<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: packtreefly</title><link>https://news.ycombinator.com/user?id=packtreefly</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Thu, 16 Apr 2026 07:22:11 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=packtreefly" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by packtreefly in "Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem"]]></title><description><![CDATA[
<p>It's painful, but I've grown distrustful enough of the ecosystem that I disable updates on every IDE plugin not maintained by a company with known-adequate security controls and review the source code of plugin changes before installing updates, typically opting out unless something is broken.<p>It's unclear to me if the code linked on the plugin's description page is in amy way guaranteed to be the code that the IDE downloads.<p>The status quo in software distribution is simultaneously convenient, extraordinarily useful, and inescapably fucked.</p>
]]></description><pubDate>Sun, 14 Dec 2025 23:47:12 +0000</pubDate><link>https://news.ycombinator.com/item?id=46268443</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=46268443</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46268443</guid></item><item><title><![CDATA[New comment by packtreefly in "Ask HN: Is there a temp phone number like temp email?"]]></title><description><![CDATA[
<p>They exist. Services treat control of the number as equivalent to control of the account, and expect you to maintain that control.<p>Throwaway phone numbers are not a viable low cost or no cost alternative in most normal user signup scenarios, and they're implemented as a privacy invasive form of spam prevention for that exact reason.</p>
]]></description><pubDate>Wed, 27 Aug 2025 15:45:00 +0000</pubDate><link>https://news.ycombinator.com/item?id=45041242</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=45041242</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45041242</guid></item><item><title><![CDATA[New comment by packtreefly in "Bruteforcing the phone number of any Google user"]]></title><description><![CDATA[
<p>> It’s surprising how something that seems harmless, like a simple recovery page, can actually hide some pretty serious security risks.<p>This is something you should include in any personal security checkup. Attempt account recovery using every allowed mechanism. The rules for recovery change over time in a way that classical login doesn't.</p>
]]></description><pubDate>Tue, 10 Jun 2025 06:31:08 +0000</pubDate><link>https://news.ycombinator.com/item?id=44233325</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=44233325</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44233325</guid></item><item><title><![CDATA[New comment by packtreefly in "The time bomb in the tax code that's fueling mass tech layoffs"]]></title><description><![CDATA[
<p>"ThE tAx CuT pAyS fOr ItSeLf"</p>
]]></description><pubDate>Sun, 08 Jun 2025 15:35:01 +0000</pubDate><link>https://news.ycombinator.com/item?id=44217598</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=44217598</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44217598</guid></item><item><title><![CDATA[New comment by packtreefly in "The cryptography behind passkeys"]]></title><description><![CDATA[
<p>I put the passkeys in a password manager, then lock the password manager with multiple physical Yubikeys, keeping several in secure storage.<p>This same pattern works for Google/iCloud accounts.</p>
]]></description><pubDate>Thu, 15 May 2025 18:09:25 +0000</pubDate><link>https://news.ycombinator.com/item?id=43997675</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=43997675</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43997675</guid></item><item><title><![CDATA[New comment by packtreefly in "Ask HN: can Wireless-CarPlay dongles steal your data?"]]></title><description><![CDATA[
<p>>I kinda just don't get wireless CarPlay/Android Auto at all.<p>In addition to your argument, wireless CarPlay is also notoriously unreliable.[1]<p>[1]: <a href="https://www.google.com/search?q=wireless+carplay+not+working+reddit" rel="nofollow">https://www.google.com/search?q=wireless+carplay+not+working...</a></p>
]]></description><pubDate>Sat, 29 Mar 2025 04:42:40 +0000</pubDate><link>https://news.ycombinator.com/item?id=43512797</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=43512797</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43512797</guid></item><item><title><![CDATA[New comment by packtreefly in "Ask HN: can Wireless-CarPlay dongles steal your data?"]]></title><description><![CDATA[
