Hacker News Reader

Wouldn't this allow someone to do a full man in the middle attack with a compromised server/dns server?

If it were the actual cert they're using, yes.

Oh I see now that it's just the self signed cert. Awesome :)