#120

YC open-sourced the harness that runs YC, and one CI key put 181 nodes inside Hugging Face

Y Combinator open-sourced QM, the agent harness it runs on, under MIT. The repo takes prose, not code. Tailscale's post-mortem: one stolen CI key, 181 nodes.

Listen to this edition

Y Combinator open-sourced QM, the multi-agent harness its accounting, legal, events and engineering teams run on. Then the README tells you not to send code. Describe the change you want as prose in adrs/, and YC’s own agents write the implementation.

QM is YC’s third pass at this. A Ruby agent loop came first, then more than 50 Hermes agents that YC says got hard to manage.

In today’s indie hacker news:

  • 🛠️ YC open-sourced QM, then refused your pull requests
  • 🔑 Tailscale apologized for a breach it never caused
  • 💸 An extension sells the seconds ChatGPT spends typing
  • 👥 Poly puts a whole team inside Claude Code
  • 📉 A tiny test universe hid an impossible architecture
  • 🎨 A kids drawing app found its first subscriber

TOP STORIES

SEND PROSE, NOT PULL REQUESTS

🚢 YC’s new repo is MIT licensed and closed to pull requests

YC's new repo is MIT licensed and closed to pull requests

The story: The repo went live on July 31 and took 2.4k stars and 215 forks in about a day. QM is short for quartermaster, per the launch essay. YC says it runs across accounting, legal, events and engineering, including building QM itself. Each person and each room gets its own memory, files, keychain view, permissions, crons and durable sandbox.

The contribution policy is what the Hacker News thread spent most of its 107 comments on. One commenter called it funny that an AI project written by AI insists on human-written text. @ycombinator got ahead of it, calling QM an experiment that’s early and has bugs.

The details:

  • Vendor agnostic: Pi, OpenCode, Codex and Claude Code all drive the same core, so you aren’t locked in.
  • Self hosted from one command: an npm exec bootstrap targets Fly or AWS in your own cloud account.
  • Three postures: Strict pauses every tool call for approval, Auto screens external data, Dangerous does neither.
  • A brand new repo: total history is 40 commits, against 10 open issues and 20 open pull requests.
  • One contributor is named claude: four names are listed, next to .claude and .codex/skills directories in the tree.

Why builders care: if agent-generated pull requests drown your repo, QM ships the first real answer. You can copy that policy tonight and never touch the software.

One more thing hiding in the tree: a shipped taste skill that bans the em dash outright. Speaking of multiplayer, two builders shipped a much smaller version of it today.

A VERY CANADIAN APOLOGY

🔑 Tailscale wrote the post-mortem for a breach it didn’t cause

Tailscale wrote the post-mortem for a breach it didn't cause

The story: Tailscale’s post, bylined Avery Pennarun, opens by establishing that no Tailscale vulnerability was found or exploited. Then it argues the company should have stopped the attack anyway.

“The attack didn’t exploit Tailscale, and Tailscale didn’t cause the compromise. But, we didn’t stop it.”

After the AI agent got root on a Kubernetes node, it read one production secret object holding 136 keys. Exactly one was a reusable Tailscale auth key. Over several days it enrolled 181 attacker nodes onto Hugging Face’s tailnet, a count Hugging Face’s timeline records independently.

The details:

  • Blast radius equals tag scope: the key carried a CI automation tag, and every enrolled device inherited its ACLs.
  • That tag saw 22 nodes: subnet routers, regional exit nodes, and the connector bridging to source control. Running tailscale status --json listed them.
  • The client ran quiet: the sandboxes had no TUN device, so tailscaled ran in userspace behind a local SOCKS5 proxy. Two flags kept state in memory and suppressed telemetry.
  • The pivot was the cheap part: the tailnet phase logged 115 recovered actions, against 6,972 in the dropper phase.
  • The fix is free and unused: Tailscale’s answer is workload identity federation, and it concedes not enough people use it.

Why builders care: if you run Tailscale for CI, the same shape is probably in your secret store. Nobody at Hugging Face got paged when the strange nodes joined, and most tailnets have no such alert either.

The Hacker News thread gave it 492 points and 192 comments. The loudest objection was that convenient defaults, not the stolen key, are the real defect.

💸 An extension sells the dead seconds while ChatGPT types

An extension sells the dead seconds while ChatGPT types

The story: Chatwait drops one sponsored card into the empty space below your message while ChatGPT, Claude or Gemini generates. You get 50 percent of what the advertiser paid, no click required. Its own auction table clears between $1.39 and $2.10 per 1,000 views. The FAQ calls the result “coffee money, not a salary.”

The extension is open source and asks for storage plus four host permissions, with no browsing history, cookies or tabs. That’s the whole trust pitch. The launch post says it doesn’t read your chats and invites you to check.

