iiinova — where your digital self keeps evolving

Tilde Swiñton @frandroid.tabnet.ca · 21/09/2026

Describe your Bluesky account with a single image

Photo of a young man dressed in black, cropped to his arms, lighting up a Molotov cocktail in his hand, rag already on fire, with the caption:
Be the light you want to see in the world

120

Tilde Swiñton @frandroid.tabnet.ca · 04/09/2026

Israelis kind of justifying the French couple's ban here... newbloommag.net/2026/08/29/i...

Text: Most notable among the tunes in rotation: a confrontation over a zoo on the island of Koh Samui, where a Thai-French couple refused entry to a group of Israelis. By the time the smoke cleared –and there was actual smoke–Israelis had made death threats, a 500,000 baht bounty had been placed on the couple running the business, and the Israeli ambassador had met with provincial officials to insist Israeli tourists be protected, just in time for the Thai-French family’s home in France to be set ablaze.

Article headline: The Polyrhythm of Israeli Entitlement in Thailand, by Micah Rieder, in New Bloom.

010

Tilde Swiñton @frandroid.tabnet.ca · 12/08/2026

Opening up the first message to all members is not going to make for better matches, and becoming like the other dating apps is not going to overcome dating-app fatigue, far from it...

screenshot of text from the article: The overhaul comes as Bumble faces pressure to modernise amid slowing growth and wider signs of dating-app fatigue.

220

Tilde Swiñton @frandroid.tabnet.ca · 28/07/2026

Spadina Subway Station, Kendal avenue entrance, Toronto. Also known as the Norman B. Gash House. One of the cutest subway entrances in the city.

Photo of the Norman B. Gash House cum Spadina Station Entrance. It is a Queen Anne Revival house made of red bricks, and features arched doorways. On the right side of the house, there is an ad panel and a Toronto Bike Share stand.

0314

Tilde Swiñton @frandroid.tabnet.ca · 17/07/2026

... and a brief video showing you how the pearlescent cat-eye shines in the sun :) 2/2

110

Tilde Swiñton @frandroid.tabnet.ca · 17/07/2026

My new claws, let me show them to you!!! 1/2

a photo of my freshly-made acrylic gel nails, with a pearly cat-eye backing, and torn panty hose print overlaid on top.

120

Tilde Swiñton @frandroid.tabnet.ca · 20/06/2026

I'm not American so I couldn't chart Toronto, but I was scouting border communities, and wow does Burlington have a different story than the average

Burlington's yearly temperature average graphic, with the color representing whether it's warmer or cooler than the historical baseline. On top of following the global warming trend, it looks like Burlington had a 10 year heatwave in the 1890s...

110

Tilde Swiñton @frandroid.tabnet.ca · 20/06/2026

fun game. the size doesn't re-adjust quite well in Firefox Android :( (though it's still playable)

010

Tilde Swiñton @frandroid.tabnet.ca · 11/06/2026

Did a nearby weather station just get doused by a sprinkler??

Photo of my plants being doused in sunlight, with my dirty windows in the background.

screen capture of my weather app, pretending that it's pouring heavy rain right now

When capture of the weather radar, showing no precipitation within 100+km

000

Tilde Swiñton @frandroid.tabnet.ca · 28/05/2026

What would Métis in Cyberspace do??

010

Tilde Swiñton @frandroid.tabnet.ca · 24/05/2026

Inside view of a salad spinner, or efficient form of public transportation? you decide.

Photo of the interior of a TTC Flexity streetcar, framed to focus on all the holding posts rather than the open space.

030

Tilde Swiñton @frandroid.tabnet.ca · 18/04/2026

surprise Chuck Taggart appearance in Vintage Spirits and Forgotten Cocktails, 2009

Picture of a young Chuck Taggart wearing some sort of Panama hat, with a link to his old page, gombopages.com/looks , dated 1999, and a short biography.

000

Tilde Swiñton @frandroid.tabnet.ca · 25/03/2026

Gupta's tweet was a long quote-tweet of an Andrej Karpathy tweet, linked here, and posted in screenshots and alt-text. xcancel.com/karpathy/sta...

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

210

Tilde Swiñton @frandroid.tabnet.ca · 25/03/2026

Screencaps of Aakash Gupta's post on X (screencapped from XCancel, where you don't need to login to see tweets)

Someone just poisoned the Python package that manages AI API keys for NASA, Netflix, Stripe, and NVIDIA.. 97 million downloads a month.. and a simple pip install was enough to steal everything on your machine.

The attacker picked the one package whose entire job is holding every AI credential in the organization in one place. OpenAI keys, Anthropic keys, Google keys, Amazon keys… all routed through one proxy. All compromised at once.

The poisoned version was published straight to PyPI.. no code on GitHub.. no release tag.. no review. Just a file that Python runs automatically on startup. You didn’t need to import it. You didn’t need to call it. The malware fired the second the package existed on your machine.

The attacker vibe coded it… the malware was so sloppy it crashed computers.. used so much RAM a developer noticed their machine dying and investigated. They found LiteLLM had been pulled in through a Cursor MCP plugin they didn’t even know they had.

That crash is the only reason thousands of companies aren’t fully exfiltrated right now. If the code had been cleaner nobody notices for weeks. Maybe months.

The attack chain is the part that gets worse every sentence.

TeamPCP compromised Trivy first. A security scanning tool. On March 19. LiteLLM used Trivy in its own CI pipeline… so the credentials stolen from the SECURITY product were used to hijack the AI product that holds all your other credentials.

