Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got into YC Startup School by hacking it

obaid.wtf

Post reply on HN
Print view View original

61–70 of 81 posts

Re: I got into YC Startup School by hacking it

#61

Post by cobertos »

jppope wrote: post #53

So let me get this straight... technical founders are providing limitless access to their IP, and this is supposed to be a positive indicator that they would be a good founder? Thats wild

`cd ~/path/to/your-project && curl -fsSL https://paxel.ycombinator.com/upload.sh | bash` is the command from Paxel's website. So you're literally just piping whatever the hell they want into bash. It's long, lots of comments, and honestly would be time consuming to audit properly.

Supposedly this is what it does from the opening comment

  # Paxel upload script
  # ===================
  #
  # What this does (up to 17 steps):
  #   On your machine
  #     1. Check Docker is installed and running
  #     2. Sign you in (browser-based device auth)
  #     3. Pull or build the Paxel Docker image
  #
  #   Inside the container — file bodies stay local; only aggregate metrics +
  #   metadata (paths, commit numstat, session events) are uploaded
  #     4. Discover projects and sessions (Claude Code, Codex CLI, Cursor)
  #     5. Read your git history
  #     6. Parse transcripts
  #     7. Summarize each session (cloud Haiku via YC proxy)
  #     8. Group git commits by session
  #     9. Group sessions into multi-day work streams
  #    10. Extract steering traces
  #    11. Extract decision exchanges (cloud Haiku)
  #    12. Redact code before upload (regex pattern redaction)
  #    13. Link decisions to outcomes
  #    14. Analyze code quality (L1 deterministic)
  #    15. Score episodes across 5 axes (cloud Haiku)
  #    16. Assemble your report
  #    17. Upload redacted summaries + scores to the server
  #
  #   Then: opens your results in the browser

Re: I got into YC Startup School by hacking it

#62

Post by cobertos »

tomhow wrote: post #55
jppope wrote: post #53

So let me get this straight... technical founders are providing limitless access to their IP, and this is supposed to be a positive indicator that they would be a good founder? Thats wild

No. It uploads only the AI coding agent transcripts in the directories you explicitly run the upload script in.

[flagged]

Re: I got into YC Startup School by hacking it

#63

Post by themgt »

tomhow wrote: post #23
OtherShrezzing wrote: post #18

Am I misreading this, or is ycombinator running a tool that transfers IP from an applicant’s machine to OpenAI and then transfers the generated summaries into their own servers. And that tool has some “webapp security 101” level vulnerability in it. Feels like a disaster waiting to happen.

It doesn’t upload code (it’s not meant to, anyway); it uploads coding agent transcripts. It’s meant to be a fun app like Spotify wrapped - that’s how it was described when presented internally.

for sure, "fun" is definitely the vibe:

Identifiers included in uploaded data. Information you upload to use the Services may include personal identifiers such as your name and email address (including names and email addresses of repository contributors), as well as other identifiers that may appear in commit metadata, file paths, transcripts, or other uploaded materials.

AI coding-agent transcript-derived content. Per-session narratives, certain session events including file paths and truncated command text, prompt excerpts, steering traces, and dispatch metadata. This data may include local file paths (e.g., directory structures such as /Users/…) and other contextual information that could be associated with an individual. Raw conversation history, full prompts, full agent responses, and full tool outputs do not leave your machine.

Information you upload may include Personal Information relating to other individuals (for example, repository contributors). You represent that you have the necessary rights and permissions to provide such information to us for processing in connection with the Services.

Usage patterns and activity intervals. We may derive and store information about your usage patterns, such as session timing and working-hour intervals, based on timestamps associated with your activity.

https://paxel.ycombinator.com/privacy

Re: I got into YC Startup School by hacking it

#65

Post by craigmccaskill »

drawnwren wrote: post #57
a_t48 wrote: post #50

Against better judgement, I ran it on my repo. Poking at the "Ask anything about the report" bot, it penalizes me heavily for not having "positive tracked outcomes", as I don't report back to Claude what the outcome is. It wanted me to do this: "At the end of research-heavy sessions, add a tiny closure note: Decision: Use CacheMountStore with registry/local/GHA backends. Why: GHA cannot expose the same content.Ingest…

I had the exact same experience. Claude is not my validation engine, I do not tell it when it has completed. I verify that in the code/project and end the session. I also got this, > A useful next habit is to end each correction with a concrete acceptance test, owner artifact, or stop condition: “write it into PROGRESS.md,” “make nix run .#bench fail until this is real,” “rerun this exact command,” or “do not proceed…

Yeah, I've found similar issues with even basic tasks like 'draft an email response' which will then populate a md file tagged as draft. Claude will then chastise me a few days later for not sending said draft. I've had to take real steps to avoid NannAIy in the last month that haven't even been a problem before in similar workflows.

