Ryan retweeted
Our thoughts on the importance of AI sovereignty.
1. Your AI sovereignty dictates your institution’s future. Sovereignty is the precondition for choice. Relinquishing sovereignty transfers the future choices of your institution to others, who are likely to exploit it for their gain and your loss.
2. Data retention is your treasure. Transfer it at your own peril. Your ability to win is dictated by your ability to recognize and use your unique edges, and you keep winning by compounding the underlying data to generate new insights. Transferring that data hands over access to your pre-existing winning plays and yields the means of production for new ones.
3. Tokenmaxxing hijacks your value orientation and decreases your institutional fortitude and intelligence. The pursuit of high token usage incentivizes disposable scripts over robust software — with the addictive feeling of false progress. There is a reason why those selling tokens refuse to charge based on value.
4. Controlling your weights is controlling your fate. Weights are the distilled form of hard-won, accumulated institutional knowledge. If you let others control your weights, you are allowing them to migrate the alpha of your business to theirs.
5. There is no contradiction between sovereignty and alpha. The architecture that maximally preserves sovereignty is one that enables institutions to own their tribal knowledge, and to compound it as alpha.
6. Politicizing the technical issues involving sovereignty is what your adversary wants. Techno-politicization is the wellspring of false sovereignty. Techno-politicization drives decisions that seem to reduce dependency, but ultimately limit agency — especially on the battlefield in the West.
7. Real expertise is existential. Allowing politics or favoritism to determine your technical decisions rewards whoever is best at politics, not whoever is right. Listen to those closest to the problems, not those speaking most compellingly about them.
8. Learn from institutions that are winning or that have consistently delivered. Institutions facing existential threats do not have the luxury of making technical decisions based on political preferences.
9. Only listen to institutions, countries, and people who have a proven record of being right. A track record of correctness is the best and only signal for future correctness. Judging something as right or wrong based on who you like is exceedingly misguided.
Ryan retweeted
Hey everyone! I triaged a @nodejs vulnerability, wrote the fix, and pushed it through the security process.
I now think it shouldn't have been a CVE. And the fix broke a big part of the ecosystem.
🧵
Ryan retweeted
USA. A Mexican restaurant. We had not yet ordered anything, and the food was already arriving.
Chips. Salsa. Unrequested. Free.
I stopped the waiter. "We have not earned these."
"They just come with the table, man."
They come with the TABLE. In my land, hospitality is a debt. Every gift creates an obligation, weighed carefully, returned in the proper season with interest of feeling. Here, the gift arrives before you have even proven you can pay for dinner.
This is not an appetizer. This is a declaration: we trust you. Eat.
I ate with the gravity the moment deserved. And then — I must report this calmly — the basket emptied, and a new one appeared.
"Did we…?"
"Refill," the waiter said. "It's bottomless."
Bottomless. They have wells of salsa. The supply lines of this nation are beyond anything my ancestors imagined.
My friend warned me. "Don't fill up on chips, dude."
Too late. I had accepted three baskets. Honor demanded each one be finished — an unfinished gift is an insult. By the time my actual food arrived, I was a ruined man.
I was not hungry. I was not comfortable. I had been defeated by a courtesy.
Generosity that arrives before the request cannot be repaid. It can only be survived.
I know the rule now. I have made my peace with the basket. One basket. Two at the most.
Who am I deceiving. There is no number of baskets I would refuse. The trust of a nation is in that salsa, and I intend to honor all of it.
🤖 Made with AI
Ryan retweeted
the only people that feel like this are reddit midwits right there at the top of the curve
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
Ryan retweeted
Easier way to protect yourself (if you are not infected yet) is to set a minimum release age in your package manager.
For @npmjs:
`npm config set min-release-age=2d`
For @pnpmjs:
`pnpm config set minimumReleaseAge 2880`
For @bunjavascript:
```
# In bunfig.toml
[install]
minimumReleaseAge = 172800
```
For Yarn:
`yarn config set npmMinimalAgeGate "48h"`
‼️🚨 BREAKING: A new npm supply-chain attack uses a dead-man's switch. The payload plants a watcher on your machine that nukes your home directory the second you revoke the GitHub token it stole from you.
The compromise happened today, across 42 official tanstack npm packages, 84 malicious versions in total. tanstack/react-router alone pulls more than 12 million weekly downloads.
