I hated my LG TV's ad-filled flutter-based home screen. So I replaced it. I used Arc to root webOS, build a custom Apple TV-style launcher, integrate Spotify and streaming/youtube recommendations, and add safe rollback to avoid bricking the TV in the process. Arc gives AI agents the tools they need to get things done - as well as collaborate across providers. Join the waitlist today, there's still a few slots left for early access. orqara.com/arc

Wait NFSU2 in the big 26 just running in a browser. This brings a tear to my eye nfsu2.xyz/

concerning... we got sociopathic switches for local models before GTA VI

Bro just starting poking around in the blackbox to see what happens

One of the funniest and most terrifying things to come out of Black October is what happened to LiteLLM this week. Back in May, a developer accidentally committed a secret API key to a public GitHub repository. Someone noticed, removed it from the repository, and identified the key as needing to be revoked. Except nobody actually revoked it. Fine. Happens. We've all had a bad Tuesday. Fast forward to October. An attacker finds the key, discovers it still works, and uses it to access an internal AI agent platform. Now here's where it gets stupid. That platform had access to a GitHub authentication token belonging to the organisation's OWNER. Not a restricted bot account. The actual owner. So the attacker went from finding an old API key lying around on GitHub to having the keys to the entire organisation. Naturally, they decided to make themselves at home. They stole more developer credentials, accessed private repositories, and started modifying the software release process. The company actually had some pretty serious security measures in place. Protected branches, multiple approvals, signed releases, even a special account tied to a physical device in their office. The attacker tried changing the release workflow. GitHub rejected it. Five seconds later, they used the stolen owner's credentials to override the protection. Lovely. They then pointed the release pipeline at a malicious lookalike repository, used one stolen developer account to start a release and another to approve it. The result? On October 21, the company's OWN official publishing system released a new version of LiteLLM containing malware designed to steal credentials and load further malicious code. Official package. Official Docker images. Properly signed. The whole thing. The malicious Python package was available for roughly two hours before being pulled. The Docker images took longer to remove because, according to the company's own incident report, they had to wake up the people with access to the registry. I cannot get over that detail. An attacker had just hijacked their software supply chain, and somewhere a developer was being woken up because they were one of the few people authorised to take the malware down. And the original entry point for this entire adventure? An API key someone accidentally uploaded FIVE MONTHS EARLIER, briefly removed from GitHub, and then forgot to invalidate. Imagine spending months designing a secure release pipeline only to discover the attacker was effectively an authorised member of your organisation. The security worked. Unfortunately, so did the stolen credentials.

If you haven't already set up a regular scan for vulnerabilities that effect you - do it now. Chatgpt lets you set up regular scans for anything. Combined with Arc you can automate patches to priority vulnerabilities so you don't get caught out by the rapidly increasing number of exploits being discovered.

what's your moat?

Haven't heard of this model before. must be new.

Do people actually post on Linkedin? it feels like the homework of social media

With all the “Black October” cybersecurity chaos this week, I used Arc to have ChatGPT audit my entire Mac against the latest vulnerabilities. It found what actually affected me, patched dependencies, updated my projects, and even fixed vulnerable root certificates in Apple's macOS trust bundle. I also set up an automated security scan with ChatGPT to keep checking for new vulnerabilities. And because Arc gives ChatGPT the tools to actually work on my Mac, it can investigate, patch, test and deploy fixes directly instead of just telling me what to do. Pretty wild 🤯

Leaving Anthropic to make time for GTA 6. A man with his priorities in order.

How much are you spending on AI each month? Where are you getting the most value?

The more I think about the roadster - driving up the side of a building or directly down into a tunnel / underground would be pretty sweet. The infrastructure & architecture designs over the next few decades could look incredibly different.

I can’t believe we got a flying car before GTA 6

can't wait to see the likes of @Max33Verstappen setting track times in the new roadster