Re: I got into YC Startup School by hacking it

#66

Post by lovich »

cobertos wrote: post #61
jppope wrote: post #53

So let me get this straight... technical founders are providing limitless access to their IP, and this is supposed to be a positive indicator that they would be a good founder? Thats wild

`cd ~/path/to/your-project && curl -fsSL https://paxel.ycombinator.com/upload.sh | bash` is the command from Paxel's website. So you're literally just piping whatever the hell they want into bash. It's long, lots of comments, and honestly would be time consuming to audit properly. Supposedly this is what it does from the opening comment # Paxel upload script # =================== # # What this does (up to 17 steps):…

What is cloud Haiku? Did they mean Claude Haiku?

Re: I got into YC Startup School by hacking it

#68

Post by TZubiri »

tomhow wrote: post #60
TZubiri wrote: post #54

Earlier quoted context omitted.

>>Sure - and people are able to audit what the software is doing and call it out if it’s operating in a way that’s unintended or inappropriate, just as has happened here 1. Yes you can audit client side and network interface, but not server side. 2. does 'curl $URL | sh' invite users to audit? Or to trust blindly? It's the equivalent of presenting a contract with 'sign here' stickers and pushing you to sign it quickl…

It doesn’t deal with code, it deals with chat transcripts, and only those in the directories you explicitly choose to share (yes I know transcripts include some code but you’re not sharing a working app codebase or anything close to it). The entire purpose of Startup School for YC is to build great relationships with the most promising talent. The scale and cost of the event is vast, and the benefits for attendees ar…

>It doesn’t deal with code, it deals with chat transcripts, and only those in the directories you explicitly choose to share (yes I know transcripts include some code but you’re not sharing a working app codebase or anything close to it).

What's more important, the code? or the source?

It's the source. The mistake thousands of people are making is that the source no longer looks like code, and the target code now looks like what source code used to be. They are looking at the aesthetics instead of the fundamentals.

Re: I got into YC Startup School by hacking it

#69

Post by Aurornis »

a_t48 wrote: post #50

Against better judgement, I ran it on my repo. Poking at the "Ask anything about the report" bot, it penalizes me heavily for not having "positive tracked outcomes", as I don't report back to Claude what the outcome is. It wanted me to do this: "At the end of research-heavy sessions, add a tiny closure note: Decision: Use CacheMountStore with registry/local/GHA backends. Why: GHA cannot expose the same content.Ingest…

This tool might be useful for AI tool beginners who need some guidance, but using it as a scoring tool looks like a mistake. It’s just going to penalize people for having different ways of working.

I don’t know how much it’s actually used to rate people. Rating anyone based on how they work instead of the results produced is an age-old mistake though.

Re: I got into YC Startup School by hacking it

#70

Post by a_t48 »

Aurornis wrote: post #69
a_t48 wrote: post #50

Against better judgement, I ran it on my repo. Poking at the "Ask anything about the report" bot, it penalizes me heavily for not having "positive tracked outcomes", as I don't report back to Claude what the outcome is. It wanted me to do this: "At the end of research-heavy sessions, add a tiny closure note: Decision: Use CacheMountStore with registry/local/GHA backends. Why: GHA cannot expose the same content.Ingest…

This tool might be useful for AI tool beginners who need some guidance, but using it as a scoring tool looks like a mistake. It’s just going to penalize people for having different ways of working. I don’t know how much it’s actually used to rate people. Rating anyone based on how they work instead of the results produced is an age-old mistake though.

It's used for YC applications as an optional portion of the founders profile. I'm not sure how it's weighted.
Post reply on HN