The attacker forked TanStack's repository and pushed a single hidden commit. From there, they tricked TanStack's own release system into signing the malicious packages as if they were the real thing. To npm, and to anyone checking the cryptographic proof of origin (SLSA provenance), the poisoned versions looked 100% legitimate.
Maintainer Tanner Linsley confirmed the whole team had 2FA enabled. It didn't matter. This is the first documented npm worm in history that ships with a valid, signed certificate of authenticity, the same one defenders rely on to know a package wasn't tampered with.
Ryan retweeted
‼️🚨 UPDATE: The TanStack npm attack is now a full campaign.
'Mini' Shai-Hulud has hit:
- OpenSearch
- Mistral AI
- Guardrails AI
-UiPath
- Squawk packages across npm and PyPI
The malware specifically targets AI developer tooling. It hooks into Claude Code (.claude/settings.json) and VS Code (.vscode/tasks.json) to re-execute on every tool event, long after the infected package is gone. npm uninstall does not fix this.
‼️🚨 BREAKING: A new npm supply-chain attack uses a dead-man's switch. The payload plants a watcher on your machine that nukes your home directory the second you revoke the GitHub token it stole from you.
The compromise happened today, across 42 official tanstack npm packages, 84 malicious versions in total. tanstack/react-router alone pulls more than 12 million weekly downloads.
The attacker forked TanStack's repository and pushed a single hidden commit. From there, they tricked TanStack's own release system into signing the malicious packages as if they were the real thing. To npm, and to anyone checking the cryptographic proof of origin (SLSA provenance), the poisoned versions looked 100% legitimate.
Maintainer Tanner Linsley confirmed the whole team had 2FA enabled. It didn't matter. This is the first documented npm worm in history that ships with a valid, signed certificate of authenticity, the same one defenders rely on to know a package wasn't tampered with.
Ryan retweeted
Electrobun is a new cross-platform runtime for desktop apps ✨
Electron mostly uses C++ to embed Node.js & Chromium.
Electrobun uses Zig to embed Bun and - like Tauri - relies on the OS default web renderer.
🔷 Write apps in TypeScript
🧱 Process isolation
⚖️ 12MB base install
Ryan retweeted
HTML might be getting a new type of tag, which… hasn't happened this millennium!
It looks like this: <?marker name="…">
See the video in the next post for a quick intro to how it works.
Ryan retweeted
🚦 NEW: Limit Orders 2.0 - live now on TELEMETRY + BONKbot
Brand new Limit Order engine.
Faster, accurate, reliable execution.
- Manage seamlessly across web, mobile and TG
- TG push notifications for filled orders
- Active for all TP, SL and Trailing SL orders + Auto Strat
Ryan retweeted
With support from our friends at @Netlify & @Webflow, we’re proud to back two essential open-source projects: @Astrodotbuild (for creating high-performance content sites) and @tan_stack (for building dynamic, complex web apps). We believe building the future of the web, together, and can’t wait to see what you build!
Ryan retweeted
The new if() selector in CSS lets you write conditional styles inline.
You can also switch based on custom properties:
Drift has moved.
@delvtech/drift is now @gud/drift. Same package, same features, same maintainer, just a new home as DELV winds down.
Update your imports to keep getting the latest features and fixes.
github.com/ryangoree/drift
Ryan retweeted
The @ethereumfndn is hiring a developer tooling coordinator 🛠️
You'll help us decide what to build, fund and support across the ecosystem!
Ideal candidate has technical experience across the Ethereum stack, an intuition for how dev tooling should evolve, and some ops chops 👇
Ryan retweeted
Anon, you're missing out.
If you're building a high-performance app that consumes a lot of on-chain data - you should 100% be using Drift
github.com/delvtech/drift
Ryan retweeted
Node excitement 😉
This is the first ever Node LTS release to have TypeScript support available by default 🎉🎉🎉
No opt-in flag. No warning message. It just works.
@satanacchio is the MVP on this one. He worked for a year to get this done, building consensus & shipping code.
Node.js v22.18.0 is out 🎉
Type stripping is enabled by default 🔥🔥🔥🔥
You can just run `node file.ts` without `--experimental-strip-types` flag.
nodejs.org/en/blog/release/v…
Ryan retweeted
1/ We're building the next generation of decentralized storage. Designed for long-term durability, verifiability, and speed.
Asking AI about yourself is the new horoscope.
"OMG y'all, ChatGPT thinks I'm deeply thoughtful, strategic, and extra special! What does yours say about you?"
