FreeStyle

Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

"I'm not a creative person." No, you are, everyone is, but your mind is just clogged by all of the podcasts and social media you ram into it without properly digesting it. You're conditioned to believe you can only take a certain path in life, and you don't daydream or entertain stupid ideas that could set you on an entirely new trajectory. You're so obsessed with being productive and efficient that you feel like you're always falling behind, and that stress prevents you from thinking outside the box. You need to slow the fuck down, allow yourself to be bored (actually bored, not so overstimulated that you find enjoyable things boring), and pursue a life that you design, not one that was assigned to you.

We just released Claude Code channels, which allows you to control your Claude Code session through select MCPs, starting with Telegram and Discord. Use this to message Claude Code directly from your phone.

向大家介绍一下即将开源的新玩具 👇 Minis 一款纯手机本地运行的 AI Agent 应用📱 无需注册额外云端账号，无需添置任何新设备，连接你的 AI 订阅直接用你手上的就能完成Manus、OpenClaw的大部分任务。 ✅ 本地虚拟技术 iSH(arm64) ✅ 本地 Browser use ✅ 与 iOS 集成: 分享、健康等 TF 链接见👇

早上好，Minis 有了快捷指令以后，叫醒我早上起床的已经不是闹钟了，而是自动抓取过去12小时的 X Timeline 汇总并播报每日早报音频。 ✅ 全程自动化：设置快捷指令自动化 ➡️ twitter-cli 获取自己的 Timeline ➡️ minis-model-use 调用 TTS ➡️ 自动播报