Hacker News Reader

Luckily JS in the browser does not have the ability to make arbitrary network connections (at least not yet).

Well JS can make GET and POST requests to arbitrary URLs, that is often enough for a DDoS.

It does, HTTP at least. That could be enough to DDoS even a large site.