Related posts
Max Howell
x.com
Your agents run Full Access. The Supply Chain is Compromised. The apps are vibe-coded.
compromised coded chain
The the words it uses that this site has seen
least often elsewhere. Posts are matched on those words alone —
nothing here is a summary of this one.
Sources
All Writing GitHub Korrents x.com Newsletter Site Recommends Bluesky Blog Mastodon
Top people
Pieter Levels
Zvi Mowshowitz
Dylan Patel
Simon Willison
Max Howell
Ben Vinegar
Philip Trammell
Andrej Karpathy
Thomas Depierre
Casey Handmer
Carlos Alexandro Becker
Mario Zechner
Showing Profile →
Show everything
Hiding Show them again
Show them again
Further back ↓
Hiding Show them again
19 September
Brazilian software engineer, creator and maintainer of GoReleaser; works on Copilot CLI at GitHub. Writes about tooling and his setup at carlosbecker.com.
Writes Don't Worry About the Vase, a near-daily account of what is happening in AI and what they think it means. Former Magic: the Gathering pro and trader; unusually willing to put a number on a belief and to grade their own past calls.
Their words
Do not assume that any AI, past this point, assumes its CoT is unmonitored.
Show the whole quote
thezvi.substack.com
17 September
Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.
Their words
I guess our best defense right now is dependency cooldowns - giving new package releases a few days before upgrading to them, in the hope that supply chain attacks like this will be spotted by someone else.
Show the whole quote
simonwillison.net
16 September
Austrian developer. Created the libGDX game framework, and more recently the pi coding agent, which moved with them to Earendil — Armin Ronacher's company — in April 2026. Writes at mariozechner.at.
he vibe coded the recording tool as i sat next to him at the vienna office. sometimes it's alright to have the ceo vibe slop his way to success. Quoting @colindaymond Radius lets you work with and collaborate on artifacts, natively within Pi Related
Prime Minister of the United Kingdom since July 2026 and leader of the Labour Party. MP for Makerfield since a by-election in June 2026; Mayor of Greater Manchester from 2017 before that.
Britain should be a country that makes things. It's how we create good jobs, give more opportunities to young people, and build pride in our communities. That's why today’s announcement from McLaren matters. They’re backing Britain, keeping design, engineering and manufacturing here at home - with plans to build their engines in-house for the first time. Their £500m investment will drive growth far beyond their factory gates, creating a thousand jobs, supporting thousands more in the supply chain, and providing apprenticeships to young people. This is what reindustrialising Britain looks like. Related
Writes Hyperdimensional, a newsletter on AI policy and governance. A White House AI policy adviser in 2025; joined OpenAI on 6 July 2026 to lead its Strategic Futures team.
nobody should patronize those who newly have opinions about third party evaluators. non-experts forming opinions fast is part of the american tradition. the constitution itself was, in a very important sense, vibe coded by 20 somethings with concepts of a plan. but newbies being fleeced is also part of the american tradition. “caveat emptor” is a provision of a contract signed by an adult, not some god-given right to be treated as something other than a little child. you will be treated as a child no matter what. you are the buyer. it is your job to beware. America Related
15 September
Co-founder of Y Combinator and Viaweb; essayist at paulgraham.com.
Their words
Someone needs to define the unit, perhaps using a chain of increasingly hard problems, each pair of which can be solved by a single model.
Show the whole quote
@paulg on X x.com
14 September
Economics professor at the University of California, Berkeley and a former Deputy Assistant Secretary of the US Treasury. Author of Slouching Towards Utopia and writer of the Grasping Reality newsletter.
12 September
Physicist and science communicator. Writes Backreaction and makes videos explaining new physics and astronomy results, frequently to argue that the headline about them overstates the case.
