Hacker News Reader

He did, but the problem is that any package anyone uses for anything could compromise security. So what could you use this with?

This sort of openness is an elegant weapon from a more civilized age.

These days the net is like a zombie movie where if you leave a crack in the boards covering the windows the arms will reach in.

View on HN

Ok, lets consider the authors example of SuperTinyIcons (https://github.com/edent/SuperTinyIcons). What are some possible ways you could send a PR, gain commit rights and then use it for compromising security?

Javascript in the SVGs?

For what benefit? Infecting a few dozen probably fairly small sites while ruining the credibility of the contributor’s account? It’s extremely obvious and would pretty quickly get caught, even if the article author doesn’t keep too close a tab on the repo.

Doesn’t seem worth it to me.

>So what could you use this with?

Dead projects and projects that are so young they are more likely to be abandoned than finished.

It doesn't work for projects that already have enough vetted members.

Reply on news.ycombinator.com