deeply cares of the quality and the outcomes that we deliver to our clients. maybe we'll all ngmi, but until then we'll just keep going.
English
@zeeg @mitsuhiko oh you sweet summer child :( it is not happening in *my* company and we share the same values as you. but i have fdes working in such companies (F25) where it is happening and we had to move ppl off projects because they just couldnt take it and it was getting close to violence
English
@zeeg @mitsuhiko (again, not about Sentry). what i am talking about is if you are in a org, where you get a PR/day metric - you wont give a shit (as usual) about quality, but now you will be greyharting that metric with impunity, where your peers that do care would be burried under slop PRs.
English
@dimd00d @mitsuhiko its not an issue w/ productivity metrics - they're the right ones - its an issue with the quality of work
there's always multiple ways to achieve a result, but few actually observe on the mechanisms and its mostly social policing at companies to solve code quality issues
English
@jacobferus @mitsuhiko as long as my name is on the commit history - its my code and my responsibility. eventual next model or not
English
@mitsuhiko It doesn’t really matter when the next generation of models will be even better and can clean it up
English
@zeeg @mitsuhiko it does enable them to pretend to be productive though based on imaginary metrics instituted by alot of companies (not saying Sentry is one of them) and possibly thrive :(
English
@mitsuhiko to be fair, in this case it was mostly a team not following corporate policy and writing shit code (it wasnt even all AI generated)
AI doesnt make up for some people being inherently lazy and not caring about their work
English
@blackroomsec Dario has consistently came up with bigger 6-12 predictions about SWE. Two options spring to mind - either AI has no PMF (aside of SWE) and they are pushing the narative to sell more, or they truly believe it and since the genie is out of the bottle - they are talking freely
English
@dimd00d From my own observations I could say that he's been solidly consistent up until 6 months ago. The other Tech CEOs were consistent up until a year and a half ago. What changed?
English
If I were a drug-addled CEO in the tech space who thinks the universe isn't real yet benefits from it existing nonetheless, what batshit crazy thing should I say next to scare people while simultaneously telling my fellow industry leaders, not to scare anyone?
English
@blackroomsec he did bring up the radiologists and the task vs job. honestly - i cant say anything about his actions, or what he *really* believes.
English
@dimd00d But didn't he also say NOT to scare people? What are his actions telling us? Forget his words they mean nothing.
English
@blackroomsec i did watch the whole interview :) this doesnt stop you from anouncing ASI (to scare people) and then say its probably in 6-12 monts (so they shouldnt really be scared just yet)
English
@dimd00d No, he didn't announce AGI. No one actually clicked on the picture to see the byline to clearly says he then walked that statement back because that is not true. In any universe including ours is that true. 🙄 And anyone saying that we did is delusional and requires mental help.
English
great, another video demo company
Brett Adcock@adcock_brett
Today I'm excited to introduce Hark, a new artificial intelligence lab building the most advanced, personal intelligence in the world We've been in stealth for 8 months, assembling one of the greatest AI and hardware teams on the planet I want to explain why I started Hark and what we're focused on I've spent the last 3 years working on the hardest AI challenge imaginable: giving AI a humanoid body. On the digital side, I've been using all the existing LLM chatbots - and I have to say, they feel incredibly dumb to me AGI, in the limit, should feel like a sci-fi movie. It should be able to listen and talk. It should have persistent memory and be highly personalized. It should see and touch the world. But we're far from this today We are crafting a new interface to AGI. Intelligence that lets you offload your mental workload into a system that begins to think like you and sometimes ahead of you We started Hark with one goal: build the world's most advanced personal intelligence - paired with next-generation hardware designed to serve as a universal interface between humans and machines hark.com
English
Well, I'll be keeping CLOSE tabs on that and will report updates.
Indian Tech & Infra@IndianTechGuide
🚨 "I'm not hiring more engineers in fiscal year 2026 because I was using AI coding agents," says Salesforce CEO Marc Benioff.
English