The German startup Magnotherm is pioneering a new type of cooling technology: Instead of compressing a refrigerant gas, as usual, their fridges use metals that heat up in magnetic fields and cool when the field is removed. This can effectively be used to move the heat from one location (eg inside the fridge) to another (outside the fridge). The idea itself is not new, it goes back to the 19th century, but Magnotherm is the first to make the step to commercial use. Earlier this year, they announced that the German supermarket chain REWE will deploy their new fridges in 10 stores. The company s… startups Related
Writes Don't Worry About the Vase, a near-daily account of what is happening in AI and what they think it means. Former Magic: the Gathering pro and trader; unusually willing to put a number on a belief and to grade their own past calls.
10 September
Writes Don't Worry About the Vase, a near-daily account of what is happening in AI and what they think it means. Former Magic: the Gathering pro and trader; unusually willing to put a number on a belief and to grade their own past calls.
9 September
AI research engineer working on large language models. He writes the Ahead of AI newsletter and is the author of Build a Large Language Model (From Scratch).
Dutch bootstrapper who builds and runs their internet startups alone — Nomads.com, Remote OK, Hoodmaps, Photo AI and Interior AI — and has written about it at levels.io since 2013. Posts as @levelsio.
Dutch bootstrapper who builds and runs their internet startups alone — Nomads.com, Remote OK, Hoodmaps, Photo AI and Interior AI — and has written about it at levels.io since 2013. Posts as @levelsio.
Their words
My own vibe coded image resizing API with NodeJS's Sharp + Redis (saves ~$1,500/mo)
Show the whole quote
x.com
Their words
My own vibe coded image resizing API with NodeJS's Sharp + Redis (saves ~$1,500/mo)
Show the whole quote
x.com
Their words
My own $0/mo vibe coded NSFW detection service with Python's NudeNET (saves ~$2,500/mo)
Show the whole quote
x.com
8 September
Writes Don't Worry About the Vase, a near-daily account of what is happening in AI and what they think it means. Former Magic: the Gathering pro and trader; unusually willing to put a number on a belief and to grade their own past calls.
From one piece
Astra Is Hard to Monitor
2 beliefs · thezvi.substack.com
6 September
Chief Scientist at OpenAI. Worked on the research that turned scaled reinforcement learning into reasoning models, and writes about where he thinks that path leads.
Their words
However, unfortunately our evaluations indicate our ability to rely on CoT monitoring is progressively diminishing.
Show the whole quote
An Alien Mind openai.com
4 September
Creator of Homebrew, the macOS package manager, and a Swift developer.
Your agents run Full Access. The Supply Chain is Compromised. The apps are vibe-coded. It’s fine: just install Automic Vault. Related
Security technologist and author of books including Applied Cryptography and Data and Goliath; writes the Schneier on Security blog and the monthly Crypto-Gram newsletter.
2 September
Co-creator of Django and creator of Datasette; writes daily at simonwillison.net.
In another case of it being quicker to build a tool than hunt around to find something that does what you need, here's a little vibe-coded thing for turning one or more GeoJSON shapes into a rendered PNG simonwillison.net
Related
1 September
Technical staff at METR, where she works on threat modelling and risk assessment for loss-of-control risks from advanced AI.
Their words
But keep those methods you use to investigate things and monitor things very separate from the methods you use to generate reward which is something that AI companies including open AAI have held up as a principle especially in the case of avoiding putting training pressure on the chain of thought. So you might have monitors that read the agents chain of thought in order to alert you if something is going wrong somewhere but you don't train the agents with the outputs of that monitor.
Show the whole quote
youtube.com
28 August
Creator of Homebrew, the macOS package manager, and a Swift developer.
Automic Vault means your CLI tools don’t perform sensitive actions without your approval. This applies to agents and supply chain attacks both. We patch tools at the *packaging layer*. Blessed Scripts allow you to make small, vetted scripts that escalate tool capabilities. Reentrant Blessed Scripts are a scripting pattern that allow you to “weave” in agent capabilities. Interleaving deterministic work with escalated Tool capabilities and secrets with applied intelligence. Perfect for automations. Quoting @AutomicVault We have documented the concept of `Reentrant Blessed Scripts` that describe our suggested mechanism of giving Agent Automations a set of escalated capabilities and secrets. Have the automation execute a Blessed Script with Automic Vault front-matter for the capabilities and… Related
Economics writer; author of the Noahpinion newsletter.
