Hacker News Reader

"I thought leaving my door key under my matt was a bad idea, but then I realized that if someone wanted into my house, they could just break my window!"

I'm not saying your making the wrong decision, it's a trade-off that everyone needs to make individually. If your happy with your Echo, great! But just because someone has one attack-vector on you doesn't mean you should dismiss new attack vectors.

View on HN

You should be more worried about using npm. How do you know that when you install 100 of different dependencies, there isn't one that is turning on your mic and listening to your conversations?

The Echo is an unlikely device to be compromised and recording everything you say, because it's pretty locked down and definitely not a general purpose computer.

(I don't use npm, but I do use other repos) The difference between an Echo and repo-code is that repo-code is open-source. I can verify it's running what it's running. AFAIK, there's no way to do that with the Echo.

> it's pretty locked down

source? AFAIK you can't verify what it's doing, so it doesn't matter how well it's locked down.

Reply on news.ycombinator.com