Tilde Swiñton

@frandroid

Zine dude. Web dev. Ⓐ with DemSoc leanings. AF af. Canadien français. Toronto. #GoHabsGo #BlackSails 🪶☀️🍉 Born at 332ppm.

2.017 Folgt1.556 Follower6.160 Posts

Instagram Instagram YouTube Bluesky

Ist das dein Profil?Übernimm es — dann gehört dir frandroid.dirty.social.Profil übernehmen

Tilde Swiñton@frandroid· 25d

... and a brief video showing you how the pearlescent cat-eye shines in the sun :) 2/2

Tilde Swiñton@frandroid· 25d

My new claws, let me show them to you!!! 1/2

a photo of my freshly-made acrylic gel nails, with a pearly cat-eye backing, and torn panty hose print overlaid on top.

Tilde Swiñton@frandroid· 27d

Screenshot of a YouTube comment:
We got grindcore on Tiny Desk before GTA 6

Tilde Swiñton@frandroid· Jun 20

I'm not American so I couldn't chart Toronto, but I was scouting border communities, and wow does Burlington have a different story than the average

Burlington's yearly temperature average graphic, with the color representing whether it's warmer or cooler than the historical baseline. On top of following the global warming trend, it looks like Burlington had a 10 year heatwave in the 1890s...

Tilde Swiñton@frandroid· Jun 20

fun game. the size doesn't re-adjust quite well in Firefox Android :( (though it's still playable)

Tilde Swiñton@frandroid· Jun 11

Did a nearby weather station just get doused by a sprinkler??

Photo of my plants being doused in sunlight, with my dirty windows in the background.

screen capture of my weather app, pretending that it's pouring heavy rain right now

When capture of the weather radar, showing no precipitation within 100+km

Tilde Swiñton@frandroid· Jun 6

alt text 3/3

Third, we examine the meaning of power in international politics. Should power be conceived of in primarily military terms, or in economic or cultural terms? Who are the great powers of today, and of tomorrow? Should the United States strive for hegemony in the international system? What is power for? Fourth, we will consider the significance of democracy for international politics. Are democracies more peaceful? Will the spread of democracy make the world more peaceful? Is liberal democracy an appropriate or desirable form of government for all cultures and societies? Is there a necessary conflict between democracies and non-democracies? Between the West and non-Western cultures? Is the world dividing into two zones, one of democracy and prosperity, the other of war and chaos? Is it possible to create democratic forms of international governance to meet the demands of globalization? Finally, we explore the implications of globalization on the structure of the international system. Does the extraordinary transformation of communications technology, global finance, transnational business, the environment, international institutions, among other changes, mean that we need entirely new theories of international politics?

Tilde Swiñton@frandroid· Jun 1

savesneakydees.com

Tilde Swiñton@frandroid· May 28

What would Métis in Cyberspace do??

Tilde Swiñton@frandroid· May 24

Inside view of a salad spinner, or efficient form of public transportation? you decide.

Photo of the interior of a TTC Flexity streetcar, framed to focus on all the holding posts rather than the open space.

Tilde Swiñton@frandroid· May 14

MOTHER OF GOD that's nuts. #GoHabsGo

Screen capture of a comment from one "Droo Ranalloo" on Facebook:

Only player that can't wear all of his Stanley Cup rings at once. Has to carry the eleventh one in his "pocket".

Tilde Swiñton@frandroid· Apr 21

Seen in image: Vandalized version of @danambra.mov's post:

i think quoting is better with screenshotting. if you’re inviting someone into pvp mode they shouldn't be able to run away like a coward. you should be able to keep staring at their dead carcass. harsh but fair

Not seen in image, the original post, without my vandalism:
i think quoting is better without screenshotting. it’s like you’re inviting someone into pvp mode but they should be able to abandon your quest and then you just get an ugly tombstone. harsh but fair

Tilde Swiñton@frandroid· Apr 17

surprise Chuck Taggart appearance in Vintage Spirits and Forgotten Cocktails, 2009

Picture of a young Chuck Taggart wearing some sort of Panama hat, with a link to his old page, gombopages.com/looks , dated 1999, and a short biography.

Tilde Swiñton@frandroid· Apr 7

The flag of the European Union, showcasing 12 stars, which is the current number of member states.

Tilde Swiñton@frandroid· Mar 25

Gupta's tweet was a long quote-tweet of an Andrej Karpathy tweet, linked here, and posted in screenshots and alt-text. xcancel.com/karpathy/sta...

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

Tilde Swiñton@frandroid· Mar 25

Screencaps of Aakash Gupta's post on X (screencapped from XCancel, where you don't need to login to see tweets)

Someone just poisoned the Python package that manages AI API keys for NASA, Netflix, Stripe, and NVIDIA.. 97 million downloads a month.. and a simple pip install was enough to steal everything on your machine.

The attacker picked the one package whose entire job is holding every AI credential in the organization in one place. OpenAI keys, Anthropic keys, Google keys, Amazon keys… all routed through one proxy. All compromised at once.

The poisoned version was published straight to PyPI.. no code on GitHub.. no release tag.. no review. Just a file that Python runs automatically on startup. You didn’t need to import it. You didn’t need to call it. The malware fired the second the package existed on your machine.

The attacker vibe coded it… the malware was so sloppy it crashed computers.. used so much RAM a developer noticed their machine dying and investigated. They found LiteLLM had been pulled in through a Cursor MCP plugin they didn’t even know they had.

