paxel and how it works sounds so dumb. so i’m not at all surprised at how it is used and by whom.
Paxel seems like a tool that would cause brand damage to YC if it were better known.
I got into YC Startup School by hacking it
21–30 of 81 posts
Re: I got into YC Startup School by hacking it
#22Don't read this horror story before bed time if you care about information security.
Perhaps running the script outside a heavily sandboxed system should trigger an automatic rejection.
Re: I got into YC Startup School by hacking it
#23Am I misreading this, or is ycombinator running a tool that transfers IP from an applicant’s machine to OpenAI and then transfers the generated summaries into their own servers. And that tool has some “webapp security 101” level vulnerability in it. Feels like a disaster waiting to happen.
It doesn’t upload code (it’s not meant to, anyway); it uploads coding agent transcripts. It’s meant to be a fun app like Spotify wrapped - that’s how it was described when presented internally.
Re: I got into YC Startup School by hacking it
#24Am I misreading this, or is ycombinator running a tool that transfers IP from an applicant’s machine to OpenAI and then transfers the generated summaries into their own servers. And that tool has some “webapp security 101” level vulnerability in it. Feels like a disaster waiting to happen.
Maybe this is another one of Garry's 30k LOC/day vibecode specials that he's so proud of
Re: I got into YC Startup School by hacking it
#25Am I misreading this, or is ycombinator running a tool that transfers IP from an applicant’s machine to OpenAI and then transfers the generated summaries into their own servers. And that tool has some “webapp security 101” level vulnerability in it. Feels like a disaster waiting to happen.
It doesn’t upload code (it’s not meant to, anyway); it uploads coding agent transcripts. It’s meant to be a fun app like Spotify wrapped - that’s how it was described when presented internally.
Those transcripts generally contain code edit diffs.
Re: I got into YC Startup School by hacking it
#26Oh, I remember that thing, it wanted to see my prompt and my code in exchange for telling me my horoscope.
Some hands you have to fold, and I'm folding this one. Patiently waiting for the "let's give all our data to a single AI user" bubble to bust with some massive exploits.
Re: I got into YC Startup School by hacking it
#27surprised running paxel doesn't disqualify you, the program sounds sus
Re: I got into YC Startup School by hacking it
#28For the longest time, the YC application included the question "What was your greatest (non-computer) hack?". They have always liked people who think of ways to work around existing systems. So it's no surprise that their response was positive. Also, all the principals are ex-founders, mostly engineers, who totally understand hacking culture. Sadly, it looks like they took that question off the application though.
Except this was a computer hack. So technically wouldn't qualify.
Re: I got into YC Startup School by hacking it
#29Am I misreading this, or is ycombinator running a tool that transfers IP from an applicant’s machine to OpenAI and then transfers the generated summaries into their own servers. And that tool has some “webapp security 101” level vulnerability in it. Feels like a disaster waiting to happen.
It doesn’t upload code (it’s not meant to, anyway); it uploads coding agent transcripts. It’s meant to be a fun app like Spotify wrapped - that’s how it was described when presented internally.
It's very common nowadays to claim that something doesn't have access to X when it does in fact have system level access to X, but the application code just doesn't use X (or a prompt is being asked not to use X).
>curl -fsSL https://paxel.ycombinator.com/upload.sh | bash
Point in case.
Trustworthy people will ask you to give them the right amount of access, they won't ask you for infinite access and ask you to trust them that they won't use it. Would you trust a contractor that asks for root, and your master password when they could have requested a specific user or some specific files?
Re: I got into YC Startup School by hacking it
#30Earlier quoted context omitted.
It doesn’t upload code (it’s not meant to, anyway); it uploads coding agent transcripts. It’s meant to be a fun app like Spotify wrapped - that’s how it was described when presented internally.
Those transcripts generally contain code edit diffs.
Sure - though that’s all generated by the coding agents. So it shouldn’t be uploading original hand-written code (unless the coding agent is running on a legacy codebase).
Obviously it’s not something everyone is going to be comfortable sharing, but YC is transparent about what is shared and how it’s used.
Edit:
I now see you have to explicitly run it in every directory you want shared - i.e., it doesn’t t scan your whole disk looking for stuff to upload. So there’s every opportunity to limit what it uploads to only what you want to share.