Then they hit GitHub Actions. Then Docker Hub. Then npm. Then Open VSX. Five package ecosystems in two weeks. Each breach giving them the credentials to unlock the next one.

The payload was three stages.. harvest every SSH key, cloud token, Kubernetes secret, crypto wallet, and .env file on the machine.. deploy privileged containers across every node in the cluster.. install a persistent backdoor waiting for new instructions.

TeamPCP posted on Telegram after: “Many of your favourite security tools and open-source projects will be targeted in the months to come.. stay tuned.”

Every AI agent, copilot, and internal tool your company shipped this year runs on hundreds of packages exactly like this one… nobody chose to install LiteLLM on that developer’s machine. It came in as a dependency of a dependency of a plugin. One compromised maintainer account turned the entire trust chain into a credential harvesting operation across thousands of production environments in hours.

The companies deploying AI the fastest right now have the least visibility into what’s underneath it.

580

Tilde Swiñton @frandroid.tabnet.ca · 19/03/2026

#PodcastFriday - Race, genre, pouvoir : où va la société ? Entrevue en deux parties sur l'intersectionnalité sur le balado Sismique, avec un hôte qui devrait en savoir plus et une invitée très intéressante, une des animatrices du vieux podcast Kiffe ta race. Partie 1 - pod.link/1361158683/e...

Photo de Rokhaya Diallo en noir et blanc. Elle est une femme noire avec des dreads au boûts blonds attachés sur sa tête, elle porte de jolies boucles d'oreilles épaisses, et regarde la caméra avec confiance, menton sur la main.

100

Tilde Swiñton @frandroid.tabnet.ca · 29/01/2026

crosspost from the fediverse: cofe.rocks/notice/B2gUB...

Screenshot of a fediverse post by @snow:

« new tech war crime:

ppl always complain that the clock on my microwave never shows the right time because I can't be assed to set it manually

so now I have an unfuck-microwave.sh cronjob which briefly kills its power every day at midnight »

Two images are included:

1) power bar with the microwave's electrical plug set in some sort of remotely programmable domotics pass-through socket
2) a screen capture of a terminal, one line setting up a daily cronjob to turn off the power, and a nearly identical one turning the power back on

032

Tilde Swiñton @frandroid.tabnet.ca · 20/01/2026

New year, new home, new girlfriend, new copper nails.

Picture of my hands, featuring my copper-coloured chromed fingernails.

040

Tilde Swiñton @frandroid.tabnet.ca · 02/01/2026

Hi @pod.link! Your site is buggy when viewed in Firefox for Android. The search field is nowhere on the screen.

110

Tilde Swiñton @frandroid.tabnet.ca · 26/12/2025

Hi @theeagleist.bsky.social, I tried to buy stuff on your shop but it doesn't seem to add postage, is that right? It could be some sort of PayPal bug with my address but I wanted to check. I'm getting a can and a patch shipped to Toronto.

100

Tilde Swiñton @frandroid.tabnet.ca · 03/12/2025

Look at how clever @evernote.bsky.social is. This screen showed up after I set up 2FA in Evernote and saw the provided backup codes. #UI

Screenshot of an Evernote model dialog.
Title: Enter a Backup Code
Prompt: Enter one of your backup codes from the previous screen to confirm you have a copy. This [code] will remain valid after setup.
[Input field]
Buttons: Back, Cancel, Complete Setup.

010

Tilde Swiñton @frandroid.tabnet.ca · 08/11/2025

"Beautifully depicts the duality of America and shit, eh?" www.instagram.com/reel/DQsWCGb...

010

Tilde Swiñton @frandroid.tabnet.ca · 04/11/2025

You need better cable management!

110

Tilde Swiñton @frandroid.tabnet.ca · 31/10/2025

@pastures.myatproto.social You've disabled a lot of engagement (replies, quoting) for your followers, so... There are also labelers that mask or block posts with fundraising links.

100

Tilde Swiñton @frandroid.tabnet.ca · 14/09/2025

Things you find in a restaurant bathroom

Photo of a large metal barrel labeled "Used Cooking Oil Only"

220

Tilde Swiñton @frandroid.tabnet.ca · 29/08/2025

Got some siiiiiick cateye gel nails and I'm totally digging them. Embraced the Bowser look on the thick spikes, but it doesn't look as good as I thought it would. My nail worker called it "interesting" LOL. But I'm super happy with the look overall. www.instagram.com/p/DN9KMe6jxm...

020

Tilde Swiñton @frandroid.tabnet.ca · 27/08/2025

Fun times catching Grace Scheele doing her atmospheric/experimental harp thing again at the Tranzac, with a much smaller harp this time.

120

Tilde Swiñton @frandroid.tabnet.ca · 26/08/2025

Man, I love the web. Fuck the web. Look at this kerning mess. I'm sure the click's author tested his stuff properly, but there's something cached somewhere that a shift-cmd-r simply won't refresh...

screenshot from @deck.blue where the font kerning for spaces is NEGATIVE

110

Tilde Swiñton @frandroid.tabnet.ca · 23/08/2025

Sekanjebin @ Pamenar... A Kensington Market classic.

010

Tilde Swiñton @frandroid.tabnet.ca · 17/08/2025

#WildcatStrike!! Solidarity with the Air Canada workers resisting the arrogance of the Carnage government! No to abusive recourse to Back to Work legislation!

Drawing of an angry black cat with the words "Wildcat Strike" surrounding it.

052