HN user

danenania

8,083 karma

Currently an engineer at OpenAI working on Codex Security.

Past founder of Plandex: an open source AI coding agent - https://plandex.ai | dane@plandex.ai

Also past founder of EnvKey (YC W18): the simple, secure, open source configuration and secrets manager - https://www.envkey.com | dane@envkey.com

@Danenania on the twitters.

Posts54
Comments2,769
View on HN
www.promptfoo.dev 7mo ago

Building a Security Scanner for LLM Apps

danenania
7pts3
www.promptfoo.dev 8mo ago

Will agents hack everything?

danenania
6pts9
medium.com 1y ago

Battle of the AI Code Assistants: Who Writes the Best Python Integration Code?

danenania
5pts0
github.com 1y ago

Show HN: Plandex v2 – open source AI coding agent for large projects and tasks

danenania
257pts81
plandex.ai 1y ago

Show HN: Plandex v2 – OSS AI coding agent w/ diff sandbox, full auto, 2M context

danenania
4pts0
news.ycombinator.com 2y ago

Ask HN: Do you use AI for writing?

danenania
2pts0
github.com 2y ago

Plandex 1.1.0 – LLM driven development in the terminal. Now multi-modal.

danenania
13pts6
www.youtube.com 2y ago

Building C/OpenGL Pong With AI [video]

danenania
2pts0
www.foundingsales.com 2y ago

Founding Sales: The Founder Led Sales and Early Stage Go-to-Market Handbook

danenania
1pts1
news.ycombinator.com 2y ago

Ask HN: What's with the gatekeeping in open source?

danenania
1pts6
www.youtube.com 2y ago

Fixing a real-world bug with AI using Claude Opus 3 with Plandex [video]

danenania
1pts1
github.com 2y ago

Show HN: Plandex – an AI coding engine for complex tasks

danenania
304pts111
www.envkey.com 2y ago

Sloppy Secrets Management: What Are the Costs?

danenania
1pts0
www.envkey.com 2y ago

HashiCorp Vault vs. EnvKey for configuration and secrets management

danenania
2pts0
www.envkey.com 3y ago

Show HN: Envkey-VSCode – Autocomplete/type-checking for env vars in 46 languages

danenania
8pts0
news.ycombinator.com 4y ago

Tell HN: We simplified EnvKey's v2 pricing

danenania
2pts0
v2.envkey.com 4y ago

Show HN: EnvKey 2.0 – End-To-End Encrypted Environments (now open source)

danenania
225pts65
news.ycombinator.com 8y ago

Launch HN: EnvKey (YC W18) – Smart Configuration and Secrets Management

danenania
108pts63
techcrunch.com 8y ago

EnvKey (YC W18) is a smarter place to store API keys and credentials

danenania
11pts2
blog.envkey.com 8y ago

Secure Strategies for Managing Passwords, API Keys, and Other Secrets

danenania
3pts0
news.ycombinator.com 8y ago

Ask HN: How does your company manage secrets like API keys?

danenania
40pts27
blog.envkey.com 8y ago

Managing Passwords and Secrets: Common Anti-Patterns

danenania
3pts0
www.smbc-comics.com 8y ago

“The Talk” on Quantum Computing

danenania
2pts0
github.com 8y ago

Python library for EnvKey: a password manager for API keys and configuration

danenania
5pts1
www.envkey.com 8y ago

Show HN: EnvKey – securely manage API keys, credentials, and config

danenania
116pts50
www2.nybooks.com 9y ago

Autocracy: Rules for Survival

danenania
2pts0
xkcd.com 10y ago

XKCD On EM Drive – Quantum Vacuum Virtual Plasma

danenania
4pts0
thenextweb.com 10y ago

MakerSlate lets developers and designers add context to their resumes with ease

danenania
2pts0
makerslate.io 10y ago

Show HN: A better résumé for developers and designers

danenania
27pts8
www.smoothconversion.com 11y ago

Show HN: User Experience Report Cards

danenania
4pts1

Being one of the people on this list... yes I would personally say it's mainly about agency and determination, and being obsessive/perfectionist about details. I think YC selects for these traits much more than domain expertise or raw intelligence.

