After LiteLLM mess: delay new packages 24h, but install OS updates instantly
altryne · x · 2026-10-23
Following the LiteLLM supply-chain mess, altryne and security expert theJoshMeister discussed where to draw the line on updates:
- Package managers (npm, pip, etc.): put a blocker so nothing less than 24 hours old gets installed, dodging freshly poisoned versions
- Browser, OS and phone: hit the update button immediately — signed official channels are safe, delay only adds risk
The strategies are opposite because the trust models differ: unaudited new packages vs. signed vendor updates.
More from coding & agent
- Benchhand: open-source Rust MCP client with editable tool approvals and per-agent models — AnshSuc · 2026-10-23
- CrawlForge MCP ships 24 releases in 24 days: free failed calls, 1-credit repeat reads — slymes-20 · 2026-10-23
- Hands-on Orq AI review: LLM gateway, evals and guardrails in one EU-hosted platform — FigureReasonable4468 · 2026-10-23
- I spent $200 benchmarking AI bug-fixing: Opus tops at 94%, DeepSeek matches for 1/26 the cost — narrow-adventure · 2026-10-23
- The 20x Cost Trap: Why Enterprises Are Getting AI Agents Completely Wrong — DavidLinthicum · 2026-10-23
- xAI and OpenAI are hiring forward-deployed engineers en masse as agentic data workflows eat consulting — teodorio · 2026-10-23