David Winer

Fun fact - if you have a recent commit that mentions OpenClaw in a json blob, Claude Code will either refuse your request or bill you extra money. This is an empty repo, I'm just calling Claude Code directly. Insanity.

Oh my God

@TheStalwart The official shoe of zero interest rates

Allbirds just sold for $39 million. The company was once worth over $4 billion. bloomberg.com/news/articles/…

Allbirds (public company) worth less than the average YC W26 company

Not good

LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below

Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

taps sign

you vs. the open weights model she told you not to worry about

@davidjwiner and @GetCiro have officially made Cursor for Prospecting. I'm just sitting here watching my agent find QUALIFIED prospects, and it's WORKING HARD. THIS IS INSANE!!

@chrisgford @GetCiro Thank you @chrisgford for all the awesome feedback along the way 🙏🙏

Matt Mahan. Finally someone who is straightforward, honest, and smart, working hard for all Californians. Support him for Governor of California and help him get our state back on the right track.

everyone hating on MCP just hasn't implemented tool search correctly in their agent harness

@garrytan Tool search tool might fix this platform.claude.com/docs/en/agents…

MCP sucks honestly It eats too much context window and you have to toggle it on and off and the auth sucks I got sick of Claude in Chrome via MCP and vibe coded a CLI wrapper for Playwright tonight in 30 minutes only for my team to tell me Vercel already did it lmao But it worked 100x better and was like 100LOC as a CLI

whoever put together this NYT graphic and didn't include Matt Mahan 😭

Has anyone ever successfully gotten a response from @inngest? Started using it to power our agents a month ago but are having huge reliability issues and can't get through to their support team.

@thdxr @opencode Wow this is awesome. Thank you!

@davidjwiner @opencode it exists, needs better docs and will be doing a v2 soon opencode.ai/docs/sdk/

.@thdxr @opencode do you plan to offer an SDK for building OpenCode-based agents? (Similar to the Claude Agent SDK) All the existing options are either bad (LangChain) or lock you into one model (Claude Agent SDK)

there is so much alpha in having fast CI right now

am i a supply chain risk now???