Hacker News Reader

@homakov, so you can get a browser to trust a cookie from a HTTP response under a domain protected by HSTS?

Doesn't HSTS just mean that the browser will just always make HTTPS responses?