HN user

alexchantavy

1,020 karma

I work on a tool called https://cartography.dev and am building a company around it called https://subimage.io

Posts15
Comments342
View on HN
www.subimage.io 1d ago

Adding Scaleway to Cartography without rewriting vulnerability management

alexchantavy
2pts0
www.subimage.io 9d ago

Screwing up vulnerability management at scale, and building a startup to fix it

alexchantavy
4pts0
ventureinsecurity.net 1mo ago

What it's like being the only security company in your YC batch

alexchantavy
4pts1
www.subimage.io 3mo ago

Shift-right: attack path analysis that never wastes a good incident

alexchantavy
5pts0
cartography.dev 4mo ago

Mapping production AI agents to IAM roles, tools, and network exposure

alexchantavy
1pts0
cartography.dev 5mo ago

Cartography Now Maps Permissions Across All 3 Clouds: My LFX Mentorship Journey

alexchantavy
2pts0
www.youtube.com 7mo ago

How Cargo Ships Navigate the World’s Most Treacherous Bay

alexchantavy
1pts0
www.subimage.io 7mo ago

How we used SubImage to fix React2Shell on our own infrastructure

alexchantavy
3pts0
www.cncf.io 1y ago

CNCF Slack Workspace Changes Coming on Friday, June 20

alexchantavy
2pts0
news.ycombinator.com 1y ago

Launch HN: SubImage (YC W25) – See your infra from an attacker's perspective

alexchantavy
135pts31
www.youtube.com 2y ago

How Do Pokemon Speedruns Beat Blue Version Backwards? [video]

alexchantavy
1pts0
conference.nber.org 3y ago

Anonymity and Identity Online [pdf]

alexchantavy
3pts0
eng.lyft.com 3y ago

Vulnerability Management at Lyft: Enforcing the Cascade [Part 1]

alexchantavy
2pts0
eng.lyft.com 5y ago

IAM whatever you say IAM

alexchantavy
69pts28
blog.alexchantavy.com 10y ago

Using the Google Geocoding API to find a new apartment

alexchantavy
3pts0

PlayStation users are moving to PC en masse

PC is even more digital-only than Playstation. No one buys physical games on PC. The only difference is that Valve has been a very good steward over Steam. Theoretically, PC can get as enshittified as PS.

I guess there are other DRM-based purchasing platforms, and there's also DRM free ones like GOG so PC gamers have choice, but those feel niche mostly.

Voice really matters in writing. If everyone uses Opus to write without editing, then it all sounds the same regardless of who it came from.

The problem they're trying to solve is to find out what functions of their software are most useful for people and what to invest in, and to make directions on product direction.

Yes, vendors can, do, and should talk to users, but then a lot of users don't like receiving cold messages from vendors (and some users go so far as to say that cold messages should _never_ be sent).

So, the alternative is to collect some soft telemetry to get usage metrics. As long as a company is upfront about it and provides an opt-out mechanism, I don't see a problem with it. Software projects (and the businesses around them) die if they don't make the right decisions.

As an open source author and maintainer, I very rarely hear from my users unless I put in the legwork to reach out to them so I completely identify with this.

I sure hope so. The way companies are pressured to hit growth numbers, I really hope messaging in general doesn’t all get sloppified along with code lol.

I think AI writing makes humanities and writing courses more important, and I hope people maintain their sense of taste with writing, but tbh I’m not optimistic here.

Having Kids (2019) 4 months ago

My favorite part is how pg says how kids made him less ambitious, but then:

“On the other hand, what kind of wimpy ambition do you have if it won't survive having kids? Do you have so little to spare?”

Relevancy is a big point here. HN readers work in tech or are super interested in tech, YC companies do very technical things so hiring posts or launches tend to blend right in for the most part.

I think this overstates the “betrayal” angle.

A lot of great open source comes out of startups because startups are really good at shipping fast and getting distribution (open source is part of this strategy). Users can try the tool immediately, and VC funding can put a lot of talent behind building something great very quickly.

The startup model absolutely creates incentive risk, but that’s true of any project that becomes important while depending on a relatively small set of maintainers or funders.

I’m not sure an acquisition is categorically different from a maintainer eventually moving on or burning out. In all of those cases, users who depend on the project take on some risk. That’s not unique to startups; it’s true of basically any software that becomes important.

There’s no perfect structure for open source here - public funding, nonprofit support, and startups all suck in their own ways.

And on the point you make about public funding being slow: yeah, talented people can’t work full-time on important things unless there’s serious funding behind it. uv got as good as it is because the funding let exceptional people work on it full-time with a level of intensity that public funding usually does not.

Seems like in this new AI world that the word sandbox is used to describe a system that asks "are you sure".

I'm used to a different usage of that word: from malware analysis, a sandbox is a contained system that is difficult to impossible to break out of so that the malware can be observed safely.

Applying this to AI, I think there are many companies trying to build technical boundaries stronger than just "are you sure" prompts. Interesting space to watch.

I think there are some primitives for agents that need to be built out for better security and being able to reason about them.

Agents run on infra, they have network connectivity, they have ACLs and permissions that let them read+write+execute on resources, they can interact with other agents.

To manage them from both an infra and security perspective, we can use the existing underlying primitives, but it's also useful to build abstractions around them for management, kind of like how microservices encapsulate compute+storage+network together.

I think of agents as basically microservices that can act in non-deterministic ways, and the potential "blast radius" of their actions is very wide. So you need to be able to map what an agent can do, and it's much easier to do that if there are abstractions or automatic groupings instead of doing this all ourselves.

The PvP was so deep too. You would go 4v4 or 8v8 and coordinate a “3, 2, 1 spike” on a target so that all your damage would arrive at the same time regardless of spell windup times and be too much for the other team’s healer to respond to.

Could also fake spike to force the other team’s healer to waste their good heal on the wrong player while you downed the real target. Good times.

Data point of 1: Having hired juniors as a startup founder, I need more generalists than AI/ML specialists. AI application work right now is basically standard software engineering - you’re finding clever ways to supply the right context to a model within certain constraints.

No one knows what’s going to happen in the future. Yes there already are fewer SWE jobs than before because of AI, and yes the days of companies hiring new grads in droves at $300k+ packages are likely over. IMO all you can really do is study what you’re interested in, learn it deeply, and do good work with cool people. If unsure, it’s possible to go back to what you were doing before if the new path doesn’t work out.

MacBook Neo 5 months ago

I still find it funny that for my personal setup I have a $700 Macbook Air but a $1500 iPhone Pro and it feels like it makes sense.

Partial agree. YC created HN, though the HN community is very much _unlike_ anything I've seen at YC.

HN is deeply skeptical, technical, cynical, sarcastic. It's a great place to learn new things and I've loved it since I found it in 2012.

The current startup climate (not just limited to YC) feels very AI bro YEAHHLETSFUCKINGGOO (and I say this as a founder myself having gone through YC recently in W25).

Does AutoRune still work on there with auto catcher when PKing? The concept of "having catch" on another player based on player ID was just crazy. All these weird bugs that ended up being core mechanics of PKing.

jQuery 4 6 months ago

I love tech hype cycles haha, I remember when you got laughed at for using jquery and now it seems everyone’s burned out and happy to go back to a simpler time

I didn't do IRC until early 2000s but I felt a lot of curiosity about being online with other people: were they from an opposite corner of the world? What was life like there? How interesting that we can talk to each other!

Just the act of getting online to seek out others was super niche, so I feel like it was a bit of a "finding your own tribe" experience for me.