Hacker News Reader

I wonder how they manage the SHA-1 fallback? Guess it might be a proxy which decides it, based on the user-agent.

By examining the ClientHello.

Wouldn't this make modern browsers vulnerable to a downgrade attack via an active MITM?

Modern browsers are removing SHA-1 support. The MITM would not be able to downgrade them to something they've removed.