Dean Tribble

1.3K posts

Dean Tribble

Dean Tribble

@DeanTribble

Chief Executive Orchestrator @agoric. IBC core contributor, OG Cypherpunk, and long-time entrepreneur and builder

Katılım Haziran 2012
1.3K Takip Edilen4.5K Takipçiler
Dean Tribble retweetledi
Haseeb >|<
Haseeb >|<@hosseeb·
Major hacks seem to be becoming more common. We're starting to see the problem with vibe hacking: defenders are diffuse, while attackers are concentrated. Right now, North Korea is using the latest tools to attack, but individual repo maintainers are not using the latest tools to defend. In the long run there might be more of a balance, but I expect this problem to get a lot worse over the next couple of years.
Feross@feross

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

English
21
8
136
34.1K
Andrej Karpathy
Andrej Karpathy@karpathy·
Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.
Daniel Hnyk@hnykda

LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below

English
1.4K
5.4K
28.1K
66.3M
Dean Tribble
Dean Tribble@DeanTribble·
AI needs real guardrails, where they can only interact with APIs that give structured, fine-grained access. Smart contracts! "AI agents aren’t dangerous because they’re smart. They’re dangerous because we keep handing them the keys and pretending it’s fine." linkedin.com/feed/update/ur…
English
2
0
8
167
Claire Kart
Claire Kart@clairekart·
i have this feeling that the conversation is going to shift very quickly from 'can i make these agents smarter?' --> 'i won't use these agents if they aren't safe' there are things bubbling under the surface and we are seeing it in places like what @near_intents is working on, @AskVenice with a privacy infrastructure intermediating querying llms crypto and ai are going to converge in ways i don't think we can see or understand right now
English
8
2
50
2.6K
Dean Tribble retweetledi
DCF
DCF@DCF_io·
@_weidai The EndoJS project is building a p2p, multiplayer agent harness that manages permissions with a hierarchical petname system, such that the AI is not exposed to even its own credentials, just self-assigned names. DM - would love to chat.
English
1
2
6
585
Dean Tribble retweetledi
OKX
OKX@okx·
Our first priority is the safety of our employees and protecting our customer and partner interests. Our Risk and Safety teams are actively monitoring the situation and coordinating closely with local authorities and internal people teams. We are fully supporting our employees in affected areas to ensure they have flexibility, and resources they need to remain safe. Nothing is more important than the wellbeing of our people. At the same time, moments like this remind us why resilient infrastructure matters. Traditional financial markets close. Banks operate within fixed hours. Liquidity pauses. But the world does not pause. Events unfold in real time, including on weekends and outside market hours. Crypto markets continue to operate. They provide continuous price discovery, real-time signals, and uninterrupted access to liquidity across borders. This is not theory. It is observable. When global events occur, digital asset markets reflect them immediately, often before traditional indices reopen. That continuous function is not about speculation alone. It is about open, resilient infrastructure that remains operational during uncertainty. We do not celebrate volatility. We recognize responsibility. The long-term role of crypto is to strengthen financial systems, to provide access without dependency on geography or banking hours, to enable settlement without interruption, and to maintain transparency when clarity is needed most. We remain focused on protecting our people and building for the future. Resilience is built before it is tested.
English
92
35
324
534.7K
Dean Tribble
Dean Tribble@DeanTribble·
Thrilled to see @Ymaxapp go live after our team's hard work! As CEO of @Agoric, I've watched this evolve into a game-changer for stablecoin yields—one-sig allocation across Morpho, Aave, and Compound on multiple chains make DeFi frictionless. @IuliaMihailescu captures it perfectly here. DeFi pros: Jump in early for boosts and let's yield more, stress less. ymax.app
Iulia Mihailescu@IuliaMihailescu

This week we launched Ymax Early Access 🚀 Ymax.app— open beta live, waitlist gone. One-sig deployment across Morpho, Aave, Compound. Introduced live at @EthereumDenver Booth was electric. "Stress Less, Yield More" branding felt refreshing—neon, beach visuals, turf oasis. Feedback: the brand delivered on the promise. "Touch Grass" activation ($25 Yield Boost claims) brought smiles and on-chain action.

English
4
9
29
1.7K
Dean Tribble retweetledi
ETHDenver 🏔🦬🦄
ETHDenver 🏔🦬🦄@EthereumDenver·
How Should DeFi Really Work? by @DeanTribble from @agoric. Laying out the core principles of good DeFi UX (e.g., clear intent, minimal friction, cross-ecosystem access, and true self-custody), and why the industry has historically struggled to deliver them due to fragmented execution, manual coordination, and brittle tooling. Full video below 👇🧵
English
6
3
21
2.5K
Dean Tribble
Dean Tribble@DeanTribble·
Come, talk to us about yield orchestration!
Ymax@Ymaxapp

@EthereumDenver , we're here. We’ve got some cool stuff ready for you — come find us at booth AW and see what we’ve been building. Yield orchestration, uninterrupted.

