Hacker News Reader

Google Docs is in HTTPS so they need to proxy the assets like Github does : https://github.com/blog/743-sidejack-prevention-phase-3-ssl-...

Interesting. I never thought of that. It seems almost silly that you're bringing insecure content over a secure channel like that but then again it is only images.

"only images"

As long as they don't do WMFs, with their code-injection-by-design functionality...

http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability

The function lets you specify height/width, passing it through makes some sense. It's also usually (though not in this case) to not hot link--a document can be viewed by thousands of people. There are some privacy issues too, viewing a Google Doc could have your browser making requests to unknown servers that could return whatever they want.

Perhaps the server needs to know the image dimensions for page layout.

They use quite a bit of HTML 5 so they should be able to do this client-side I would imagine. But I dunno.