Why does the author keep mentioning that a one line bash command that downloads a bunch of crap is “great UX”?
I got into YC Startup School by hacking it
51–60 of 81 posts
Re: I got into YC Startup School by hacking it
#52> I found that this year, YC wanted me to use something called Paxel on my computer as part of the application. > I should run a script, a very easy-to-use cURL one-liner that installed something on my computer and analyzed every line of code I’ve written with a coding agent, compile a report, and upload it to YC’s servers. This is ridiculous. Any kind of application (job, startup school, whatever) should not do this…
> (what) is YC thinking with this?
They want people who do what they say and don't challenge them?
Re: I got into YC Startup School by hacking it
#53So let me get this straight... technical founders are providing limitless access to their IP, and this is supposed to be a positive indicator that they would be a good founder? Thats wild
Re: I got into YC Startup School by hacking it
#54Earlier quoted context omitted.
It's very common nowadays to claim that something doesn't have access to X when it does in fact have system level access to X, but the application code just doesn't use X (or a prompt is being asked not to use X). >curl -fsSL https://paxel.ycombinator.com/upload.sh | bash Point in case. Trustworthy people will ask you to give them the right amount of access, they won't ask you for infinite access and ask you to trust…
Sure - and people are able to audit what the software is doing and call it out if it’s operating in a way that’s unintended or inappropriate, just as has happened here. Edit: I’ll add this point as people always seem to want to raise the spectre of YC or the AI platforms stealing people’s code or ideas via these sorts of tools. The value of any code or ideas is immaterial compared to the value of identifying talented…
>>Sure - and people are able to audit what the software is doing and call it out if it’s operating in a way that’s unintended or inappropriate, just as has happened here
1. Yes you can audit client side and network interface, but not server side.
2. does 'curl $URL | sh' invite users to audit? Or to trust blindly? It's the equivalent of presenting a contract with 'sign here' stickers and pushing you to sign it quickly like it's nothing. Does not signal trustworthiness.
>I’ll add this point as people always seem to want to raise the spectre of YC or the AI platforms stealing people’s code or ideas via these sorts of tools.
>The value of any code or ideas is immaterial compared to the value of identifying talented people who can then be offered opportunities such as attending Startup School, being funded by YC, getting jobs at YC-funded companies or YC itself.
>It’s one of pg’s oldest dictums, that ideas alone are worthless, and only working products and the people that build them are worth anything. Nobody at YC thinks any differently about that these days.
I do agree and share this point, ideas are worthless. But this doesn't deal with ideas, it deals with code, which as a software startup I don't feel the need to convince you of its value and the risks of leaking it. If you think your code is worthless, close your startup.
By many definitions, prompts are source code, and what we used to call source code is now target code. So this indeed does leak your source code. It's not just an IP blunder to leak your source code this carelessly, but it's a security blunder to do so. "But Kerchoff's principle.." no, Kerchoff's principle is that you should design your system as if source code were public, not that leaking source code has no negative security effect.
Also, is it possible that YC is taking advantage of the 'your ideas are worthless' dictum? Just share your ideas with YC, they are too big to care about your stupid idea. But they are gathering intel on over hundred of thousands of startups, and the ratio of applicants to fundings is continuously going down.
And sharing your idea with a single potential investor, isn't the same thing as submitting your idea (and implementation details), to a system built by people who don't give a shit about internals or security, and that use third party tools and services from different countries to process your data in ways that they don't give a fuck either.
What guarantee do you have that by using YC's vibecode data gathering tool, your data won't end up in a training set that will make it easier for a competitor with the same idea as you to find your solution?
A decade ago maybe your idea was worthless and joining YC was a contrarian bet. Nowadays, this data is clearly worth something, and applying to YC is as mainstream as applying for a job, and both of these mainstream 'apply for a 0.1% chance at the privilege of working with us' tend to grow completely asymmetric and exploit the underdog as much as they allow themselves to be exploited.
Re: I got into YC Startup School by hacking it
#55So let me get this straight... technical founders are providing limitless access to their IP, and this is supposed to be a positive indicator that they would be a good founder? Thats wild
No.
It uploads only the AI coding agent transcripts in the directories you explicitly run the upload script in.