<p>If the dongle acts as a wifi AP with a DHCP server, it could give the iPhone an ip address but no gateway upon connection. This will cause the iPhone to talk directly to the dongle via the WiFi interface, but talk to the rest of the internet via the cellular connection.<p>You can determine this by checking the WiFi network's properties after the connection is established. If there's no value in the "Router" field, that's how it works.<p>Once you load the firmware update page, JavaScript on the page instructs the browser to fetch the firmware payload from a server on the public Internet, then relays that data to the dongle's web server to execute the firmware update process.<p>As the other reply mentioned, this can be tricky, as CORS likes to prevent this kind of data transfer for security reasons, the right configuration on the web server will make it work.<p>It's a fairly clever setup.<p>If you want a low-tech way of confirming this design, try running the firmware update with a device that doesn't have two network connections, like a laptop, instead of a cell phone. If it doesn't work from such a device, the scenario I described above is probably how it works.</p>
]]></description><pubDate>Thu, 27 Mar 2025 03:17:56 +0000</pubDate><link>https://news.ycombinator.com/item?id=43490074</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=43490074</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43490074</guid></item><item><title><![CDATA[New comment by packtreefly in "Imagine telling 2010 devs that in 2025, collapsing a div would require $8/ month"]]></title><description><![CDATA[
<p>To keep with that analogy, customers expect the SaaS company to respond to the HTTP requests for free, but you still have for-profit factories producing servers...</p>
]]></description><pubDate>Fri, 21 Mar 2025 13:28:12 +0000</pubDate><link>https://news.ycombinator.com/item?id=43435421</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=43435421</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43435421</guid></item><item><title><![CDATA[New comment by packtreefly in "Feds Link Cyberheist to 2022 LastPass Hacks"]]></title><description><![CDATA[
<p>No. I used both of them when migrating from LastPass, and found that Bitwarden only supports four or five types of entries, which ultimately drove me away from the product.<p>The rich entry types from 1P and LP are nearly all converted to Notes in Bitwarden. Great product otherwise.</p>
]]></description><pubDate>Sat, 08 Mar 2025 16:30:36 +0000</pubDate><link>https://news.ycombinator.com/item?id=43301368</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=43301368</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43301368</guid></item><item><title><![CDATA[New comment by packtreefly in "DOGE puts $1 spending limit on government employee credit cards"]]></title><description><![CDATA[
<p>That's the endgame I see.<p>Oligarchy. Kleptocracy. Morons cheering because they're deluded enough to believe that the definition of "pork" is when the government transfers money directly to lower and middle class via paychecks.<p>Congress will authorize contractors to do these jobs instead. We get back privatized versions of the old government services at a higher price, and the money goes into the bank accounts of the rich.<p>I'd like to read the CBO report on what this shit will actually cost over ten years.</p>
]]></description><pubDate>Fri, 21 Feb 2025 04:36:00 +0000</pubDate><link>https://news.ycombinator.com/item?id=43124067</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=43124067</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43124067</guid></item><item><title><![CDATA[New comment by packtreefly in "Parents were injured in a Tesla crash. She ended up having to pay Tesla damages"]]></title><description><![CDATA[
<p>It's currently accessible to law enforcement via the law-abiding manufacturer acting as sole custodian. I don't see how this makes any difference.</p>
]]></description><pubDate>Thu, 13 Feb 2025 16:19:13 +0000</pubDate><link>https://news.ycombinator.com/item?id=43037535</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=43037535</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43037535</guid></item><item><title><![CDATA[New comment by packtreefly in "Parents were injured in a Tesla crash. She ended up having to pay Tesla damages"]]></title><description><![CDATA[
<p>That counts as begging from my point of view.<p>> Good luck getting data this easily from any other major manufacturer<p>This is an industry-wide problem.</p>
]]></description><pubDate>Thu, 13 Feb 2025 16:15:45 +0000</pubDate><link>https://news.ycombinator.com/item?id=43037475</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=43037475</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43037475</guid></item><item><title><![CDATA[New comment by packtreefly in "Parents were injured in a Tesla crash. She ended up having to pay Tesla damages"]]></title><description><![CDATA[
<p>The problem isn't that the owner didn't get the data. The problem is that the method for getting the data is that you must beg Tesla for it, rather than just slurping it out of a USB port inside the car.<p>If Tesla is going to go to the trouble of uploading all this shit to the cloud anyway, the least they can do is give customers a no-questions-asked download button.</p>
]]></description><pubDate>Wed, 12 Feb 2025 06:58:10 +0000</pubDate><link>https://news.ycombinator.com/item?id=43022620</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=43022620</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43022620</guid></item><item><title><![CDATA[New comment by packtreefly in "Ask HN: Is onboard audio still good enough compared to dedicated Sound Cards?"]]></title><description><![CDATA[
