simonbrown

Neither is this.

It's still possible for a MITM to use the old certificate.

Did you consider grandfathering existing users in?

It's possible to apply to have your ads unblocked if they're unobtrusive.

https://eyeo.com/acceptable-ads-application.html

Tom Preston-Werner - http://tom.preston-werner.com/

I've been using Google to find things on HN for a few years.

The file from January 2013 appears just as permissive:

http://web.archive.org/web/20130109093744/http://news.ycombi...

> Most users will click through a security certificate warning generated by their browsers for the sake of convenience.

This can be avoided by using HSTS.

How are you detecting whether they have JS disabled?

Or make the option to disable Java accessible from there.

For the Chrome extension, you probably don't need to request permissions on tosdr.org. If you send CORS headers from that site, you will be able to make requests to it without the permissions.

With any CA's (or better, the right one's) private key, they could still use it to stage a MITM attack on the website, assuming they have the right access.

It might be better as a Bootstrap theme, so that people can easily switch between them.

The chances are you won't, since most businesses fail.

What if natural resources are scarce?

Even having an email address to send reports to would be good for a lot of websites. I sometimes don't bother reporting these issues for fear of being threatened with legal action.

That's already possible. I guess this will make it easier, though.

Chrome displays a permission dialog.

How are you dealing with the copyright of the images?

What should we use instead?

> Also, on other note: username is Not an email address. Do not ask me for my username when you really mean email address.

Are you saying that sites should allow users to use email addresses to log in, rather than usernames? As I understand it, the former is a more recent thing.

The URL you're using for the iframe works under HTTPS.

I don't think free public repositories are gift to the open source community, but freemium system designed to get people to convert to paid accounts with additional features. This project doesn't require the additional features.

If it was share-alike, why would companies develop tutorials, since they could be re-published by other companies at close to cost price?

What should they use for password resets?

This reminds me of Up and Down the Ladder of Abstraction:

http://worrydream.com/LadderOfAbstraction/

> And when you outgrow it, we'll grow with you. Automatically.

Does this mean that when you exceed your quota, Docverter starts charging you more without your permission?

I don't see how 3rd and 4th examples aren't superior to green.

Can Android apps without network permissions open pages in the browser? If so, there's one way.

So move it to another host?

How do you know?