Well, you could post a linkbait article that pulled in some javascript with an exploit in it. Everything here is public except the IP addresses behind the usernames.
I think he meant for hiding malware on the rendered pages a HN user sees - doxing most people here would probably not be so hard (especially for GCHQ).
