The amount of newly created accounts under this post praising this product reeks of botting... edit: some of those comments have now disappeared. Make of that what you want.
Voting ring detection for thee and not for me
Launch HN: Escape (YC W23) – Discover and secure all your APIs
11–20 of 40 posts
Re: Launch HN: Escape (YC W23) – Discover and secure all your APIs
#12Something went wrong. Please use a professional email address. :))) whats wrong with my not-professional email address?
Hello, we limited the registration to personal email because too many people were trying to scan APIs that didn't belong to them.
Mind you that you can also use your personal GitHub account to register because we noticed people are way less likely to do risky stuff with their Github account than with a personal email :)
Re: Launch HN: Escape (YC W23) – Discover and secure all your APIs
#13[dead]
[dead]
Re: Launch HN: Escape (YC W23) – Discover and secure all your APIs
#14Looks like it's limited for Graphql ?
They started with GraphQL but after a while they also developed a security scanner for REST APIs that use OpenAPIs or Swagger[1]. [1] https://escape.tech/blog/rest-security-testing/
Thank you, yes, we originally supported GraphQL only and released REST scanning support a few months ago. We plan to support all types of APIs ultimately.
Re: Launch HN: Escape (YC W23) – Discover and secure all your APIs
#15The amount of newly created accounts under this post praising this product reeks of botting... edit: some of those comments have now disappeared. Make of that what you want.
Have noticed under several launch HN posts - often other batch mates I think. Not sure how to feel about it tbh.
It's against the rules and if you scroll down https://news.ycombinator.com/yli.html you'll notice it's in bold text—for a reason! Unfortunately it's hard to get the message across, because people who aren't avid HN users have no idea of the conventions here, and there are other platforms where it's considered fine.
I've emailed the founders to tell their friends/teammates/etc. not to do this.
Re: Launch HN: Escape (YC W23) – Discover and secure all your APIs
#16The amount of newly created accounts under this post praising this product reeks of botting... edit: some of those comments have now disappeared. Make of that what you want.
Regular HN users have flagged the comments, since obviously they're against the convention here. I've emailed the founders to ask them to call off their friends/teammates/etc.
People who don't know HN's rules often try to "help" in this way. I try to tell everyone that it doesn't help, it hurts! but it's hard to get the word out.
(Edit: forgot to mention that the comments disappeared because HN users flagged them enough to make them [dead]. You can see [dead] comments if you want to, by turning on 'showdead' in your profile. That's also in the FAQ: https://news.ycombinator.com/newsfaq.html)
Re: Launch HN: Escape (YC W23) – Discover and secure all your APIs
#17The amount of newly created accounts under this post praising this product reeks of botting... edit: some of those comments have now disappeared. Make of that what you want.
Voting ring detection for thee and not for me
Launch HNs for YC startups get placed on HN's front page automatically - this is one of the things that HN gives back to YC in exchange for funding it. It's in the FAQ: https://news.ycombinator.com/newsfaq.html.
Since the purpose of voting rings is to try to get on the front page, that construct doesn't really apply here, unless you want to call "automatic placement" a "ring".
Re: Launch HN: Escape (YC W23) – Discover and secure all your APIs
#18Seems amazing. Is this going to be an enterprise only product? Don't see a pricing page.
Re: Launch HN: Escape (YC W23) – Discover and secure all your APIs
#19Who watches the watchers?
If I understand the product correctly, you're suggesting customers opt into letting an LLM pentest their testing systems, and allowing that LLM to generate and carry out plans of attack.
Imagine a recurring revenue business that keeps tokens for user credit cards on file, and then a dev naively gives the CI infrastructure an ability to call out/proxy some calls to production in a privileged way, and then Escape finds a way to break out of CI and charge cards on the production system. Of course, this is a massive security issue in and of itself, but at a certain point, a human pentester would know "holy ** I should stop what I'm doing right now." How do we know that Escape won't keep fuzzing and fuzzing and exacerbate the situation, causing real-world impact to customers?
There's probably a philosophical take on this - that security by obscurity is no security at all, and that threat actors will be every bit as good at this as Escape's technology is. But for any business that's not really a dedicated target for actors (say, only gets drive-by script kiddies that are easily fended off by keeping software up to date) using Escape might be increasing their risk of a breach that is meaningful to their customers, by inviting the scrutiny of a well-funded LLM, with a laser focus only on your specific business, that doesn't know when to stop.
Re: Launch HN: Escape (YC W23) – Discover and secure all your APIs
#20Who watches the watchers? If I understand the product correctly, you're suggesting customers opt into letting an LLM pentest their testing systems, and allowing that LLM to generate and carry out plans of attack. Imagine a recurring revenue business that keeps tokens for user credit cards on file, and then a dev naively gives the CI infrastructure an ability to call out/proxy some calls to production in a privileged…
Hello btown, you are indeed raising legitimate questions here.
You are right in the sense that using automated security testing tools in production creates a risk. But there are workarounds:
1) Most of Escape's security scans happen on staging or pre-prod environments, where there is little risk of breaking something critical or finding real customer data.
2) We have designed a specific scan mode for production APIs, that is made with safety in mind. It will not attempt the riskiest attack scenarios and, thus will be safe for production use at the cost of scanning depth.
You can chose a scan mode when adding a new application for testing in Escape. So far, most of our users use both modes, one for the production environment and one for the development environment, to spot bugs early.
No user ever had problems with the production scanning mode.
By the way, the core algorithm powering Escape is more a graph traversal algorithm than LLMs. We do use a small, self-hosted LLM for specific inference tasks, but everything is made in-house, and we don't use OpenAI or any other inference API.
Hope that helps!