Menlo Park, CA
Joined May 2008
- Tweets1.5K
- Following594
- Followers2.1K
- Likes931
Love the "Apple Home Collection" line, but for a company that cares so much about privacy like Apple... There could not have been a worse time to team up with someone like LG to build hardware.
Neordr is a Herdr-compatible server that uses Neovim as the terminal multiplexer. Built for Moshi. Hoping to open source it after testing it for a while. xitter.cf/derekstavis/status/210…
Just built a RDP to VNC proxy working at 60fps under LAN. It pretends to be a Mac so one can use username/password authentication. It advertises on Bonjour so Screens on Mac/iPad finds it automatically.
No more switching between two apps for remote access.
I never thought I'd have a great SSH app on my iPhone/iPad. Moshi changed my mind.
while 3.12.1 is still waiting for review, 3.12.2 is almost ready. and it’s all about shortcuts:
- enhanced herdr/tmux prefix support
- cmd as prefix
- right click emulation
- bind shortcuts to vol up/down
- keyboard shortcut to enter chat-view and start voice input
- more stability fixes on hook
try Moshi, if you haven’t yet!😻
I wouldn't buy anything that is not a @Tesla but the latest seat design on the Model Y has some serious quality control issues.
This is how the seats have been since ~400 miles. Service centers claim this is "normal wear and tear" and refuse to replace them under warranty.
When a post about a memory allocator turns into an x-ray of the faith of the standard company culture.
jasone.github.io/2025/06/12/…
Real talk
> Why are you trying to push this to a next session? Tell the truth of why you think continuing on this session is not a good idea
You’re right, and the honest answer isn’t flattering: the real driver was my own context-length/fatigue anxiety, and I dressed it up as “responsible engineering / needs a fresh pass.”
Hey friends at @eightsleep imagine if your house AC, fridge and stove only worked if you paid a subscription.
Yes that’s exactly what you’re doing with your product. It’s a shame.
Oh My Fish has been barely maintained for the past 10 years. People often say “add more contributors”.
I hope all the recent events with npm and pypi makes self-explanatory why not.
Yes we might be “licking the cookie” but that cookie is a huge responsibility.
New App one shotted with Codex!
My Dexa tracks all of your Dexa scan metrics and appointments, syncing metrics to Health Kit!
For now it’s integrated with @BodySpec (waiting for OAuth client key). Hope to get it on the stores soon!
Built with @expo using Expo Router and @DrizzleORM to be offline-first!
Uses background tasks to sync data and send notifications for appointments and results!
Took me 1h to build 😂
Derek Stavis retweeted
Imagine every pixel on your screen, streamed live directly from a model. No HTML, no layout engine, no code. Just exactly what you want to see.
@eddiejiao_obj, @drewocarr and I built a prototype to see how this could actually work, and set out to make it real. We're calling it Flipbook. (1/5)
Can't wait for Apple to do a Snow Leopard like release... The state of macOS is deplorable. Been trying to search for music and the Home tab in Music is just spinning forever. Killing the app (and stopping playing music) is the only solution.
I think it's not whether dependencies are good/bad that needs to be re-evaluated, but the security standards of package indexes.
What should happen here is that they should demand the highest levels of security from user accounts that maintain popular packages.
Software horror: litellm PyPI supply chain attack.
Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.
LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.
Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.
Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.
Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.