Neither is this.

It's still possible for a MITM to use the old certificate.

Did you consider grandfathering existing users in?

It seemed that he was trying to move the existing users from costing him money to at least a break even situation. In this case grandfathering existing users would have propagated a negative cash flow.

It's possible to apply to have your ads unblocked if they're unobtrusive.

https://eyeo.com/acceptable-ads-application.html

Tom Preston-Werner - http://tom.preston-werner.com/

Looks like Tom hasn't actually blogged in 2 years though. That's not really very regular...

I've been using Google to find things on HN for a few years.

The file from January 2013 appears just as permissive:

http://web.archive.org/web/20130109093744/http://news.ycombi...

I have been too. I was surprised to find that HN didn't show up on Google a couple weeks ago. Yes, it looks like I was wrong. No, pg isn't changing titles because of SEO.

> Most users will click through a security certificate warning generated by their browsers for the sake of convenience.

This can be avoided by using HSTS.

How are you detecting whether they have JS disabled?

Or make the option to disable Java accessible from there.

You want to add an option to disable a particular browser plugin in the core browser options? That doesn't seem like a good idea.

For the Chrome extension, you probably don't need to request permissions on tosdr.org. If you send CORS headers from that site, you will be able to make requests to it without the permissions.

And it’s fixed for the Chrome extension: https://chrome.google.com/webstore/detail/terms-of-service-d... Thank you again for the pointer. :)

Thanks! Opened an issue on our tracker, chime in if you like: https://github.com/tosdr/tosdr-chrome/issues/5