Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got into YC Startup School by hacking it

obaid.wtf

Post reply on HN
Print view View original

71–80 of 81 posts

Re: I got into YC Startup School by hacking it

#71

Post by tomhow »

TZubiri wrote: post #68
tomhow wrote: post #60

Earlier quoted context omitted.

It doesn’t deal with code, it deals with chat transcripts, and only those in the directories you explicitly choose to share (yes I know transcripts include some code but you’re not sharing a working app codebase or anything close to it). The entire purpose of Startup School for YC is to build great relationships with the most promising talent. The scale and cost of the event is vast, and the benefits for attendees ar…

>It doesn’t deal with code, it deals with chat transcripts, and only those in the directories you explicitly choose to share (yes I know transcripts include some code but you’re not sharing a working app codebase or anything close to it). What's more important, the code? or the source? It's the source. The mistake thousands of people are making is that the source no longer looks like code, and the target code now loo…

You ignored the rest of my comment. The maximum theoretical benefit to YC from “stealing” IP or trade secrets from chat transcripts is immaterial, relative to the benefit to YC of finding good talent and building positive, trusting relationships with them over the long term.

It's literally the hardest thing in business for investors and employers by far: finding good talent to invest in or employ, and earning/keeping their trust. YC spends unimaginable amounts of money and effort each year to keep doing that, as it has done for two decades. Startup School is just that latest and biggest example of that.

It doesn't even pass basic logic that YC would steal some gem of an idea from someone's transcript and hand it to someone else to build. Everyone who is talented enough to build it is busy building products based on their own ideas, and the very best person to build a product is the person who had the idea to build it.

Re: I got into YC Startup School by hacking it

#72

Post by actionfromafar »

Aurornis wrote: post #15

> Based on Paxel’s own site, 1.2 million+ coders have so far uploaded their reports to YC. I checked the Paxel website and it says this: > So far, 1,543,553 sessions have been uploaded and analyzed. The count is for sessions, not coders. I assume the tool uploads a lot of sessions from each person who uses it. That’s a large number, but it’s not a million different people. I am surprised that so many people think it’…

"They trust me."

Re: I got into YC Startup School by hacking it

#73

Post by moomoo11 »

TZubiri wrote: post #34
siva7 wrote: post #2

> I uncovered Y Combinator was scoring 100k+ founders around the world through Paxel Alright, my ears are wide open. Tell us more, how did YC use the private submission data from thousands of founders to score them? They fed some 3rd-Party AI all personal data to score who should get an interview? I can't be the only one here seeing a bad news story unfolding in real time...

YC is currently polarizing against companies that are rejecting the philosophy of giving (a single user) AI full read access to company data. They find that resistance frustrating and the complain publicly about it, calling such an attitude outdated "so 2024". https://youtu.be/B246K_G7mHU?si=UVJei9Jpk7ZvREnH&t=1483 https://youtu.be/B246K_G7mHU?si=ikHZD4MwxA5JtXLj&t=1716 I understand that YC and startups in general ha…

ceo of vc firm and ceo of msft

have different priorities

Re: I got into YC Startup School by hacking it

#74

Post by TZubiri »

tomhow wrote: post #71
TZubiri wrote: post #68

Earlier quoted context omitted.

>It doesn’t deal with code, it deals with chat transcripts, and only those in the directories you explicitly choose to share (yes I know transcripts include some code but you’re not sharing a working app codebase or anything close to it). What's more important, the code? or the source? It's the source. The mistake thousands of people are making is that the source no longer looks like code, and the target code now loo…

You ignored the rest of my comment. The maximum theoretical benefit to YC from “stealing” IP or trade secrets from chat transcripts is immaterial, relative to the benefit to YC of finding good talent and building positive, trusting relationships with them over the long term. It's literally the hardest thing in business for investors and employers by far: finding good talent to invest in or employ, and earning/keeping…

One of the threat models is not YC itself stealing your IP. Which they are to some extent, but them using vendors that themselves train their models on your IP. Or vendors that use vendors that...