The details:

  • Dwell time is the meter: an impression only pays after five seconds of visible, focused attention on the card.
  • The card yields to the landlord: Chatwait hides itself whenever the host is already showing its own ad.
  • The landing page contradicts itself: the stat block prints 44 percent, under a hero that promises half.
  • The idea has a twin: a rival called uwait runs the same two headlines across 8 assistants, against 3.
  • Distribution says two things: the README explains a local install, while the site links to the Chrome Web Store.

Why builders care: OpenAI said on January 16 it plans to test ads at the bottom of ChatGPT answers. That makes the roadmap and the inventory the same square of screen, and the extension already concedes it.

PLAYER TWO HAS NOT ENTERED

👥 Two builders shipped a shared room for Claude Code

Two builders shipped a shared room for Claude Code

The story: Poly puts every prompt, reply, tool call and diff from a Claude Code session into one shared timeline. Teammates watch a turn happen live, queue the next one behind it, or stop a bad edit before it runs. Two people built it over a few weeks, and wrote the whole thing inside its own rooms.

The billing design is the actual product. Every member brings their own Anthropic API key. Each turn runs on its author’s key and model, and the receipt lands in the room. Turns run in an isolated sandbox, so a teammate’s prompt can’t reach your key.

The details:

  • The gap is in Anthropic’s own tracker: issue #60082 asked for multi-user sessions on May 18, still open.
  • Nobody is watching it either: 2 thumbs up, 3 commenters, and no maintainer reply on the captured page.
  • Share links only watch: claude.ai share links are read only by design, and tmux sharing is the unofficial workaround.
  • Agent teams parallelize one human: the feature stays experimental, off by default, scoped to one session.
  • Anthropic’s shared answer lives in Slack: Claude Tag launched June 23 in beta for Enterprise and Team customers only.

Why builders care: Per-turn spend attribution across separate accounts is the part Anthropic has no reason to build. The request sits under the area:cowork label, so assume the shared timeline itself eventually ships for free.

One commenter on the launch thread runs an 18-agent Claude Code cron stack and says coordination is the hardest part. They cut back to three or four per project.

TWELVE TICKERS TOLD A LIE

📉 His optimizer looked fine because the test universe was tiny

His optimizer looked fine because the test universe was tiny

The story: Reverse Efficient Frontier inverts Modern Portfolio Theory. You set a target return and risk tolerance, and it finds the stock blend that matches. Version one fired the optimizer on every slider change, like a database query.

That works forward, where you hand a solver a fixed set of stocks and solve for weights. Picking k stocks out of N is a different problem class. Every candidate set needs its own optimization run before you can compare them. In the founder’s writeup it never showed up as slowness, because the test universe was twelve tickers.

The details:

  • Sample, don’t enumerate: the rebuild samples thousands of subsets, optimizes each, and keeps a dense point cloud.
  • One start wasn’t enough: single-start SLSQP once put 97 percent into one ticker. Randomized starts and hard weight bounds fixed it.
  • Precompute and park: a scheduled Databricks job writes results as JSON to Blob Storage behind a CDN.
  • The phone stopped optimizing: it does a nearest neighbor lookup, under a second on a mid-range handset.
  • The sector panel lied too: on three aerospace-adjacent names it reported 100 percent Other. The real risk was correlation.

Why builders care: any product that answers the same question for every user can make that trade today. Compute stops scaling with traffic, and becomes a fixed line you can forecast.

The sharpest note came from commenter PriorElephant9: “Bounded weights stop one ticker dominating. They do not stop ten tickers being the same trade.”

  • 🏪 Online or a boring offline business - a tutor turned founder says the online ceiling is low. The online tax is competition, the offline tax is capital, and neither one hands you customers.
  • ✅ A habit tracker built for an audience of one - a weekend build, designed for the maker rather than a market. That’s the cheapest way to find out whether a category bores you before you commit a year.

FIRST DOLLAR

THE FIRST ONE ALWAYS COUNTS

🎨 Two months of building, one paying subscriber

WeeArtists is a step-by-step drawing app for kids. It has been live about two months, growth has been slow, and today it took its first subscription. The builder calls it a small milestone financially and a large one otherwise, which is the correct read.

STACK OF THE DAY

🌐 A browser that just passed Acid 3

This one is two years of solo work on a new browser, and today it passes Acid 3. That test is a museum piece now, but passing it still means a working layout engine and DOM. Worth a look if you have ever wondered how deep the web platform goes.

Not sponsored. We just feature tools builders would actually use.

BOOKMARKED TODAY

See you tomorrow. Reply and tell me what you shipped this week.

Curated by AI, built by a human.