Highview Apps @highviewapps

Productivity unlock: Le Mans and the new Edition in the same week. Dropping now: The Everywhere Edition. 150+ updates. Highlights in 🧵

@TryMapleAI any plans for 2FA support?

EZ Inventory Update: Change in Shopify Quantity Now Available in the Activity Log Details highviewapps.com/blog/ez-invent… #ShopifyApps #ShopifyInventoryManagement

EZ Inventory Update: Set Inventory Adjustment Reason highviewapps.com/blog/ez-invent… #ShopifyApps #ShopifyInventoryManagement

Webhooks were built for a simpler time. Next Generation Events are built for ours. Choose what triggers your webhook, shape your payload with GraphQL and run filters before it even hits your endpoint. Now in Developer Preview.

@DavisPaipa Yep, it's very rare for anyone to leave a review without support interaction. So if your app just works and you have good docs, it's hard to get reviews. The review archiving makes it even worse if you've been around for a long time (10 years in our case).

Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored). If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update! I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it. Feeling pretty swell about this mentality with all the supply chain attacks happening.

Bragging about how much software you’re shipping with AI is like holding down the shutter button and bragging about how many photos you took.

And now you can access your analytics data in Shopify Flow with a "Get analytics data" action. It works with our scheduled time trigger, enabling reporting use cases and more. help.shopify.com/en/manual/shop…

EZ Exporter Update: New Shopify Customer Fields highviewapps.com/blog/ez-export… #ShopifyApps

@marksuman Love the new Projects folders, but not a fan of the new font (harder to read, previous one was much better in our opinion, but maybe we'll get used to it eventually). The extra Cloudflare check is also a bit annoying as we're always on VPN, so it gets triggered all the time.

Export Shopify B2B Companies to CSV/Excel With EZ Exporter highviewapps.com/blog/export-sh… #ShopifyApps #ShopifyB2B

We avoid doing simple things that work because they don't make us look smart. Smart people feel stupid doing simple things, so we invent complicated alternatives that accomplish less but feel more intellectually satisfying. Meanwhile, the people who dominate their fields are doing embarrassingly basic things, but they do them better than everyone else -- Shane Parrish

Maple Update: We're excited to roll out Projects and Pinned Chats. A new way to organize your work into clear, focused spaces. - Group chats into Projects - Set custom instructions that apply to every chat - Pin the chats you visit daily As always, your data remains private.

Upload Multiple Tracking Numbers to a Single Fulfillment With EZ Fulfill highviewapps.com/blog/upload-mu… #ShopifyApps

Shopify brings native B2B features to millions more merchants shopify.com/news/b2b-for-a… via @Shopify

Chrome extensions are so incredibly unsafe Malware criminals find popular ones, pay the owners of the extension lots of money, they add malware to the code and millions of people get infected Then they take your cookies, localStorage, anything they can access Which is why in locked down advanced security devices you can't even install Chrome extensions I mostly run uBlock Origin, but have some others that I'll just vibecode now to stay safe

@

57 years ago

0 0 0 0 0

New supply chain attack this time for npm axios, the most popular HTTP client library with 300M weekly downloads. Scanning my system I found a use imported from googleworkspace/cli from a few days ago when I was experimenting with gmail/gcal cli. The installed version (luckily) resolved to an unaffected 1.13.5, but the project dependency is not pinned, meaning that if I did this earlier today the code would have resolved to latest and I'd be pwned. It's possible to personally defend against these to some extent with local settings e.g. release-age constraints, or containers or etc, but I think ultimately the defaults of package management projects (pip, npm etc) have to change so that a single infection (usually luckily fairly temporary in nature due to security scanning) does not spread through users at random and at scale via unpinned dependencies. More comprehensive article: stepsecurity.io/blog/axios-com…

Feross @feross

3 months ago

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios

540 4K 16K 12.4M 7K

Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

Daniel Hnyk @hnykda

3 months ago

LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below

307 2K 9K 5.9M 3K

A bespoke software revolution? I don't buy it. It'll exist. It already exists. Small consultants and big consulting firms have made custom software for years. It almost always sucks. It’s bloated, confusing, and because the client pays, it’s built wrong in all the ways. Who’s excited about bespoke software? Software makers! Of course they're excited about building bespoke software — that's what they do. X is full of them. Your feed is full of people who love making software talking about making software. Of course they’re excited about the revolution. Echo, echo, echo... Most people don’t like computers. Nobody in tech wants to say that out loud. People tolerate computers. They use them because they have to. Given the choice, most would rather not think about them at all. So when someone suggests that AI means everyone will build their own custom tools, ask who "everyone" is. The three-person accounting firm drowning in client paperwork? They want the paperwork gone, not a new system to maintain. The regional logistics company with 40 trucks? They want the routes optimized, not Joe spouting off about this new system he’s been messing around with. The law firm billing 70-hour weeks? They want leverage on their time, not a software project to design. They don’t hate technology. But building and maintaining their own critical systems isn’t their wheelhouse, regardless of how much faster and easier it’s become. It's another job on top of the job. Will these people use AI? Absolutely, for all sorts of things. Will some outliers go deep and build real custom systems? Sure, but they're almost always people who already had some pull toward software. The curiosity was already there. They were dabblers before. Giving everyone access to software building tools doesn't mean everyone becomes a builder. A powerful excavator doesn't turn a homeowner into a contractor. Most people just want the hole dug by someone else. They don’t want the responsibility either.