>YC spends unimaginable amounts of money and effort each year to keep doing that, as it has done for two decades.

Yeah, that or they built their reputation early on and are now coasting on that. It's an industry whose explicit objective is to build companies (build reputations) and then exit and sell them, would you be surprised if YC itself did that?

>It doesn't even pass basic logic that YC would steal some gem of an idea from someone's transcript and hand it to someone else to build.

More likely is the opposite, they get 100k startup applications and they know what ideas people are pursuing and should be avoided, and which might be worth looking into. The former become would target demographics for shovel selling as well, so the 1% that actually gets into YC might setup shop selling to the other 99%. It's theoretical, but these are all attacks that emerge from the basic violation of sharing your source code. To be clear, I don't think that YC employees are starting startups, the threat model is that they act through their picks, and they strengthen their picks at the expense of their non-picks. It's like a russian roulette of startups, which isn't necessarily a bad idea.

>Everyone who is talented enough to build it is busy building products based on their own ideas,

Like, I get that, but also don't overcorrect into the naïve take that market intelligence is worthless or doesn't exist, especially when that take is 20 years old, if you treat that as your strategic advantage over the population, it's more likely that it's going to be used to take advantage of you.

Be moderate, share your idea, don't share everything. Share to individuals, don't share to massive data gathering systems that may use your data as training data for machine learning models. Basic stuff really.

Re: I got into YC Startup School by hacking it

#75

Post by tomhow »

TZubiri wrote: post #74
tomhow wrote: post #71

Earlier quoted context omitted.

You ignored the rest of my comment. The maximum theoretical benefit to YC from “stealing” IP or trade secrets from chat transcripts is immaterial, relative to the benefit to YC of finding good talent and building positive, trusting relationships with them over the long term. It's literally the hardest thing in business for investors and employers by far: finding good talent to invest in or employ, and earning/keeping…

One of the threat models is not YC itself stealing your IP. Which they are to some extent, but them using vendors that themselves train their models on your IP. Or vendors that use vendors that... >YC spends unimaginable amounts of money and effort each year to keep doing that, as it has done for two decades. Yeah, that or they built their reputation early on and are now coasting on that. It's an industry whose expli…

The users have already shared their ideas with an AI company’s chatbot. The “IP” you’re worried about is already more than half the output of LLM chatbots and it could already be trained on.

Everything you’re speculating about regarding YC’s potential to steal ideas, along with the notion that they are “coasting”, is easily disproven by what YC is doing, literally right now.

Startup School 2026 is the most costly and elaborate event YC has ever presented. YC is hosting about 7500 people at the event, and entertaining them (meals, parties, small-group sessions and dinners) and paying for flights for many of them from elsewhere in the country and world. They recently did a similar thing in India, and are constantly running outreach events at colleges around the world. That’s in addition to running four YC accelerator batches per year, funding nearly 1000 companies annually (and hoping to grow that).

This is the opposite of “coasting” and is completely at adds with any notion what YC really wants to do is steal IP or ideas. YC’s business collapses if it loses the trust of the most promising talent.

Re: I got into YC Startup School by hacking it

#76

Post by [deleted] »

tomhow wrote: post #75
TZubiri wrote: post #74

Earlier quoted context omitted.

One of the threat models is not YC itself stealing your IP. Which they are to some extent, but them using vendors that themselves train their models on your IP. Or vendors that use vendors that... >YC spends unimaginable amounts of money and effort each year to keep doing that, as it has done for two decades. Yeah, that or they built their reputation early on and are now coasting on that. It's an industry whose expli…

The users have already shared their ideas with an AI company’s chatbot. The “IP” you’re worried about is already more than half the output of LLM chatbots and it could already be trained on. Everything you’re speculating about regarding YC’s potential to steal ideas, along with the notion that they are “coasting”, is easily disproven by what YC is doing, literally right now. Startup School 2026 is the most costly and…

[deleted]

Re: I got into YC Startup School by hacking it

#77

Post by TZubiri »

tomhow wrote: post #75
TZubiri wrote: post #74

Earlier quoted context omitted.

