Hacker News Reader

No, protocol-relative is the way to go.

I think HTTPS isn't a bad idea. You don't want some MITM messing with your 3rd-party JS.

If you're loading your 3rd-party JS from an HTTP page, they already can.

Sure, but it's one less avenue for a MITM attack.