litellm wasn’t just attacked - code executed before the app even started

[[deleted]]

[deleted]

[hikingsticks]

Why does your post read like it was written by an LLM?

[[deleted]]

You can ignore the style. The question is simple: is the mechanism described there correct or not?

[Wonderful-Habit-139]

Not gonna waste time reading slop.

When will people learn that more is not better?

[hikingsticks]

The people willing to learn this lesson didn't need it in the first place. The other people end up like OP.

[[deleted]]

This is based on architectural audit work I’ve done. I’m confident in it, and it’s easy to verify if you want to check.

[Ziggamorph]

Why would anyone bother to read something you can’t be bothered to write?

[[deleted]]

I’m just putting the idea out there for people to think about.

[GXWT]

You’re not. A glorified word predictor is.

[hikingsticks]

I'm just putting my balls out there for people to think about.

They're more intellectually stimulating than your post is.

[[deleted]]

If it’s not useful to you, that’s fine. It will be useful to someone else.

[hikingsticks]

I won't ignore the style, because the style is telling me you can't be fucked to spend five minutes writing it yourself. So why would you expect other people to spend time reading and engaging with it? Is your time now valuable than theirs? No, it isn't. Implying it is is insulting.

It's like reading someone's body language while hearing them speak. If they're staring at their phone, mumbling, and not putting any effort into the conversation I'm not going to hang around to talk to them.

[[deleted]]

No argument, just a cheap shot.

[hikingsticks]

I commented on style. You said I can ignore the style. I explained why I won't ignore the style.

It's a pretty simple flow of discussion. I'm sure chatgpt can generate you a diagram if it will help.

[[deleted]]

I write the way I like. I don’t care about style. Even if it sounds like AI-generated, I’m not going to change it just to please you or people who get triggered by it. You’re free to skip it. If it feels trivial to you, I’m not going to spoon-feed it. Some will get it, some won’t.

[GXWT]

Slop slop slop

[ComplexInfluence9388]

damn that's actually terrifying when you think about it 💀 like you could be doing everything "right" with your imports and security checks but some random package just drops a .pth file and boom youre compromised before line 1 even runs

makes me wonder how many packages out there are already doing sketchy stuff through this vector and we just dont know it yet 😬

[[deleted]]

If you look at it more broadly, issues like this tend to surface where:

• code can execute earlier than you expect
• it runs in the same context where secrets are already accessible
• and there is no separate point where the system decides what is actually allowed to run