Senior Software Engineer @ Disney Streaming. 2x CMU Stats alum. R evangelist, nodeJS hacker, Python tamer. Views are my own.
Hoboken, NJ
Joined March 2010
- Tweets133
- Following273
- Followers98
- Likes1.2K
Frank Kovacs retweeted
One thing I do want to say, I made a lot mistakes in that final set. But, you cannot fault me for playing to my outs. If there’s is a chance, why wouldn’t I take it? Why wouldn’t I try everything in my power to win if I see a line? Most of you would do the same in my shoes.
Two ways to look at this:
1. MCP in production opens up a can of worms that must be dealt with when giving agents access to remote tools and resources.
2. MCP is best suited for situations in which end users are already within a walled garden and can be trusted.
I err towards 1)
This is wild.
I just read these top 25 vulnerabilities report of MCP and it's absolutely brutal.
Every single "Critical" vulnerability is trivially exploitable. Prompt injection, command injection, missing auth - basic security failures that we solved in web development 15 years ago.
The scariest part? 18 out of 25 are rated "Easy" to exploit.
We're giving AI agents database access and file system permissions while ignoring input validation. It's like handing someone root access to a server running unpatched PHP from 2008.
Companies are rushing to deploy AI agents in production with zero security engineering discipline. This report just proves what security researchers have been screaming about since day one.
Hard agree. While AI has enabled teams to move faster the ability to maintain said code can lag. Eventually "AI Cleaner" may be a title or a component of a senior-level engineer's responsibilities.
The rise of uv as a python package manager seriously speeds up development of forked repos. Shoutout @rasbt 's directive within "LLMs from Scratch" for this.
It felt amazing to speak in front of people at @nyhackr 's annual meet! The topic was how we can use Model Context Protocol to architect context delivery to LLMs. Thanks to @jaredlander for the opportunity, video and recap to follow
What is the term for AI-powered coding in which the end user is an experienced dev? "Vibe coding" implies following what the model produces without scrutiny and nobody creates a project without errors at some point.
Be there or be square! Excited to dive into how MCP enhances LLMs workflows and provides the benefits of a client / server model
👏Our next meetup is on Wednesday, Sept 17 with Frank Kovacs (@statkovacs), who will talk about model context protocol!
📍In-Person at NYU & Virtually Online at 7 PM (ET)
🙋♀️RSVP now ➡️ nyhackr.org
Thanks @NYU_PRIISM for hosting!
#rstats
One of the most unexpectedly convenient use of LLMs when building: Pasting a anonymized version of a large error stack trace into GPT or Claude and getting a detailed breakdown of the error and ways to resolve it
"The first step is convinving people your idea is wonderful is to answer the question 'why hasn't this been addressed before?'"
Great framing by @chendaniely about LLMs as layered API calls that are all independently "stateless" at @TheDataConf
Cleaning up old software on my computer and shocked to find TexLive installations dating back to 2016. An odd mix of nostalgia and horror
I'm in the process of converting my Rmarkdown-turned-Quarto configuration into a complete template and am in awe of the detail provided. @posit_pbc wonderful work
Fell down a prompt engineering rabbit hole while experimenting with AI-generated within automated posting. Best. Rabbit. Hole. Ever.
Upon diving into personal development I re-discovered Act by @nektos . This tool has saved me a lot of headaches when testing workflows.
I was particularly impressed by how well it handled AI-embedded actions that can be tricky during the initial dev stages.
github.com/nektos/act
Moving away from the Hugo Eureka theme for my personal website. Thanks to @wang_chucheng for creating Eureka!