HackerTrans
TopNewTrendsCommentsPastAskShowJobs

alexchantavy

1,016 karmajoined قبل 11 سنة
I work on a tool called https://cartography.dev and am building a company around it called https://subimage.io

Submissions

What it's like being the only security company in your YC batch

ventureinsecurity.net
4 points·by alexchantavy·قبل 23 يومًا·1 comments

Shift-right: attack path analysis that never wastes a good incident

subimage.io
5 points·by alexchantavy·قبل 3 أشهر·0 comments

Mapping production AI agents to IAM roles, tools, and network exposure

cartography.dev
1 points·by alexchantavy·قبل 4 أشهر·0 comments

[untitled]

1 points·by alexchantavy·قبل 4 أشهر·0 comments

Cartography Now Maps Permissions Across All 3 Clouds: My LFX Mentorship Journey

cartography.dev
2 points·by alexchantavy·قبل 5 أشهر·0 comments

How Cargo Ships Navigate the World’s Most Treacherous Bay

youtube.com
1 points·by alexchantavy·قبل 7 أشهر·0 comments

How we used SubImage to fix React2Shell on our own infrastructure

subimage.io
3 points·by alexchantavy·قبل 7 أشهر·0 comments

comments

alexchantavy
·أول أمس·discuss
Voice really matters in writing. If everyone uses Opus to write without editing, then it all sounds the same regardless of who it came from.
alexchantavy
·قبل 29 يومًا·discuss
I miss that 2010s startup look
alexchantavy
·الشهر الماضي·discuss
High, extra, or max?
alexchantavy
·قبل 3 أشهر·discuss
The problem they're trying to solve is to find out what functions of their software are most useful for people and what to invest in, and to make directions on product direction.

Yes, vendors can, do, and should talk to users, but then a lot of users don't like receiving cold messages from vendors (and some users go so far as to say that cold messages should _never_ be sent).

So, the alternative is to collect some soft telemetry to get usage metrics. As long as a company is upfront about it and provides an opt-out mechanism, I don't see a problem with it. Software projects (and the businesses around them) die if they don't make the right decisions.

As an open source author and maintainer, I very rarely hear from my users unless I put in the legwork to reach out to them so I completely identify with this.
alexchantavy
·قبل 3 أشهر·discuss
Great article, thanks for sharing. How much does it run you a month roughly?
alexchantavy
·قبل 3 أشهر·discuss
> You could look at your denigrators and decide: "fuck you"

That escalated quickly and I enjoyed this comment a lot
alexchantavy
·قبل 3 أشهر·discuss
I wonder what college freshman-level writing classes are teaching about writing voice and AI. The tell-tale patterns are pretty frustrating to read.
alexchantavy
·قبل 3 أشهر·discuss
The solution to every software problem is another layer of indirection :-)
alexchantavy
·قبل 3 أشهر·discuss
I sure hope so. The way companies are pressured to hit growth numbers, I really hope messaging in general doesn’t all get sloppified along with code lol.

I think AI writing makes humanities and writing courses more important, and I hope people maintain their sense of taste with writing, but tbh I’m not optimistic here.
alexchantavy
·قبل 4 أشهر·discuss
My favorite part is how pg says how kids made him less ambitious, but then:

“On the other hand, what kind of wimpy ambition do you have if it won't survive having kids? Do you have so little to spare?”
alexchantavy
·قبل 4 أشهر·discuss
Relevancy is a big point here. HN readers work in tech or are super interested in tech, YC companies do very technical things so hiring posts or launches tend to blend right in for the most part.
alexchantavy
·قبل 4 أشهر·discuss
I think this overstates the “betrayal” angle.

A lot of great open source comes out of startups because startups are really good at shipping fast and getting distribution (open source is part of this strategy). Users can try the tool immediately, and VC funding can put a lot of talent behind building something great very quickly.

The startup model absolutely creates incentive risk, but that’s true of any project that becomes important while depending on a relatively small set of maintainers or funders.

I’m not sure an acquisition is categorically different from a maintainer eventually moving on or burning out. In all of those cases, users who depend on the project take on some risk. That’s not unique to startups; it’s true of basically any software that becomes important.

There’s no perfect structure for open source here - public funding, nonprofit support, and startups all suck in their own ways.

And on the point you make about public funding being slow: yeah, talented people can’t work full-time on important things unless there’s serious funding behind it. uv got as good as it is because the funding let exceptional people work on it full-time with a level of intensity that public funding usually does not.
alexchantavy
·قبل 4 أشهر·discuss
Seems like in this new AI world that the word sandbox is used to describe a system that asks "are you sure".

I'm used to a different usage of that word: from malware analysis, a sandbox is a contained system that is difficult to impossible to break out of so that the malware can be observed safely.

Applying this to AI, I think there are many companies trying to build technical boundaries stronger than just "are you sure" prompts. Interesting space to watch.
alexchantavy
·قبل 4 أشهر·discuss
Haha FB Cloud sounds so wild to imagine
alexchantavy
·قبل 4 أشهر·discuss
Vrei sa pleci dar numa numa iei numa numa iei numa numa numa iei

bring back the old internet
alexchantavy
·قبل 4 أشهر·discuss
I think there are some primitives for agents that need to be built out for better security and being able to reason about them.

Agents run on infra, they have network connectivity, they have ACLs and permissions that let them read+write+execute on resources, they can interact with other agents.

To manage them from both an infra and security perspective, we can use the existing underlying primitives, but it's also useful to build abstractions around them for management, kind of like how microservices encapsulate compute+storage+network together.

I think of agents as basically microservices that can act in non-deterministic ways, and the potential "blast radius" of their actions is very wide. So you need to be able to map what an agent can do, and it's much easier to do that if there are abstractions or automatic groupings instead of doing this all ourselves.
alexchantavy
·قبل 4 أشهر·discuss
The PvP was so deep too. You would go 4v4 or 8v8 and coordinate a “3, 2, 1 spike” on a target so that all your damage would arrive at the same time regardless of spell windup times and be too much for the other team’s healer to respond to.

Could also fake spike to force the other team’s healer to waste their good heal on the wrong player while you downed the real target. Good times.
alexchantavy
·قبل 4 أشهر·discuss
Data point of 1: Having hired juniors as a startup founder, I need more generalists than AI/ML specialists. AI application work right now is basically standard software engineering - you’re finding clever ways to supply the right context to a model within certain constraints.

No one knows what’s going to happen in the future. Yes there already are fewer SWE jobs than before because of AI, and yes the days of companies hiring new grads in droves at $300k+ packages are likely over. IMO all you can really do is study what you’re interested in, learn it deeply, and do good work with cool people. If unsure, it’s possible to go back to what you were doing before if the new path doesn’t work out.
alexchantavy
·قبل 4 أشهر·discuss
I still find it funny that for my personal setup I have a $700 Macbook Air but a $1500 iPhone Pro and it feels like it makes sense.
alexchantavy
·قبل 4 أشهر·discuss
Feels a bit like Jack Ma and Alibaba