That crash is the only reason thousands of companies aren’t fully exfiltrated right now. If the code had been cleaner nobody notices for weeks. Maybe months.

The attack chain is the part that gets worse every sentence.

TeamPCP compromised Trivy first. A security scanning tool. On March 19. LiteLLM used Trivy in its own CI pipeline… so the credentials stolen from the SECURITY product were used to hijack the AI product that holds all your other credentials.

Then they hit GitHub Actions. Then Docker Hub. Then npm. Then Open VSX. Five package ecosystems in two weeks. Each breach giving them the credentials to unlock the next one.

The payload was three stages.. harvest every SSH key, cloud token, Kubernetes secret, crypto wallet, and .env file on the machine.. deploy privileged containers across every node in the cluster.. install a persistent backdoor waiting for new instructions.

TeamPCP posted on Telegram after: “Many of your favourite security tools and open-source projects will be targeted in the months to come.. stay tuned.”

Every AI agent, copilot, and internal tool your company shipped this year runs on hundreds of packages exactly like this one… nobody chose to install LiteLLM on that developer’s machine. It came in as a dependency of a dependency of a plugin. One compromised maintainer account turned the entire trust chain into a credential harvesting operation across thousands of production environments in hours.

The companies deploying AI the fastest right now have the least visibility into what’s underneath it.

Tilde Swiñton@frandroid· Mar 19

#PodcastFriday - Race, genre, pouvoir : où va la société ? Entrevue en deux parties sur l'intersectionnalité sur le balado Sismique, avec un hôte qui devrait en savoir plus et une invitée très intéressante, une des animatrices du vieux podcast Kiffe ta race. Partie 1 - pod.link/1361158683/e...

Photo de Rokhaya Diallo en noir et blanc. Elle est une femme noire avec des dreads au boûts blonds attachés sur sa tête, elle porte de jolies boucles d'oreilles épaisses, et regarde la caméra avec confiance, menton sur la main.

Tilde Swiñton@frandroid· Mar 18

Colorized photo of Marshall Zhukov in uniform, wearing an obscene number of military medals on his uniform.

Tilde Swiñton@frandroid· Feb 28

"Two guys pointing" meme overlaid a photo of a dirigible in the sky, with "Zeppelins mentioned!" I'm red arial text written between them.

Tilde Swiñton@frandroid· Feb 22

Look at this beauty.

1990s red Honda Civic with some sort of stock spoiler.

Tilde Swiñton@frandroid· Jan 29

crosspost from the fediverse: cofe.rocks/notice/B2gUB...

Screenshot of a fediverse post by @snow:

« new tech war crime:

ppl always complain that the clock on my microwave never shows the right time because I can't be assed to set it manually

so now I have an unfuck-microwave.sh cronjob which briefly kills its power every day at midnight »

Two images are included:

1) power bar with the microwave's electrical plug set in some sort of remotely programmable domotics pass-through socket
2) a screen capture of a terminal, one line setting up a daily cronjob to turn off the power, and a nearly identical one turning the power back on

Tilde Swiñton@frandroid· Jan 26

Wait, what? :) #HeatedRivalry #rave

Screenshot of an article: « Jacob Tierney: We just saw Connor on Saturday. He’s very offline in a healthy way and he was like, “I think it just hit me how big this show is.” On Friday, he was driving around L.A. and saw a lineup that was like four blocks long to get into a “Heated Rivalry” rave. I was »

The words "Heated Rivalry rave" are highlighted.

Screenshot of a different article's title and lede:

‘Heated Rivalry’ Raves Become Nationwide Phenomenon
Club 90s launched its first ‘Heated Rivalry’ dance party on January 2. Within weeks, 150 events were booked nationwide for fans to celebrate the queer hockey romance together.

Tilde Swiñton@frandroid· Jan 24

Stock photography. Photo of a sign being held up by someone. In stylized grey text on a red background, it says "NOT AFRAID TO STRIKE"

Tilde Swiñton@frandroid· Jan 20

New year, new home, new girlfriend, new copper nails.

Picture of my hands, featuring my copper-coloured chromed fingernails.

Tilde Swiñton@frandroid· Jan 2

Hi @pod.link! Your site is buggy when viewed in Firefox for Android. The search field is nowhere on the screen.

Tilde Swiñton@frandroid· Jan 1

Merriam-Webster. Your 2026 Word: besotted.

Tilde Swiñton@frandroid· Dec 26

Hi @theeagleist.bsky.social, I tried to buy stuff on your shop but it doesn't seem to add postage, is that right? It could be some sort of PayPal bug with my address but I wanted to check. I'm getting a can and a patch shipped to Toronto.

Tilde Swiñton@frandroid· Dec 13

🙃

Tilde Swiñton@frandroid· Dec 3

Look at how clever @evernote.bsky.social is. This screen showed up after I set up 2FA in Evernote and saw the provided backup codes. #UI

Screenshot of an Evernote model dialog.
Title: Enter a Backup Code
Prompt: Enter one of your backup codes from the previous screen to confirm you have a copy. This [code] will remain valid after setup.
[Input field]
Buttons: Back, Cancel, Complete Setup.

Tilde Swiñton@frandroid· Nov 8

"Beautifully depicts the duality of America and shit, eh?" www.instagram.com/reel/DQsWCGb...