Dr.Nucleux

Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

One day, the Deep State's media and mind control tool called Twitter was dying. Most of the right wing, many of the moderates and independent thinkers were leaving in droves. Especially during 2020 US elections, when everyone saw how Twitter ran itself, before and after the elections, blatantly taking sides. More than half of the US population and tens of millions in the world were no longer influencable suddenly that day. Legacy media propaganda was already no longer working on them, and social media too had become another propaganda tool, so many had realized. The DS had overplayed its hand. It realized it was losing narrative control with more than half the world. That day, they came up with a brilliant idea. To prop up Musk as the right wing, free speech, intellectual & independent thinkers' champion. They got him to buy Twitter & turn it into X. He did that in a jiffy. Twitter was now X. No much regulatory oversight and no issues taking control of such a large and powerful communications platform - more critical than a telecom company for a state. More than 40 billion dollars. A private billionaire was able to simply buy direct reach to hundreds of millions of people and take ownership of - as revealed by many exposes - a govt influenced & Intel agencies backdoored platform. Twitter, now X, was taken private to escape any public scrutiny. Elon could do whatever was asked, and it was blamed on his eccentricites by the DS media. He fired most of the staff. Those who worked with the agencies and government to regulate, throttle, and stifle free speech were gone, he said. Then Elon lets you buy your verification status. Anyone could buy a verification mark over Stripe - another DS infiltrated entity to collect data. X was proclaimed to be a privacy respecting, ultimate free speech platform. All those right wing, centrists, moderates, truly intellectual and independent thinkers came back in droves now. This was further incentivized by revenue sharing to X users. Now, not only do you get verified with a number and card, but you can also earn money directly linking your bank account and giving your official ID. Who wants to miss that? So, if you are an influencer of good reach with verification and making revenue on X, then they have your IP, location, address, banking, and complete ID information. And you now also think X is private and anti-Govt. It is a bastion of free speech. It has nothing to do with the agencies and dirty elites who want to control you. You think whatever you like on X is private. That nobody knows, for Elon made X likes private. But Grok is, right now, as I write this, analyzing all your posts, likes, and re-posts to build a model about you. Your attitude, your beliefs, your ideology, your extremism, your way of thinking, and even your way of writing and speaking. It can submit automatic reports about you to them, based on certain criteria. They can pull up a complete picture about you - a beautiful mental model of you and your personal details. They can even predict what you may say or do next. That "they and them" are the DS and its agencies. The same DS that is backing Elon on whatever he does without any issues and is propping up X and Trump, dissolving all their legal troubles, to run the world in a radical new way. It is a new DS crafting a new world order. A DS of the AI and the X age. A DS that not only knows you by your metadata (name, age, address, etc) but by your mental data. A DS that can program you individually post by post and thought by thought, making you believe it is all free and fair, organic and real. Enjoy X. Now the fun part: This post is to remind you that from now on, after President Trump, whatever you see on X may not be a real story. The post itself can look authentic like this, but it can be just a mind control conspiracy theory, Like this post. Do not believe whatever you see on X. They could be just conspiracy theory, Like this post.

There's a website from Ministry of Education, India. I've been shouting wow, wow since. All the courses are free.