Now that I'm working at a large org (before this my career was purely in startups), I see the importance of this all the time. When you work on a significant project in a bigger org, you get blocked by all kinds of things. Most have very reasonable explanations, but you are blocked nonetheless. Many people just accept this and allow things to proceed pretty slowly, or they accept tradeoffs that make the product worse because it's the path of least resistance. If you want to go faster and not compromise on details, you often have to be persistent and willing to follow up on things to the point of being annoying, which feels similar to being a founder.

Claude Sonnet 5 22 days ago

I’d also point out that LLM inference revenue already totals more than 100B annually based on publicly reported numbers. Almost none of that is replacing knowledge workers. Almost all is increasing their productivity. So empirically what you describe is already happening to a nontrivial degree.

You can’t get every detail right up front, but you can build a robust foundation from the beginning.

The argument seems to be that AI is causing managers to demand faster results, and so everything has to be a one-shotted mess of slop that just barely works. My point is that it doesn’t take much longer to build something solid instead. Implementation time and quality/robustness are not tightly coupled in the way they used to be.

You’re assuming that building something robustly is significantly more time consuming than the “quick and dirty” version. But that’s not really true anymore. You might need to spend another hour or two thinking through the task up front, but the implementation takes roughly the same amount of time either way.

Line by line is no longer what I need to think about. I think about types/schemas, architectural division, contracts between services and components, how to test thoroughly, scaling properties, security properties, and these kinds of things.

That sounds pretty much the same as it’s always been? It used to be: “Does the happy path work? Then ship it! There’s no time to make it robust or clean up tech debt.”

Now there actually is time to make things robust if you learn how to do it.

thinking, abstracting, deciding how to apply your knowledge and experience, searching for information

None of this requires coding by hand. I can do those things better and faster with agents helping me. That incudes unfamiliar areas where I am effectively a junior.

That’s also true without AI. Engineers want more time to polish and businesses want to ship the 80/20 solution that’s good enough to sell. There's always going to be a tension there regardless of tools.

This is a great point. We’re very much in a transitional phase on this, but I personally do see signs in my own work with agents that we are heading toward the main deliverable being a readme/docs.

The code is still important, but I could see it becoming something that humans rarely engage with.

If a junior builds something with agents that turns into a mess they can’t debug, that will teach them something. If they care about getting better, they will learn to understand why that happened and how to avoid it next time.

It’s not all that different than writing code directly and having it turn into a mess they can’t debug—something we all did when we were learning to program.

It is in many ways far easier to write robust, modular, and secure software with agents than by hand, because it’s now so easy to refactor and write extensive tests. There is nothing magical about coding by hand that makes it the only way to learn the principles of software design. You can learn through working with agents too.

GPT-5.4 5 months ago

tmux makes it easy for terminal based agents to talk to each other, while also letting you see output and jump into the conversation on either side. It’s a natural fit.

GPT-5.4 5 months ago

Gemini 1.5 Pro actually has 2M!

No other model from a major lab has matched it since afaik.

Edit: err, I see in the comment below mine that Grok has 2M as well. Had no idea!

GPT-5.4 5 months ago

I built a tool at work that allows claude code and codex to communicate with each other through tmux, using skills. It works quite well.

The correct answer is “Postgres would handle it, but if it needed to scale even higher, I’d…”

The point of a system design interview is to have a discussion that examines possibilities and tradeoffs.

I have a similar process and have thought about committing all the planning files, but I've found that they tend to end up in an outdated state by the time the implementation is done.

Better imo is to produce a README or dev-facing doc at the end that distills all the planning and implementation into a final authoritative overview. This is easier for both humans and agents to digest than bunch of meandering planning files.

I’m very pro AI coding and use it all day long, but I also wouldn’t say “the code it writes is correct”. It will produce all kinds of bugs, vulnerabilities, performance problems, memory leaks, etc unless carefully guided.

How I estimate work 6 months ago

The date is just a useful fiction to:

- Create urgency

- Keep scope creep under control

- Prioritize whatever is most valuable and/or can stand on its own

If you just say “I don’t know” and have no target, even if that’s more honest, the project is less likely to ever be shipped at all in any useful form.

I don’t think “ready to merge” necessarily means the agent actually merges. Just that it’s gone as far as it can automatically. It’s up to you whether to review at that point or merge, depending on the project and the stakes.

If there are CI failures or obvious issues that another AI can identify, why not have the agent keep going until those are resolved? This tool just makes that process more token efficient. Seems pretty useful to me.