4 ms·

A startup that uses agentic coding tools such as Claude Code or Codex is packaging up their entire codebase and sending it directly to their LM provider. Depend

A startup that uses agentic coding tools such as Claude Code or Codex is packaging up their entire codebase and sending it directly to their LM provider. Depending on their product, they might be sending it directly to a potential competitor. Odd times we are living in!

drchaim 4mo ago
and all their keys, because sooner or later, the harness is gonna read them
- ai-x 4mo ago
  One company's irrational fear is a competitive advantage for someone else.
- fastball 4mo ago
  Claude code is actually very good at not reading your keys these days.
  - drchaim 4mo ago
    Not the case for me. I tried .envs, ansible-vault and sops, and it always ends up reading the unencrypted ones for some reason, usually in debugging sessions, it finds a way to read them.
    - fastball 4mo ago
      Well it reads them, but (at least for me) it reads them in a way where it filters out the actual key values.
ai-x 4mo ago
people over-rate how much software/IP is useful in running a successful business. There are genuinely very few IP in this world that needs to be protected. Everyone else is running stupid CRUD apps They also over index fear of LargeCo stealing IP from SmallCo. In fact, LargeCo is typically more scared about even the possibility of any product team looking at competitor internals due to lawsuits.
- hnlmorg 4mo ago
  I’d be more scared of a data leak due to LargeCo being hacked than I would about LargeCo prying into the data. What I don’t trust LargeCo with is personal information. I’ve heard too many horror stories about Govs and LargeCos swapping customer nudes or stalking ex’s to be comfortable with anything personal on those systems. But that’s a whole different topic.
  - rkozik1989 4mo ago
    Well, I mean, basically any data leak violated privacy laws and opens you up to extremely expensive lawsuits to litigate. Anyone dealing with healthcare/patient data, police customers, military customers, etc. should not be using LLMs in general or at least ones that are not on-premise. Because if there is a data leak it could bankrupt the business.
    - hnlmorg 4mo ago
      There is a massive difference between using LLMs as coding agents, and using them to analyze PII like healthcare data.
- sly010 4mo ago
  > people over-rate how much software/IP is useful in running a successful business Indeed, by a couple trillions...
- switchbak 4mo ago
  LargeCo is probably struggling under the weight of technical debt and organizational challenges/politics. I bet if you gave them the Codebase of the Gods, it’d be a heap of hacks inside a couple months.
  - Peacefulz 4mo ago
    At a growing LargeCo now, and have been entrusted to some internal flows as an associate. I honestly don't know how Ops Managers get through the day. So many pipelines with basically non-existent audit trails. So much money leaking from the cracks in these places that it's criminal. I wouldn't trust these people to hold my beer, let alone sensitive data.
Ifkaluva 4mo ago
Not just “a startup”! Also, famously, Meta, with their famous AI usage dashboards
skybrian 4mo ago
Yes, it certainly is an odd situation when some people believe you cannot use Mythos-class models because security while others believe you must do code reviews with Mythos-class models because security.
stainablesteel 4mo ago
they would kill their own product if they did this it would be like if tsmc started designing their own chips to compete with the people they sell their services to, they have more to gain by limiting their participation to a specific corner
sreekanth850 4mo ago
A Startup using gitlab or github or bitbucket also have the same risk right?
- c0balt 4mo ago
  For self-hosted GitLab or BitBucket, no. GitHub enterprise (self-hosted) also no (though that is rather rare).
  - sreekanth850 4mo ago
    We are only talking about saas. every saas have access to your data at disc or storage level.
tobyhinloopen 4mo ago
You mean these tools you can now rebuild at the cost of a night and one Claude code subscription? You have to have an ordinarily unique startup if your software can’t be recreated quickly.
puttycat 4mo ago
100%. Companies are paperclip optimizers, with money as the objective. For example, Uber used ride data to circumvent investigations by regulators. There is absolutely no reason to assume that AI companies would not use their data in any way possible to reach their objectives.

drchaim 4mo ago

and all their keys, because sooner or later, the harness is gonna read them

ai-x 4mo ago
One company's irrational fear is a competitive advantage for someone else.
fastball 4mo ago
Claude code is actually very good at not reading your keys these days.
- drchaim 4mo ago
  Not the case for me. I tried .envs, ansible-vault and sops, and it always ends up reading the unencrypted ones for some reason, usually in debugging sessions, it finds a way to read them.
  - fastball 4mo ago
    Well it reads them, but (at least for me) it reads them in a way where it filters out the actual key values.

ai-x 4mo ago

people over-rate how much software/IP is useful in running a successful business. There are genuinely very few IP in this world that needs to be protected. Everyone else is running stupid CRUD apps They also over index fear of LargeCo stealing IP from SmallCo. In fact, LargeCo is typically more scared about even the possibility of any product team looking at competitor internals due to lawsuits.

hnlmorg 4mo ago
I’d be more scared of a data leak due to LargeCo being hacked than I would about LargeCo prying into the data. What I don’t trust LargeCo with is personal information. I’ve heard too many horror stories about Govs and LargeCos swapping customer nudes or stalking ex’s to be comfortable with anything personal on those systems. But that’s a whole different topic.
- rkozik1989 4mo ago
  Well, I mean, basically any data leak violated privacy laws and opens you up to extremely expensive lawsuits to litigate. Anyone dealing with healthcare/patient data, police customers, military customers, etc. should not be using LLMs in general or at least ones that are not on-premise. Because if there is a data leak it could bankrupt the business.
  - hnlmorg 4mo ago
    There is a massive difference between using LLMs as coding agents, and using them to analyze PII like healthcare data.
sly010 4mo ago
> people over-rate how much software/IP is useful in running a successful business Indeed, by a couple trillions...
switchbak 4mo ago
LargeCo is probably struggling under the weight of technical debt and organizational challenges/politics. I bet if you gave them the Codebase of the Gods, it’d be a heap of hacks inside a couple months.
- Peacefulz 4mo ago
  At a growing LargeCo now, and have been entrusted to some internal flows as an associate. I honestly don't know how Ops Managers get through the day. So many pipelines with basically non-existent audit trails. So much money leaking from the cracks in these places that it's criminal. I wouldn't trust these people to hold my beer, let alone sensitive data.

Ifkaluva 4mo ago

Not just “a startup”! Also, famously, Meta, with their famous AI usage dashboards

skybrian 4mo ago

Yes, it certainly is an odd situation when some people believe you cannot use Mythos-class models because security while others believe you must do code reviews with Mythos-class models because security.

stainablesteel 4mo ago

they would kill their own product if they did this it would be like if tsmc started designing their own chips to compete with the people they sell their services to, they have more to gain by limiting their participation to a specific corner

sreekanth850 4mo ago

A Startup using gitlab or github or bitbucket also have the same risk right?

c0balt 4mo ago
For self-hosted GitLab or BitBucket, no. GitHub enterprise (self-hosted) also no (though that is rather rare).
- sreekanth850 4mo ago
  We are only talking about saas. every saas have access to your data at disc or storage level.

tobyhinloopen 4mo ago

You mean these tools you can now rebuild at the cost of a night and one Claude code subscription? You have to have an ordinarily unique startup if your software can’t be recreated quickly.

puttycat 4mo ago

100%. Companies are paperclip optimizers, with money as the objective. For example, Uber used ride data to circumvent investigations by regulators. There is absolutely no reason to assume that AI companies would not use their data in any way possible to reach their objectives.