Yet another Hacker News

However, if anyone is looking for 20x faster and less "targeted" LiteLLM alternative - I'm work on one in Go. That's why GoModel it's called. https://github.com/ENTERPILOT/GoModel/

ghrl 1 hour ago | parent

Sounds like a reasonable choice of a language.

I myself have written a small llm proxy in Go, doing nothing but injecting the real API key to outgoing requests while itself validating virtual keys it generates, and it works great.

santiago-pl 1 hour ago | parent

Definitely it was a deliberated decision. Also enterprises adapt Go more and more.

TZubiri 46 minutes ago | parent

If you don't use any LLM router, it's infinity times faster, and infitesimally as targetted.

jiwidi 1 hour ago | parent

Twice? uiuiui

0xbadc0de5 1 hour ago | parent

Again! Yikes.

stbenjam 1 hour ago | parent

IMHO defaults for uv, npm, etc should all have a cooldown for 24 - 48 hours by default, you should have to go out of your way to install something newer.

rcleveng 1 hour ago | parent

I didn't realize they've all such added that, this was a change we made to our own projects last year when these first started - glad to see it's common.

Risk is ensuring enough security researchers are finding these and quarantining these before that default cooldown lapses.

robinhoodexe 1 hour ago | parent

We have 7d cooldown on packages on an internal pypi proxy but that blocks security updates also, which we now have to manually exclude from the cooldown.

I’m unsure how to automate this properly, maybe an LLM is the best starting point.

mbrumlow 48 minutes ago | parent

Are security updates immune ?

fmbb 44 minutes ago | parent

It’s in the name. They are secure!

dlkasajiewo 36 minutes ago | parent

No, but there's a bigger tradeoff for not upgrading. In one case it's that you're potentially exposed to a known vulnerability, vs the other case where you might just be missing out on some new or slightly reworked feature.

mattstir 36 minutes ago | parent

But then an attacker marks their malicious release as a critical security update. It's really messy unfortunately.

tikkabhuna 34 minutes ago | parent

They definitely wouldn't be if attackers knew that it would then bypass cooldowns!

Ultimately, you need someone to verify releases and that probably means paying for it. I know Sonatype paid solutions utilise their own internal research to allow/block new releases.

trollbridge 31 minutes ago | parent

Problem is, we leave ourselves open for LLM injection attacks.

giancarlostoro 1 hour ago | parent

I wonder if in some cases it's not so much that people are updating too quickly, but rather, their deployment pipelines do not have pinned / frozen versions attached to their builds.

petesergeant 1 hour ago | parent

> There currently exists a private LiteLLM registry for enterprise customers, in which we are distributing an embargoed release that remediates a vulnerability whose disclosure date is scheduled for October 27.

https://github.com/BerriAI/litellm/issues/47826

oh boy. Announcing that there's a private enterprise repo you should be paying for if you don't want a credential stealer in your build is quite the optic, and then announcing there's an undisclosed second vulnerability that's being distributed, just not to the poors...

sullivanmatt 1 hour ago | parent

That's not what's being said, at all. They are simply telling their enterprise customers that there is a different build pathway for the enterprise builds and that pathway wasn't impacted by this issue.

Also if you don't like organizations fixing vulns without releasing the open source first, you're going to be upset when you learn how every major vuln and associated patches are distributed long before the fixes hit the repos. A timely example of this is PHP, literally today.

petesergeant 50 minutes ago | parent

> A timely example of this is PHP, literally today.

Sorry, there was a paid-for PHP release that fixed it I could have gotten a week ago, and that they publicly announced existed, and it was just people who don't pay for PHP who had to wait...?

sullivanmatt 30 minutes ago | parent

Yeah, that's how many companies with open ecosystems work. If you're using e.g. RedHat, you are getting packages with embargoed fixes baked into them before those fixes hit public repos. Node.js, OpenSSL, Git itself all do this.

You can argue about whether the "publicly announced existed" part since they don't advertise for any single package, but that's the ecosystem you buy into.

petesergeant 17 minutes ago | parent

> If you're using e.g. RedHat, you are getting packages with embargoed fixes baked into them before those fixes hit public git repos.

The way you've written this is substantially misleading. RedHat receives notice of the vulnerabilities so they can prepare packages to be available the moment the embargo lifts, which I guess technically could hit the public packages a tiny bit earlier, but they are not releasing fixes of embargoed vulnerabilities to their commercial clients before the embargo lifts.

This is substantially different from the policy I've quoted that I am objecting to.

callamdelaney 1 hour ago | parent

Why on earth do these people make it impossible to select the title of their article?

tech_solver 1 hour ago | parent

its litellm again. I wonder about maintainer trustworthiness

infecto 1 hour ago | parent

Any package hosts that scan and include cooldowns by default that operate on a consumption model? The ones I have seen all charge a lot.

cyanydeez 55 minutes ago | parent

man, people are going to be sorely disappointed in what's free on the internet in a couple of years.

Agents and malware will eradicate all goodwill left.

