Today liteLLM was compromised (account accessed by malicious actor?) and a compromised released was published : pypi package and docker image.

Official blog post

The commits have quiet suspicious title with totally suspect content:

• Change greeting
• Update print statement

I went away and decompress the payload on can check the code on this codeberg repository.

From liteLLM github issue:

How it was undermined

• On Monday, we temporarily expanded release permissions to allow two internal engineers to publish daily bugfix backports for customers.
• The attacker had access to three sets of developer github CLI credentials (more on this below). One of which had the ability to run github workflows.
• The attacker tried to merge a change to allow the releaser to be pointed at a different source repository, but was unable to due to our protections. One of the tokens held by the attacker belonged to one of our two Github organization owners. The attacker used this to disable branch protections and force push the change.
• Finally, they ran the compromised workflow, pointed at a lookalike repository (Berri-AI/litellm instead of BerriAI/litellm), which signed and published the poisoned artifacts.

Hello community,

I am allowing myself to open a "casual" conversation here about the fact that I feel like the debates around AI should have been an opportunity for the solarpunk movement to push its discourse yet this community (here on lemmy) feels dead and solarpunk in general too.

I never really interacted with any solarpunk community so far, I believe my first introduction was from Andrewism (https://www.youtube.com/@Andrewism/videos) so probably 3 years ago, maybe 4. I feel like the movement as mainly from "white" people who tends toward "anarchism" (there are many flavors especially if we talk about USA's people anarchism) and missed a lot of political points, instead converging in a vague cultural/artistic idea.

In my opinion the solarpunk movement followed an growth of ecological-related topics. And like many environmental movements failed to be radical enough instead going in a more "centrist" ideology. The amount of corporate-friendly discourse (not here but in general) showed, to me, the origin of the movement and its limits. I am not going to hide the fact that I am in favor of a communist revolution so I always felt like solarpunk seems nice-and-all but misses some big points.

Yet to this day the debates around AI : what technology do we want, from who, for who, should have been a great opportunity for people liking solarpunk to show up but no.

Was solarpunk just a trend? I am genuinely asking here for people that are/were more involved as I see solarpunk as a fight (like feminism/anti-racism/LGBT/ecology/validism/adultism/librism/etc) rather than a full model of society so something I was interested to learn from.

Full quote:

Generative AI and it's applications hold a mirror up to the face of capitalism itself. Under capitalism we are blessed with the miracles of being able to buy anything from anywhere. But behind the curtain lies exploitation.

Ok I don't fully agree with the guy, especially with the "we are blessed with the miracles of being able to buy anything from anywhere" (you are not me/us) but this is good sentence overall and I feel this phrasing might resonate more to western people.

Feel free to share your thoughts if this is a good quote and/or a good video overall.

PS : quote is at 15:46

cross-posted from: https://scribe.disroot.org/post/11942580

Archived version

A report just in from the Kernel Maintainers Summit on 8 October reveals just how full AI slop the Linux kernel project has gone. And so has project leader Linus Torvalds.

...

Nothing really new but this seems a nice summary with sources linked.

Let me know if this kind of articles have value, thus should be shared.

cross-posted from: https://mbin.linuxnation.social/m/[email protected]/t/18361

System76's COSMIC desktop now requires contributors to certify that pull requests contain no LLM-generated content. The new template also adds a Developer Certificate of Origin.

I am sharing my modest Inkscape production. I couldn't get it to render properly into PNG, only gimp can open the SVG and export correctly.

Use this SVG or PNG as much as you wish (EDIT : clean up some metadata):

