Hacker News Reader

If you're using this in your site as it stands, you are opening up XSS attacks as it does not appear to sanitise user input.

Only if you do something silly like serve cookies on that domain

I think this is ignoring the content of his warning and is a tautology.

"it's only opens up an attack if you allow the attack vector"