One of the threat models is not YC itself stealing your IP. Which they are to some extent, but them using vendors that themselves train their models on your IP. Or vendors that use vendors that... >YC spends unimaginable amounts of money and effort each year to keep doing that, as it has done for two decades. Yeah, that or they built their reputation early on and are now coasting on that. It's an industry whose expli…

The users have already shared their ideas with an AI company’s chatbot. The “IP” you’re worried about is already more than half the output of LLM chatbots and it could already be trained on. Everything you’re speculating about regarding YC’s potential to steal ideas, along with the notion that they are “coasting”, is easily disproven by what YC is doing, literally right now. Startup School 2026 is the most costly and…

Took a look at Paxel. It's worth noting that we have the client target code to analyze only, I could not find server side code, nor source prompts for the client code, if any of those could be provided it would make auditing easier.

Also, I appreciate that it's probably all fine, and that my attack scenarios are mostly theoretical, and that YC took care in developing security measures for Paxel, and that maybe I'm paranoid.

But I believe in a security model that doesn't rely just on trust, but on system level guarantees, where we install things not by running 'curl $URL | bash', but by robust technologies like OAuth. Yes, maybe it's a bit harder to build, and the 'UX' of installing these things will not be as clean. I'm just not on board with the piping curl into bash fad. I'm sure there's a sweetspot of trustingness and scrutiny.

To take some heat off YC, they are not the only ones, consider socket.dev, a security product, they tell you that they will not read your code, only the requirements.txt and package.json type of files, but when you install it, GitHub gives them full access to repos, we have had file level permissions for years, but suddenly it's not possible to request that level of granulairty for permissions.

I'm sure that there's a sweetspot between trustworthiness and rigour, but 'curl|bash' and 'deputyless permissions' is clearly on the too-trustworthy end of the spectrum, fantastically so, it makes me feel the overton window is shifting towards extremist levels of disregard for security.

But maybe I'm wrong, I'd love to read a defense of 'curl|bash', 'give the agent access to all the company data' and 'you can just ask the LLM to not read some data'.

Re: I got into YC Startup School by hacking it

#78

Post by classified »

actionfromafar wrote: post #72
Aurornis wrote: post #15

> Based on Paxel’s own site, 1.2 million+ coders have so far uploaded their reports to YC. I checked the Paxel website and it says this: > So far, 1,543,553 sessions have been uploaded and analyzed. The count is for sessions, not coders. I assume the tool uploads a lot of sessions from each person who uses it. That’s a large number, but it’s not a million different people. I am surprised that so many people think it’…

"They trust me."

I feel so tempted to post the next two words that famously follow that utterance.

Re: I got into YC Startup School by hacking it

#79

Post by classified »

OtherShrezzing wrote: post #18

Am I misreading this, or is ycombinator running a tool that transfers IP from an applicant’s machine to OpenAI and then transfers the generated summaries into their own servers. And that tool has some “webapp security 101” level vulnerability in it. Feels like a disaster waiting to happen.

AI can do no wrong.

Re: I got into YC Startup School by hacking it

#80

Post by feross »

TZubiri wrote: post #77
tomhow wrote: post #75

Earlier quoted context omitted.

The users have already shared their ideas with an AI company’s chatbot. The “IP” you’re worried about is already more than half the output of LLM chatbots and it could already be trained on. Everything you’re speculating about regarding YC’s potential to steal ideas, along with the notion that they are “coasting”, is easily disproven by what YC is doing, literally right now. Startup School 2026 is the most costly and…

Took a look at Paxel. It's worth noting that we have the client target code to analyze only, I could not find server side code, nor source prompts for the client code, if any of those could be provided it would make auditing easier. Also, I appreciate that it's probably all fine, and that my attack scenarios are mostly theoretical, and that YC took care in developing security measures for Paxel, and that maybe I'm pa…

Founder/CEO of Socket here.

If you have a suggestion for how to scope down the permissions of our app, we’re all ears. But based on our research, it’s not possible.

More info documenting each permission: https://docs.socket.dev/docs/permissions

Post reply on HN