Good by internet.

abhisek 48 minutes ago | parent

Not sure about a service, but PMG enforces dependency cooldown and sandbox on package install. https://github.com/safedep/pmg

TZubiri 47 minutes ago | parent

Socket.dev

Tell em Tom Zubiri sent ya (I don't get a commission, just good karma)

edoceo 5 minutes ago | parent

This one ? https://news.ycombinator.com/item?id=46909037

I use it, I don't cooldown, proper version pinning for me.

baddash 55 minutes ago | parent

litellm in the news again

TZubiri 50 minutes ago | parent

What's interesting here is that this will only affect those who did not migrate off LiteLLM after it was attacked the first time.

I'm not saying everyong should migrate after there's a vuln, but I'm definitely saying that. Unless it's something huge and foundational like a programming language (PHP gets a second chance), just migrate within the next couple of weeks.

I didn't even have it installed the first time, so the ideal programmers, (read, your competition), actually suffered 0 vulns from this dep, if you suffered 1, that's already pretty bad, being burnt twice should be a wake up call. If you get hit 3 times by the same dependency, it's a lost case.

john_strinlai 42 minutes ago | parent

>PHP gets a second chance

second? i haven't kept count, but we have to be somewhere in the hundreds of chances now

wongarsu 41 minutes ago | parent

As someone who does not use litellm but instead a barely maintained underpowered alternative: what did everyone migrate to?

If it matters, I am mostly interested in the aspect of having a proxy that unifies multiple ollama and openai-compatible endpoints with model-based routing and failover. Optionally with api-keys, reporting, budgets, etc. I do not particularly care about the MCP gateway, Agent-To-Agent thingy, and whatever else LiteLLM bolted on over time

tkz1312 39 minutes ago | parent

Claude will write you something custom that fits your exact requirements with zero supply chain risk in an afternoon.

spike021 25 minutes ago | parent

how is there zero supply risk? claude will still package dependencies into a homemade solution at some level...

tkz1312 22 minutes ago | parent

sure zero was a bit strong, but I personally feel pretty good about depending on only the go stdlib, compared to pulling in litellm.

connorbrinton 16 minutes ago | parent

Pydantic AI has a great set of abstractions over LLM providers. The documentation tends to focus on its agent loop more, but I find the LLM abstractions quite nice even on their own

dannyboland 9 minutes ago | parent

After the last LiteLLM compromise, I took my requirement (an OpenAI compatible endpoint routing across multiple providers based on latency) and built that as a small static Rust binary - https://github.com/sturnus-dev/sturnus

Now that AI makes it cheaper to build such tools in-house, the case for adopting a maximalist framework and trusting that entire supply chain is a lot weaker.

syntaxing 53 minutes ago | parent

I figured LLMs nowadays would be good enough to catch issues like this. Is it because it’s too costly to do it?

abhisek 49 minutes ago | parent

Yes if you use LLM to analyse everything. Not really if you analyse diffs, with heuristics to select candidates for LLM/agent based analysis. But at the cost of missing out novel attacks.

bcvvvy 49 minutes ago | parent

Fuck this week.

zxilly 10 minutes ago | parent

Welcome to the AI era, every week in the near future

hmokiguess 32 minutes ago | parent

https://github.com/BerriAI/litellm/issues/47826#issuecomment...

> OSS Users > For the time being, please pin your version to 1.106.2 or any explicit version published prior to now.

> Enterprise Customers > There currently exists a private LiteLLM registry for enterprise customers, in which we are distributing an embargoed release that remediates a vulnerability whose disclosure date is scheduled for October 27. Our private registry is not affected. If you are an enterprise customer pulling from our private registry you are not affected.

1-6 23 minutes ago | parent

This is the 2nd time. I'm glad I moved away from this platform.

SomaticPirate 20 minutes ago | parent

Second f**king time. Just torching their reputation at this point

madamelic 15 minutes ago | parent

I am not following how someone snuck the files into the release.

All I read was that it creates a directory from the build file but seemingly no description how new files or added dependencies slipped by. Was `cook.pth` a dependency that got automatically downloaded from PyPI on install and then the build system put it into dependencies?

Leaving this for others:

> BerriAI’s private release pipeline built these wheels from an attacker-modified git source. The attacker could have used a compromised maintainer or bot credential, a private branch or mirror, or the reference the pipeline builds from. A stolen PyPI token used from the attacker’s own machines fits the evidence less well.

Makes sense. It was that a maintainer or the private pipeline was attacked and the malicious dependency was injected there by squatting on the maintainer's local copy rather than the dependency being hijacked for everyone. Very clever.

1vuio0pswjnm7 6 minutes ago | parent

1792590200 | LiteLLM Hijacked: Malicious 1.107.0 Wheels Steal Credentials | https://research.jfrog.com/post/litellm-hijacked-again/ | https://news.ycombinator.com/item?id=50180838 | 0 comments

1792590232 | Litellm 1.107.0 Compromised | https://github.com/BerriAI/litellm/issues/47826 | https://news.ycombinator.com/item?id=50180845 | 0 comments