Frank Zheng

近期目標

如果 GitHub 是台灣人做的。

Surprised with how good the comments on github gists are. A lot more helpful, insightful, constructive, a lot less AI... Is it the user community? The markdown format? The (lack of) incentives? Suddenly feeling like I should gist more. @github consider competing with X (?)

you can outsource your thinking but you cannot outsource your understanding

The hottest new programming language is English

The best engineers today don’t write more code. They write less. AI writes code. Engineers design systems. That’s where the leverage is.

The best engineers today don’t write more code. They write less — and design better systems with AI. Less is more. Paradigm shift. The real leverage now is in system design and workflow automation. Make system design and workflow automation great again.

I am kinda of #Anthropic side.

it's time @claudeai

Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

There are 10 types of people in the world: those who understand AI, and those who don’t.

Collection of skills for Claude github.com/BehiSecc/aweso…

GPT 5.2 is "ridiculously better" than Opus 4.5 they said... I tested BOTH on identical bugs in OpenCode and recorded everything GPT 5.2 → 24 minutes for nothing Opus 4.5 → 4 minutes and done Full video proof (crazy) Always test yourself instead of trusting tweets

We are starting to test ads in ChatGPT free and Go (new $8/month option) tiers. Here are our principles. Most importantly, we will not accept money to influence the answer ChatGPT gives you, and we keep your conversations private from advertisers. It is clear to us that a lot of people want to use a lot of AI and don't want to pay, so we are are hopeful a business model like this can work. (An example of ads I like are on Instagram, where I've found stuff I like that I otherwise never would have. We will try to make ads ever more useful to users.)

1/n I’m really excited to share that our @OpenAI reasoning system got a perfect score of 12/12 during the 2025 ICPC World Finals, the premier collegiate programming competition where top university teams from around the world solve complex algorithmic problems. This would have placed it first among all human participants. 🥇🥇

Top 12 Tips for API Security

Open-source Free Domain For Everyone.

1/n I’m thrilled to share that our @OpenAI reasoning system scored high enough to achieve gold 🥇🥇 in one of the world’s top programming competitions - the 2025 International Olympiad in Informatics (IOI) - placing first among AI participants! 👨‍💻👨‍💻

🤔