27 August
Co-founder of AngelList. Writes and podcasts at nav.al in short, aphoristic pieces on startups, wealth and judgement rather than long essays.
You’re here because an unbroken chain of your ancestors, from tadpoles to monkeys to now, replicated. Don’t be the first one to miss the branch. Quoting @matthewschmitz The sociologist Susan Pickard chose career over motherhood. She writes about being the last of her line. Related
26 August
Venture capitalist and founder of Theory Ventures, previously a partner at Redpoint. Writes a near-daily blog on startups, SaaS metrics, data and AI.
Does the token supply chain also experience the bullwhip effect? Here's my explanation of this classic phenomenon and what it means for AI data centers. data centers Related
Programmer; makes Handmade Hero and teaches Performance-Aware Programming, and argues loudly about how software got slow.
Their words
the performance of your software is generally determined by the longest serial dependency chain because it's something that cannot be parallelized.
Show the whole quote
youtube.com
30 July
American software engineer; worked on code-server at Coder and teaches TypeScript and open-source contribution. Publishes at joeprevite.com.
as software engineers most of us are sitting in an office chair all day we spend hours staring at a screen, not moving more then our fingers or wrists sometimes we lock in and it feels like there are only occasional windows to move if so, start simple. take a screen break and do: - a 5-min walk around your house - 25 push-ups - 25 jumping jacks anything to break the chain of not moving trust me, you'll thank me in a year Related
27 July
Clinical psychologist and clinical professor of psychiatry at UCSF. His 2010 meta-analysis established psychodynamic therapy as an evidence-based treatment; he has argued ever since that "evidence-based therapy" is used as a marketing term.
21 July
Dutch bootstrapper who builds and runs their internet startups alone — Nomads.com, Remote OK, Hoodmaps, Photo AI and Interior AI — and has written about it at levels.io since 2013. Posts as @levelsio.
Their words
So you went from a business chain of customer > app > ai model provider To customer > ai model provider The app layer is possibly getting removed!
Show the whole quote
levels.io
14 July
Indian software developer and prolific blogger on PHP, Laravel and JavaScript; open-source enthusiast publishing near-daily at amitmerchant.com.
28 June
Co-founder of Modem and a founding engineer at Sentry, where he went on to be VP of Engineering. Co-author of Third-party JavaScript, and co-host of the State of Agentic Coding podcast with Armin Ronacher.
Just noticed a vibe-coded project of mine cost $200/month to serve a few dozen users/day 😭 Turns out it was doing 10s of millions of unnecessary Redis polls/day, even when idle - telemetry alone cost $$ a possible clue for why infra providers are growing so much right now Related
24 June
Co-founder and CTO of Honeycomb; previously an infrastructure engineer at Parse, Facebook and Linden Lab, and co-author of Observability Engineering.
i said i would write a followup piece on AI and ethics, and I have. Here it is. We do not get to choose to live in a pure world. But we get to choose whether to help shape the compromised world we already live in. Related
Makes NeetCode, the structured practice list and video walkthroughs people use to prepare for coding interviews; a former Google engineer.
22 June
Italian software architect working on Microsoft 365, Azure and GitHub tooling. Microsoft MVP and GitHub Star; writes, speaks and streams about developer productivity at emanuelebartolesi.com.
18 June
Chief executive of Intel since 2025, founder of the venture firm Walden International and chief executive of Cadence Design Systems for thirteen years.
America
Their words
And you have to have a robust and resilient supply chain. You cannot just depend on one or two player in different geographical. And so, I think, you know, the more and more people going to realize making in United States is critical.
Show the whole quote
youtube.com
15 June
Security researcher; built Report URI and Security Headers, and writes about web security in practice.
4 June
Economist at Oxford's Global Priorities Institute; works on what advanced AI would do to growth, saving and the long-run economy.