Re: I got into YC Startup School by hacking it
#56> YC wanted me to use something called Paxel on my computer as part of the application. > I should run a script, a very easy-to-use cURL one-liner that installed something on my computer and analyzed every line of code I’ve written with a coding agent, compile a report, and upload it to YC’s servers. Yikes! I hope this is NOT the future of hiring.
Don't worry, it doesn't analyze your generated code, it just analyzes your source prompts, the thing that presumably generates the code. If only there was a word for text that generates a computer program.
Re: I got into YC Startup School by hacking it
#57Against better judgement, I ran it on my repo. Poking at the "Ask anything about the report" bot, it penalizes me heavily for not having "positive tracked outcomes", as I don't report back to Claude what the outcome is. It wanted me to do this: "At the end of research-heavy sessions, add a tiny closure note: Decision: Use CacheMountStore with registry/local/GHA backends. Why: GHA cannot expose the same content.Ingest…
I had the exact same experience. Claude is not my validation engine, I do not tell it when it has completed. I verify that in the code/project and end the session.
I also got this,
> A useful next habit is to end each correction with a concrete acceptance test, owner artifact, or stop condition: “write it into PROGRESS.md,” “make nix run .#bench fail until this is real,” “rerun this exact command,” or “do not proceed until these two choices are explicit.”
> You already do this well in the biggest penance sessions. Apply it to the smaller ones too.
Which I have found to be counterproductive in my personal work. Current models can generally infer acceptance tests of this level of granularity (not true for larger project-level prompts, but those don't produce good enough code for me yet -- even with specific acceptance criteria).
I also got penalized for using claude in read-only mode for the same validation reason?
> For read-only work, end with one of:
“turn the top finding into a PR-sized plan”
“mark these as accepted/rejected/deferred”
“write a cleanup checklist”
“give me the exact command I should run safely”
“stop, no action recommended”
It's a little sad to be honest, I would actually enjoy a product that helped me improve prompting + ai usage.
Re: I got into YC Startup School by hacking it
#58So if you built something without the use of an LLM, you’re automatically disqualified now? What a world.
Re: I got into YC Startup School by hacking it
#59Am I misreading this, or is ycombinator running a tool that transfers IP from an applicant’s machine to OpenAI and then transfers the generated summaries into their own servers. And that tool has some “webapp security 101” level vulnerability in it. Feels like a disaster waiting to happen.
It doesn’t upload code (it’s not meant to, anyway); it uploads coding agent transcripts. It’s meant to be a fun app like Spotify wrapped - that’s how it was described when presented internally.
[deleted]
Re: I got into YC Startup School by hacking it
#60Earlier quoted context omitted.
Sure - and people are able to audit what the software is doing and call it out if it’s operating in a way that’s unintended or inappropriate, just as has happened here. Edit: I’ll add this point as people always seem to want to raise the spectre of YC or the AI platforms stealing people’s code or ideas via these sorts of tools. The value of any code or ideas is immaterial compared to the value of identifying talented…
>>Sure - and people are able to audit what the software is doing and call it out if it’s operating in a way that’s unintended or inappropriate, just as has happened here 1. Yes you can audit client side and network interface, but not server side. 2. does 'curl $URL | sh' invite users to audit? Or to trust blindly? It's the equivalent of presenting a contract with 'sign here' stickers and pushing you to sign it quickl…
It doesn’t deal with code, it deals with chat transcripts, and only those in the directories you explicitly choose to share (yes I know transcripts include some code but you’re not sharing a working app codebase or anything close to it).
The entire purpose of Startup School for YC is to build great relationships with the most promising talent. The scale and cost of the event is vast, and the benefits for attendees are huge.
It’s a three day event with main-stage interviews with several top figures in the tech world and many other intimate events with YC partners, industry experts and fellow attendees. Much of the effort in organizing the event is maximizing the chances that attendees will meet other attendees with things in common so they can build relationships and maybe work on important projects in the future. Of course, YC hopes to be able to fund the most promising startups that come out of this, but nobody is obligated to apply to YC or take YC funding if it’s offered.
What I’m trying to convey here is that it’s in YC’s utmost interests to build trust and earn respect from the people who are participating in these programs, and there is no way in a million years that some code or implementation detail exposed in a chat transcript is going to be more valuable than building very positive, mutually trusting relationships with all participants and applicants over the long term.