Top all-time · #7487
David Gilbertson
Personal blog · david-gilbertson.medium.comaiprogramming
David Gilbertson's personal blog at david-gilbertson.medium.com covers ai and programming. Since 2021, 11 different Hacker News readers have linked it 12 times, most often “Harvesting credit card numbers and passwords from your site”. It is still writing: the last post was on 2026-10-24, and you can follow it by feed.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
HN commenters link this Medium post, which imagines a developer harvesting credit card data through a package, when discussing malicious packages and supply-chain security in npm and VS Code extensions.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Harvesting credit card numbers and passwords from your site7 people · 7 mentions · first linked 2023-01-30
What Hacker News says?
None of those methods are even remotely reliable for filtering out bad code. See e.g. this excellent write up on how many methods there are to infect popular repos and bypass common security approaches [1] (including Github "screening"). The only thing that works nowadays is sandbox, sandbox, sandbox. Assume everything may be compromised one day. The only way to prevent your entire company (or personal life) from be…
Comment linking /im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5
on “I almost got hacked by a 'job interview'”Submitted Harvesting credit card numbers and passwords from your site as a story · 3 points
HN discussionI used to share this article with students https://david-gilbertson.medium.com/im-harvesting-credit-car...
Comment linking /im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5
on “We all dodged a bullet”Submitted The Three Types of Time as a story · 2 points
HN discussionI think I'm on the NIH side of things. Not because I like inventing things (well, partially), but because of the security problem [0]. I don't see it being talked about here, either. Our current system of pulling in packages made by random people on the internet is going to burn us. We assume that everyone who creates a package is an honest, reliable, developer who will not inject malicious code into their package.…
Comment linking /im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5
on “Ask HN: Why does every package+module system become a Rube Goldberg machine?”Submitted Can AI agents manipulate you into taking real-world actions? as a story · 2 points
HN discussionReminds me of https://david-gilbertson.medium.com/im-harvesting-credit-car...
Comment linking /im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5
on “VSCode Security: Malicious Extensions Detected- More Than 45,000 Downloads”Submitted Shrinking a language detection model to under 10 KB as a story · 1 points
HN discussionYour first paragraph reminded me of this article: https://david-gilbertson.medium.com/im-harvesting-credit-car... Imagine this scenario taking place with this package if someone got ahold of his NPM account.
Comment linking /im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5
on “So what’s next (personal news from developer of popular CoreJS polyfill”Submitted I found mistakes in OpenAI's HealthBench using AI as a story · 1 points
HN discussionSubmitted I'm harvesting credit card numbers and passwords from your site. (2018) as a story · 1 points
HN discussionSubmitted 2D Tokenization for Large Language Models as a story · 1 points
HN discussion