From one piece
The better AI gets, the smaller its share of the economy might get – Alex Imas and Phil Trammell
2 beliefs, in the piece's order there
Their words
I do think there's this qualitative shift that we I think we agree is coming, which is that there will be at least some goods whose network-adjusted capital share goes to one, right? Because the whole supply chain can be automated and there's no part in it that we care intrinsically about having a human do. Um, so that'll be a, you know, that'll be a qualitative shift. Interestingly, the implications of that shift for the overall capital share are ambiguous
Show the whole quote
youtube.com
Their words
there's a sense in which nothing's yet been completely automated. If you look at the network-adjusted factor shares of a good, which is to say you look down the supply chain and say not just like the final step, but how much of that is done by capital and labor, but what went into the machines that can automate that final step. You'll find that labor's adding a lot of value down the supply chain.
Show the whole quote
youtube.com
Behavioural economist at Chicago Booth, professor of behavioural science and economics and director of AGI economics at Google DeepMind.
AGI energy
Their words
So, I think there is a world where it is concentrated, in which case it's going to be really hard to index AGI. There is another world where it is not It's electricity, then like basically every company has access to AGI. So, you just buy you use buy the index. So, like, you know, Nigeria just needs to buy the index.
Show the whole quote
youtube.com
2 June
Swiss full-stack developer working mostly with Laravel and Vue; author of the widely used git-auto-commit-action GitHub Action.
If you've been using my "laravel-backup-restore" package in your projects, please upgrade to the latest version as soon as possible. v1.9.4 fixes multiple security vulnerabilities that could affect you, if your dump files have been compromised. github.com
Related
31 May
Programmer and writer on computer architecture, performance, and software reliability. He has worked on CPU design at Centaur Technology and on software at Google and Microsoft, and writes long-form technical essays at danluu.com.
It's interesting how much (some) people are adopting AI-isms in writing even when not using AI. It makes sense that people would fall into the same patterns after seeing them everywhere, but it's still very weird to, live, watch someone who never used to write like this, write out something that's full of "It's not X, it's Y", etc. If you actually read it, it's a little too well reasoned and doesn't have enough nonsense phrases to be AI writing but, superficially, it's very AI-coded writing. Related
25 April
Software engineer who writes about low-level and systems programming at nullprogram.com; author of the Elfeed feed reader, the Endlessh SSH tarpit and Enchive.
15 April
Co-founder of NVIDIA and, as of 2026, its chief executive; the company designs the GPUs most large AI models are trained on.
6 April
Computer scientist and director of the MIT Digital Currency Initiative; her research covers distributed systems, databases and digital currency.
I'm curious about this as well. @business can you please be more specific in your reporting? just saying "stablecoins" without referencing which issuer or which chain isn't acceptable. bloomberg.com
Quoting @matthew_d_green I’ve seen reports that Iran is demanding payment in stablecoins for Hormuz transits. Does anyone know the addresses or chain details? Related
31 March
Founding member of OpenAI and former director of AI at Tesla; creator of nanoGPT and the term "vibe coding".
New supply chain attack this time for npm axios, the most popular HTTP client library with 300M weekly downloads. Scanning my system I found a use imported from googleworkspace/cli from a few days ago when I was experimenting with gmail/gcal cli. The installed version (luckily) resolved to an unaffected 1.13.5, but the project dependency is not pinned, meaning that if I did this earlier today the code would have resolved to latest and I'd be pwned. It's possible to personally defend against these to some extent with local settings e.g. release-age constraints, or containers or etc, but I thin… stepsecurity.io
Quoting @feross 🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downl… Related
24 March
Founding member of OpenAI and former director of AI at Tesla; creator of nanoGPT and the term "vibe coding".
Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm… Quoting @hnykda LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below crypto Related
23 March
Hosts the Lex Fridman Podcast — long, unhurried conversations with scientists, engineers and public figures. Several of the interviews quoted elsewhere on this site are episodes of it.
