IMHO defaults for uv, npm, etc should all have a cooldown for 24 - 48 hours by default, you should have to go out of your way to install something newer.
Why on earth do these people make it impossible to select the title of their article?
Seriously again for litellm? I really with that things like Google ADK didn't add this to my deps.
> There currently exists a private LiteLLM registry for enterprise customers, in which we are distributing an embargoed release that remediates a vulnerability whose disclosure date is scheduled for October 27.
https://github.com/BerriAI/litellm/issues/47826
oh boy.
I wish all the best to LiteLLM team with handling it again. I can imagine how challenging are situations like this one.
However, if anyone is looking for 20x faster and less "targeted" LiteLLM alternative - I'm work on one in Go. That's why GoModel it's called. https://github.com/ENTERPILOT/GoModel/
Sounds like a reasonable choice of a language.
I myself have written a small llm proxy in Go, doing nothing but injecting the real API key to outgoing requests while itself validating virtual keys it generates, and it works great.
Definitely it was a deliberated decision. Also enterprises adapt Go more and more.
Again! Yikes.
Twice? uiuiui
So in just 1 week:
1. Google Cloud Outage [0]
2. eMudhra CA private key Leak [1]
3. PingCap TiDB 10.6 TB data Leak [2]
4. PHP2Shell uncovers critical CVEs (with AI) [3]
...and now we have Round 2 of a LiteLLM compromise after the first one in [4].
[0] https://news.ycombinator.com/item?id=50163961
[1] https://news.ycombinator.com/item?id=50166579
[2] https://news.ycombinator.com/item?id=50173716
[flagged]
[flagged]
[flagged]
[flagged]
I didn't realize they've all such added that, this was a change we made to our own projects last year when these first started - glad to see it's common.
Risk is ensuring enough security researchers are finding these and quarantining these before that default cooldown lapses.