English
0
1
13
311
Dean Tribble retweetledi
Ymax
Ymax@Ymaxapp·
@EthereumDenver , we're here. We’ve got some cool stuff ready for you — come find us at booth AW and see what we’ve been building. Yield orchestration, uninterrupted.
Ymax tweet media
English
0
2
11
717
Dean Tribble
Dean Tribble@DeanTribble·
9/ But on long-term potential, optimism isn't cope; it's informed by how transformative tech actually evolves. If you're building non-financial crypto, nail real pain points and obsess over user delight. It's early. The trajectory is familiar. The upgrade is real. @cdixon @hosseeb /end
English
0
0
2
110
Dean Tribble
Dean Tribble@DeanTribble·
8/ We're still in crypto's "packet switching" phase. Mass onchain adoption via payments, stablecoins, and DeFi will lay the distribution foundation—exactly like the internet needed hundreds of millions of users before new cultural/economic categories exploded. Policy breakthroughs (e.g. stablecoins) show how long groundwork suddenly becomes inflection points. So finance is today's success.
English
1
0
1
117
Dean Tribble
Dean Tribble@DeanTribble·
1/9 Great debate from @cdixon and @hosseeb on crypto's future beyond finance. As Haseeb notes: finance has dominated so far. But I disagree that non-financial apps are inherently unwanted or doomed. It's about timing, evolution, and fundamentals.
Haseeb >|<@hosseeb

With all due respect to Chris, I completely disagree with this take. Chris argues that "web3," particularly crypto-powered gaming and media, failed due to scams and regulation, and that better regulation will unlock these non-financial cases. OK, think about this for a second. Does this pass the smell test? Do you think web3 gaming failed because of Gary Gensler? Do you think web3 media plays failed because the scammers crowded out the honest media innovators? Really? If this is true, why didn't they kill financial crypto, which had WAY more of both? Financial use cases were right in the crosshairs of the regulatory harassment, and they also attracted way more scams. Why shouldn't we instead accept the more obvious answer: non-financial use cases for crypto have failed because no one wants them. Let's just admit it. They were bad products. They failed the market test. It was not Gensler or SBF or Terra that caused these things to fail, it was that no one wanted any of it. Pretending otherwise is cope. Enormous sums of capital and talent explored these ideas, and we should acknowledge what we learned. That lesson is not "if we just had better laws, then finally people would finally be using decentralized Spotify" or whatever. Call a spade a spade. Every single use case in crypto that has worked at scale has been financial in nature. 2008: Bitcoin - non-sovereign store of value 2014: Tether - stablecoins 2015: Ethereum - programmable money 2017: ICOs - capital formation 2018: Prediction markets (Augur, later Polymarket) 2020: DeFi - literally finance is in the name 2021: NFTs - non-fungible financial assets (to the extent they worked) 2024: RWAs (the year BUIDL took off) All this stuff was adopted bottoms-up. We as investors discovered that people wanted to do these things with crypto. The web3 consumer stuff, on the other hand, was primarily conjured up by investors and pitch decks, ZIRP accelerationism, and "wouldn't it be crazy if" blog posts. This was the opposite of the "what smart people are doing on their weekends" thesis. In fact, if you go back to the Ethereum white paper from 2014, almost every single Ethereum use case Vitalik describes is financial in nature: token issuance, stablecoins, derivatives, on-chain treasuries/DAOs, on-chain savings, insurance, price feeds, escrow, gambling, prediction markets. It's all in there. This is nothing to be ashamed of. Finance is almost 10% of GDP. It's an enormous part of the world economy, and banks are some of the lowest NPS score companies in the world. People hate their banks and the outdated financial architectures their money runs on. It's literally why Bitcoin was created. There is so much to innovate in the realm of finance, and I truly believe we are only at the beginning of that displacement. You don't need to assume anything more to project the next 10x in crypto. The old saying goes "crypto will do to finance what the Internet did to every other industry." I respect Chris's optimism. But 18 years in, we should not be propagating this meme about consumer web3 use cases as though they're inevitable. If you are hanging around the rim hoping that crypto is going to disrupt media and gaming, you should know the history and look at it with clear eyes. Now if you as a founder believe that despite that, you know the secret to cracking this market--I respect that, and I certainly don't begrudge anyone to follow their convictions. But I think it's important that investors be honest that all the evidence points the other way.

English
2
3
11
381