<?xml version="1.0" encoding="UTF-8" standalone="no"?>

<svg
   width="110mm"
   height="110mm"
   viewBox="0 0 110 110"
   version="1.1"
   id="svg1"
   inkscape:version="1.4.4 (dcaf3e7d9e, 2026-05-05)"
   sodipodi:docname="anti-ai.svg"
   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
   xmlns="http://www.w3.org/2000/svg"
   xmlns:svg="http://www.w3.org/2000/svg"
   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns"
   xmlns:cc="http://creativecommons.org/ns">
  <sodipodi:namedview
     id="namedview1"
     pagecolor="#303030"
     bordercolor="#808080"
     borderopacity="1"/>
  <defs
     id="defs1">
    <rect
       x="87.88"
       y="100.5"
       width="130.6"
       height="107.1"
       id="rect2" />
  </defs>
  <g
     inkscape:label="Layer 1"
     inkscape:groupmode="layer"
     id="layer1">
    <circle
       style="fill:#ffffff;stroke:#fe4a4a;stroke-width:8;stroke-linecap:round;stroke-linejoin:round"
       id="path1"
       cx="55"
       cy="55"
       r="48" />
    <text
       xml:space="preserve"
       id="text2"
       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:78px;line-height:1.25;font-family:'Noto Serif';-inkscape-font-specification:'Noto Serif, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;letter-spacing:0px;word-spacing:0px;white-space:pre;shape-inside:url(#rect2);display:inline"
       transform="translate(-76.84,-92.75)"><tspan
         x="87.88"
         y="175.1"
         id="tspan3"><tspan
           style="font-size:82px"
           id="tspan1">AI</tspan></tspan></text>
    <path
       style="fill:none;stroke:#fe4a4a;stroke-width:8;stroke-opacity:1"
       d="m 21.7,92.34 66.59,-74.68"
       id="path2" />
  </g>
  <metadata
     id="metadata2">
    <rdf:RDF>
      <cc:Work
         rdf:about="">
        <cc:license
           rdf:resource="http://creativecommons.org/licenses/by-sa/4.0/" />
      </cc:Work>
      <cc:License
         rdf:about="http://creativecommons.org/licenses/by-sa/4.0/">
        <cc:permits
           rdf:resource="http://creativecommons.org/ns#Reproduction" />
        <cc:permits
           rdf:resource="http://creativecommons.org/ns#Distribution" />
        <cc:requires
           rdf:resource="http://creativecommons.org/ns#Notice" />
        <cc:requires
           rdf:resource="http://creativecommons.org/ns#Attribution" />
        <cc:permits
           rdf:resource="http://creativecommons.org/ns#DerivativeWorks" />
        <cc:requires
           rdf:resource="http://creativecommons.org/ns#ShareAlike" />
      </cc:License>
    </rdf:RDF>
  </metadata>
</svg>

I am a long-time NoScript extension (https://noscript.net/) user. For those who don't know this automatically blocks any javascript and let you accept them (temporarily or permanently) based on the scripts' origin domain.

NoScript as some quality-of-life option like 'accepting script from current page's domain by default' so only 3rd parties would be blocked (usefull in mobile where it is tedious to go to the menu).

When I saw LibreJS (https://www.gnu.org/software/librejs/) I though that would be a better version of NoScript but it is quiet different in usage and cares about license and not open-source code (maybe it can't).

Am I the only one who thought about checking for open-source JS scripts filtering (at least by default)? This would require reproducibility of 'compilation'/packaging. I think with lock files (npm, yarn, etc) this could be doable and we could have some automatic checks for code.

Maybe the trust system for who checks could be a problem. I wanted to discuss this matter for a while.

Just wanted to share for the 10 people like me who has with an Nvidia + dual screen setup on ArchLinux (btw) with KDE Plasma desktop that since the new plasma 6 update I can finally use the Wayland session option!

The wayland should work has been around for the last 5 years and 5 years ago it was not even close, then 1 or 2 years ago it started not crashing but multi-screen was not OK (I tried all the kernel and driver parameters).

Now for me and my 5+ years-old setup (probably a lot of legacy plasma settings in my .config) it was finally seamless.

From previous tries I already knew that the desktop feels WAY smoother (true 60 fps everywhere, specially for the video players in web browser).

Feels great so far, discord screen-sharing is not there but can be done from Firefox if needed so OK for me.

I hope this post will be informative for some like me who tried several time over the years and didn't had much hope.

PS : the cursor has a weirdly strong outline (too shiny to my taste) feels like unintended but not a big problem. I spent 30 mins in the options but couldn't find anything about that.

The whole channel should have way more views. Science fraud is a topic that scientists knows and talk about but it is always vague and it's hard to point at precises cases due to lack of documentation (and journalists in general).

It's been half a year now at least that this change was introduced and it's super annoying. I discover this behavior on MacOS many years but now this is happening in Linux. Because of that I really want to change browser.

Am I missing a reason for such a change?

Edit: to be clear I always setup Firefox to ask everytime what to do but the open option used to open the file without downloading it (or probably in a tmp folder somewhere) now with the open option you have the file in your download which misses the point of asking in the first place.

I see all the drama around Red-hat and I still don't get why companies would use RHEL (or centos when it existed). I was in many companies and CentOS being years behind was awful for any recent application (GPU acceleration, even new CPU had problems with old Linux kernels shipped in CentOS).

Long story short the only time one of the company I worked in considered CentOS it was ditched out due to many problems and not even being devs/researchers friendly.

I hear a lot of Youtube influencers "talking" (or reading the Red-Hat statements) about all the work Red-Hat is doing but I don't see any. I know I dislike gnome so I don't care they contribute to that.

What I see though is a philosophy against FOSS. They even did a Microsoft move with CentOS (Embrace, extend, and extinguish). I see corporate not liking sharing and collaborating together but aiming at feeding of technology built as a collective. I am convinced they would love to patent science discovery too. I am pretty sure there is a deep gap in philosophy between people wanting "business-grade" Linux and FOSS community.

If you have concrete examples of Red-Hat added value that cannot be fulfilled by independent experts or FOSS community, I'd really like to hear that.