Not all updates are equal: wait 24h on pip/npm, patch browsers and OS now
thursdai_pod · x · 2026-10-23
The ThursdAI podcast argues updates shouldn't be treated equally: browsers, OS and phones should be patched immediately, while pip/npm packages are better updated after 24 hours — supply chain attacks like the poisoned LiteLLM release tend to be caught within a day, so waiting avoids installing compromised versions. Guests include @altryne and security expert @theJoshMeister.
More from Safety
- WSJ: OpenAI searched employees' phones and Signal messages before firing 3 safety researchers — lxrjl · 2026-10-23
- Viral cartoon: humans must show 'proof of human' to survive a web of synthetic content — sierracatalina · 2026-10-23
- Researchers call for anti-shredding provisions as AI firms use self-destructing messages — StephenLCasper · 2026-10-23
- 20+ ICLR 2027 submissions self-confess fabricated placeholder results — thegautamkamath · 2026-10-23
- Fired OpenAI safety researchers tell their side in first podcast interview — kevinroose · 2026-10-23
- Why frontier AI labs' bug bounties are cheap: their models flood the supply — lxrjl · 2026-10-23