<p>I'd recommend any good sound device that connects digitally, like USB or HDMI/Displayport.<p>So the answer is that you should get a dedicated sound device, but don't bother looking for an internal card. External devices are easier to connect, won't complicate upgrades, and can be attached to a different machine with less work.<p>Onboard has always been good enough, it's just that people are usually willing to accept trash.</p>
]]></description><pubDate>Thu, 30 Jan 2025 23:09:53 +0000</pubDate><link>https://news.ycombinator.com/item?id=42883163</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=42883163</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42883163</guid></item><item><title><![CDATA[New comment by packtreefly in "Steam Brick: No screen, no controller, just a power button and a USB port"]]></title><description><![CDATA[
<p>> not having a mouse plugged in will mean you have no mouse cursor when remoting in.<p>Parsec has a setting to fix that too. Look in the host options.</p>
]]></description><pubDate>Sun, 26 Jan 2025 03:57:10 +0000</pubDate><link>https://news.ycombinator.com/item?id=42827579</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=42827579</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42827579</guid></item><item><title><![CDATA[New comment by packtreefly in "DoubleClickjacking: A New type of web hacking technique"]]></title><description><![CDATA[
<p>It is the height of irony to me that a blog post complaining about clickjacking is presented on a website that is guilty of scrolljacking.</p>
]]></description><pubDate>Fri, 17 Jan 2025 20:56:43 +0000</pubDate><link>https://news.ycombinator.com/item?id=42743138</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=42743138</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42743138</guid></item><item><title><![CDATA[New comment by packtreefly in "Magic/tragic email links: don't make them the only option"]]></title><description><![CDATA[
<p>We've got similar opinions here. I'm just pointing out that the overall experience here feels familiar, and it wasn't until reading this thread that I really put it together.<p>I agree with you that I'd be surprised if Enshittification works as well here as it does in tech, but maybe since there's an app involved, they just think they can get away with it. Who knows.</p>
]]></description><pubDate>Thu, 09 Jan 2025 04:12:04 +0000</pubDate><link>https://news.ycombinator.com/item?id=42641550</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=42641550</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42641550</guid></item><item><title><![CDATA[New comment by packtreefly in "Magic/tragic email links: don't make them the only option"]]></title><description><![CDATA[
<p>> they also removed the best deals from the app<p>They've captured the user base with the money that corporate was pumping into the app deals, and are in the process of enshittifying it by transferring the value to themselves instead of the users.</p>
]]></description><pubDate>Wed, 08 Jan 2025 17:21:53 +0000</pubDate><link>https://news.ycombinator.com/item?id=42636359</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=42636359</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42636359</guid></item><item><title><![CDATA[New comment by packtreefly in "Magic/tragic email links: don't make them the only option"]]></title><description><![CDATA[
<p>I will sadly admit that the high price of fries only angers me when they're not fresh.</p>
]]></description><pubDate>Wed, 08 Jan 2025 17:15:20 +0000</pubDate><link>https://news.ycombinator.com/item?id=42636288</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=42636288</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42636288</guid></item><item><title><![CDATA[New comment by packtreefly in "Magic/tragic email links: don't make them the only option"]]></title><description><![CDATA[
<p>> The development environment where I'm downloading random libraries is on a completely separate physical machine than my primary computer. I generally spin up a short-lived container for each new coding project, that gets deleted after the resulting code I produce is uploaded somewhere. This is completely separate from the work-supplied machine where I hack on my employer's code.<p>Something like VS Code remote dev with a container per project? Just plain docker/podman for containers?<p>> On my primary computer, my web browser runs in an ephemeral container that resets itself each time I shut it down. My password manager runs in a different, isolated, container. Zoom runs in a different, also isolated, container. And so on.<p>Qubes, or something else? I've been looking at switching to Linux for a while, but Apple Silicon being as good as it is has made making that leap extremely difficult.</p>
]]></description><pubDate>Wed, 08 Jan 2025 06:13:14 +0000</pubDate><link>https://news.ycombinator.com/item?id=42631514</link><dc:creator>packtreefly</dc:creator><comments>https://news.ycombinator.com/item?id=42631514</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42631514</guid></item></channel></rss>