Here's my conversation with Jensen Huang, CEO of NVIDIA, the most valuable & one of the most influential companies in the history of human civilization. It is the engine powering the AI revolution. This was a fascinating & inspiring conversation, in parts super-technical on engineering of every part of the AI stack, memory, power, supply chain (TSMC, ASML, etc), in parts about leadership & psychology, and in parts personal & philosophical about life, consciousness, mortality, and human nature. It's here on X in full and is up everywhere else (see comment). Timestamps: 0:00 - Introduction 0:33… Related
13 March
Founder and chief analyst of SemiAnalysis; reports on semiconductor supply chains, AI datacentre economics and what the chip export controls actually do.
From one piece
Dylan Patel — The single biggest bottleneck to scaling AI compute
5 beliefs, in the piece's order there
AI and jobs China America
Their words
As we move from, you know, hey, [clears throat] these companies are selling tokens where they provide the entire uh reasoning chain and all that to uh selling automated, you know, white collar work, right? Automated software engineer, send them the request, they give you the result back and there's a bunch of thinking on the back end that they don't show you. The ability to distill out of American models into Chinese models will be harder.
Show the whole quote
youtube.com
Their words
Um in general the semiconductor supply chain has not right it's lived through the booms and bust and uh we can talk a bit more about it but basically no one you know some players as of very recently have like woken up but in general no one really sees demand for 200 gawatts a year of AI chips or you know trillions of dollars of spend a year in the semiconductor supply chain.
Show the whole quote
youtube.com
data centers
Their words
Yeah, I think the biggest bottleneck is compute and for that the longest lead time supply chains are not power or data centers. They're actually the semiconductor supply chain themselves, right? It switches back from being power and data center uh as a major bottleneck to chips.
Show the whole quote
youtube.com
+ 2 more
data centers
Their words
oh 50 gigawatts of economic you know sort of capex in in the data center and what gets built on top of that in terms of tokens is even larger right it might be hundred billion dollars worth of AI value into the supply chain is held up by this $1.2 two billion dollars worth of tooling that simply just cannot expand its supply chain quickly.
Show the whole quote
youtube.com
China
Their words
Um, just shipping out all the engineers and blowing up the fabs means China has a stronger semiconductor supply chain than the rest of the world, right?
Show the whole quote
youtube.com
11 March
Programmer and essayist who has worked at Amazon, Google, Grab and Sourcegraph. Best known for the long-form essays collected as Stevey's Drunken Blog Rants and Stevey's Blog Rants.
19 February
FreeBSD developer and former FreeBSD Security Officer; founder of the Tarsnap online backup service and author of the scrypt key derivation function.
13 February
Programmer, teacher and speaker; long-time Microsoft developer-community figure, host of the Hanselminutes podcast and author of the hanselman.com blog.
You vibed an app, for an audience of one. Add it to Tiny Tool Town. But You know what Tiny Tool Town REALLY needed? *TIKTOK MODE* Why not mindlessly scroll awesome vibe coded apps rather than videos? Maybe one will help you or someone else! go hit **https://tinytooltown.com** and tap "SHORTS" for TikTok/Shorts/Reels Mode Related
11 January
Software engineer writing about maintenance, open source and the industrial reality of software — the author of "I am not a supplier".
4 January
Economist at George Mason University, co-author of Marginal Revolution, host of Conversations with Tyler. Writes in short, dense claims about economics, culture and AI, and has moved position on AI in public more than once.
Their words
Nicolas Niarchos, The Elements of Power: A Story of War, Technology, and the Dirtiest Supply Chain on Earth is a good treatment of minerals issues as they relate to the Congo today.
Show the whole quote
marginalrevolution.com
23 November 2025
Co-founder of Modem and a founding engineer at Sentry, where he went on to be VP of Engineering. Co-author of Third-party JavaScript, and co-host of the State of Agentic Coding podcast with Armin Ronacher.
16 November 2025
Software engineer writing about maintenance, open source and the industrial reality of software — the author of "I am not a supplier".
17 September 2025
Free software developer; maintainer of sway, wlroots, aerc and scdoc, and founder of the SourceHut (sr.ht) software forge.
13 September 2025
Founder of Terraform Industries and formerly a physicist at NASA's Jet Propulsion Laboratory; writes about energy, space and manufacturing.
15 August 2025
Founder of Terraform Industries and formerly a physicist at NASA's Jet Propulsion Laboratory; writes about energy, space and manufacturing.
solar America
Their words
And I think the United States could probably do that in 2 years or less if you started today. Like it's currently 11:00, so like we're going to start cutting checks by noon.
Show the whole quote
youtube.com
29 July 2025
Development economist; writes Global Developments, on growth, history and the numbers behind them.
19 July 2025
Mathematician and maker of the 3Blue1Brown YouTube channel, which explains mathematics through animation. Creator of the open-source Manim animation library and founder of the Summer of Math Exposition.
Welp, somewhat embarrassingly, yesterday this account was briefly compromised and someone posing as me promoted a crypto project supposedly "tokenizing" manim. Thank you to those of you who quickly flagged it as spam and alerted me to the problem. For future reference, it's a safe bet that you'll never see me creating and promoting a meme coin. crypto Related
30 May 2025
Programmer on the Dart language at Google and author of Game Programming Patterns and Crafting Interpreters; previously a game developer at EA.
Consider Knitting Let’s say that, like me, you are a person who stares at a computer and writes code for a living. As a straight male who grew up in a time where knitting was very strongly female coded, it for the most part never o…
Related
15 May 2025
Data scientist at Our World in Data and author of Not the End of the World. Writes By the Numbers, working through energy and climate questions with the numbers in front of them, and revising in public when they say something unexpected.
1 May 2025
Machine-learning researcher; has written the Lil'Log survey posts on how a model technique works since 2017, and worked at OpenAI from 2018 to 2024, latterly leading its safety systems team.
6 April 2025
Founder of the toy manufacturer Viahart; writes about manufacturing, importing and why bringing production back to America is harder than it sounds.
America
Their words
That’s because America has an amazing consumer supply chain, one of the best, if not the best in the world, but this is totally different from having an industrial supply chain.
Show the whole quote
molsonhart.com
12 March 2025
Co-founder of Ximian and Xamarin; CEO of GitHub from 2018 to 2021; now an independent investor and funder of open technical projects, including the Vesuvius Challenge to read the Herculaneum Papyri.
Exciting PlasticList update: We were honored to work with @bobaguys to identify and eliminate the sources of BPA contamination, and their teas are now BPA-free! They have fully transitioned to BPA-free receipt paper, which PlasticList confirmed to be BPA-free through independent lab testing. They have also switched to brown sugar in BPA-free packaging. We have been impressed with their commitment to get to the bottom of the issue and move fast to remove BPA from their supply chain. If you want healthy and delicious tea, I highly recommend Boba Guys! Quoting @natfriedman Advice for Food Companies Since we launched PlasticList, we’ve been heartened to have quite a few food companies reach out and ask for help interpreting their results and tracking down and eliminating their contamination. I’ve had calls with a bunch of these. I am happy to report that no food compa… Related
27 February 2025
Investment researcher and engineer who runs Lyn Alden Investment Strategy, writing on macroeconomics, currency systems and equity analysis.
Twitter/X Restored My Twitter/X account was compromised from February 26th to March 3rd, but I confirm that I’ve regained control of it now. Thank you to everyone who helped make it happen. Fortunately, I still had access to Nostr during…
Related
Nothing matches. Show everything
A korrent is a belief a person has stated in their own words: one
sentence stating the claim, backed by a quote and a source, kept at
korrents.com .
Under a name here, the quoted block is what they actually said.
The korrent beneath it is the claim those words support, in
korrents' wording — tap it to see the record, its source, and who
else holds it.
Nobody here wrote their own korrents. They are compiled from public
statements, and a person can change their mind, which is recorded too.
Got it
About the English under a post
Some people here publish in a language other than English. Where they
do, this site shows a machine translation beneath the post, in
this typeface — the site's own, not theirs.
The post itself is never changed, moved or hidden: what is set in the
serif above is exactly what the person published, and it is what to
quote them on. A translation can be wrong in ways that matter,
especially about tone.
Only the post's own words are translated. A quoted post, a linked
article and a belief on korrents.com
are left in their original language.
Got it